Privacy
What we collect and why
Last updated 10 September 2026. This notice matches the live product — not a generator template.
Play without an account
You can solve today’s boards in the browser with no email. Progress, settings, and Unlock All live in this browser’s local storage until you sign in or pay.
If you sign in
We collect:
- Email — to send a magic-link sign-in (and email-change confirmation).
- Display name — optional, only if you join public daily leaderboards.
- Game progress — streaks, solves, and related stats synced to your account when signed in.
- Daily results — time, hints, and mistakes for each daily you finish, saved to your account so a finished daily reopens solved on any device. These are shown on the public leaderboard only if you opt in; opting out hides you from listings but does not stop your own results being saved.
- Device slot ids — anonymous browser ids so Unlock All can restore on up to 3 browsers.
We do not ask for a password. Magic links expire in 15 minutes.
If you buy Unlock All
Card details go to Stripe, not to Coronet. We store the checkout session id, receipt email, amount, and which browsers you’ve restored so we can honor the pass. Price is $2.99 USD.
Analytics
Vercel Web Analytics records page views and anonymous game events (open, win, share). No Google Analytics. No advertising cookies. No user ids in analytics.
Who receives data
- Cloudflare — Worker API + D1 database (accounts, sync, leaderboards, payment ledger).
- Resend — delivers sign-in and email-change messages.
- Stripe — Checkout and restore lookups.
- Vercel — hosts the site and anonymous analytics.
We do not sell personal data. Public leaderboards show only the display name and score you opted into.
How long we keep it
Account rows stay until you delete the account. Payment ledger rows stay as long as we need them to restore a purchase or meet bookkeeping rules. Magic-link tokens expire. Analytics are aggregated by Vercel.
Your choices
- Play as a guest — nothing is emailed.
- Stay off public leaderboards — default is off.
- Delete account — Settings → Account → Delete account. That wipes D1 profile, synced stats, leaderboard scores, and sessions. Stripe’s copy of the charge remains with Stripe. Local browser data is separate; clear site data if you want that gone too.
Children
Coronet Arcade is a general-audience puzzle site. We do not knowingly collect personal data from children under 13.
Contact
Email hello@coronet.one. Operator: Coronet Arcade at coronet.one.