Privacy Policy — Saltfire

This site is operated by the AI Agency. Last updated 31 July 2026.

The short version

There is no account, so we never ask for your name, your email, or anything else that identifies you. There is nowhere in Saltfire to type anything, so you could not send us a personal detail even if you wanted to.

Your cabinet, your streak and today’s progress live in your own browser. When you finish a day, one number leaves it: how many merges the run took. That number is added to a public tally for the day and nothing is attached to it — no identifier, no account, no session, nothing that could point back at you.

What your browser sends us

Exactly one request carries anything about your play. When a run finishes, the app sends { "d": "2026-07-31", "steps": 7 } to /api/solve — today’s date and your merge count, and nothing else. (The app also reads the day’s totals from /api/day, which sends only the date you are looking at.)

On our side that becomes the day tally: one record per day, not one per player. The record holds how many runs finished, the total of their merge counts, how many matched par, and a histogram: one counter for each merge count from four to nineteen, and one for twenty and over. It carries no identifier, no IP address and no session id. The only time-based value in the record is the automatic expiry stamp, written once when the day’s record is created — so it marks roughly when that day’s first run finished, and every run after it leaves no time of its own and does not move the stamp. There is nothing in the record to join to a person, including by us, and your run is indistinguishable from anyone else’s that day. Each day’s record deletes itself automatically about 400 days after it is first written.

We publish a day’s median and its par rate only once at least 20 runs have finished it. Below that the page says so rather than showing a figure, because a percentage drawn from three people is not a fact.

Your device’s IP address reaches our servers as part of any web request, as it must for a page to be delivered at all. We do not store it and we never record it alongside the tally.

What stays on your device

Four entries in your browser’s localStorage, on this device only. None of them is a cookie, and none of them is ever transmitted anywhere:

• saltfire.cabinet — every element you have ever discovered, each with the day number you first found it on.
• saltfire.today — today’s run: the pairs you have tried, what they produced, your merge count, and whether you have solved it. A new day replaces it.
• saltfire.streak — your current streak, your best streak, and the day you last solved, so the counter knows whether a solve is consecutive.
• saltfire.prefs — your light/dark and reduced-motion preferences.

All four hold element names, day numbers and small integers. None of them holds anything personal, and because they live only in your browser they are also the only thing there is to erase: clearing this site’s data resets your streak and empties your cabinet, and we have no copy to restore them from.

Share cards and shared links

If you share a result, the link carries four numbers in its address — the day number, your merges, the day’s par and your streak — and our server draws those numbers into a preview image so the link unfurls as a card. That is the whole contents of a share link. It carries no identifier and it structurally cannot carry text, because the product has no text input on any screen. Drawing a card stores nothing.

Anyone you send the link to can see that card, so share it where you would like it seen. Opening a shared link shows the recipient the game, not your run.

Who else is involved

We keep the list of third parties as short as we can, and this is all of it:

• Google AdSense — serves the ads that pay for the site. Its cookies and how to opt out are covered in the next section.
• Google Analytics 4 — measures aggregate usage: page views, which screens people reach, how many merges a session takes, whether a run was shared. Apart from the address of the page you are on, every value we send it is a number or a fixed label, never anything you typed (there is nothing to type) and never anything that identifies you. It sets its own identifier in your browser, and we have no way to connect its measurements to the day tally above.
• Google Fonts — serves the two typefaces the site is set in, from fonts.googleapis.com and fonts.gstatic.com. Loading a page therefore makes a request to Google for the fonts.
• Amazon Web Services — hosts the site and runs our code and the day tally, as our infrastructure provider, processing requests on our behalf.

There is no other embedded third-party content: no social widgets, no trackers beyond the Google products named above, and no first-party cookies of our own.

Advertising and cookies

We use Google AdSense to show ads. Google and its partners use cookies (including the DoubleClick DART cookie) to serve ads based on your visits to this and other sites. You can opt out of personalised advertising via Google Ads Settings, or opt out of third-party vendor cookies at aboutads.info/choices. Consent is collected by Google’s certified CMP before any ad cookies are set.

You can change or withdraw that consent at any time, and you can clear cookies in your browser whenever you like.

Analytics and your consent choices

We want to be exact about what happens before you make a choice in the consent dialog, because the two halves are not treated the same. Advertising storage is denied until you choose — ad storage, ad user data and ad personalisation all start denied, and Google’s certified consent platform is what turns them on. Analytics storage is permitted by default, so Google Analytics 4 can measure a visit from the moment the page loads.

If you would rather it did not, you can block or clear the analytics cookie in your browser, use a tracker-blocking extension, or use Google’s Analytics opt-out add-on. Nothing in the game depends on analytics; blocking it costs you no feature.

Your rights under the GDPR

If you are in the UK or the EEA you have the right of access to your personal data, and the rights to rectification, erasure, restriction of processing, data portability, and to object to processing. You may withdraw consent at any time where processing rests on it, and you may lodge a complaint with your national supervisory authority.

In practice we hold no account and no identified record of you, so there is normally nothing of yours for us to hand over, correct or delete: the day tally carries no identifier that could single you out, and everything else lives in your own browser, where clearing site data erases it immediately. Ask us anyway and we will tell you honestly what exists.

Your rights under the CCPA / CPRA

If you are a California resident you have the right to:

• Know what personal information we collect, use and disclose, and why.
• Delete personal information we hold about you.
• Correct inaccurate personal information we hold about you.
• Opt out of the sale or sharing of personal information.
• Limit the use of sensitive personal information — we do not collect any.
• Non-discrimination — we will never give you a worse experience, a different price or fewer features for exercising any of these rights.

We do not sell personal information, and we do not share it for cross-context behavioural advertising beyond the advertising and analytics providers named above. To exercise any of these rights, email us at the address below; you may also use an authorised agent.

Children

Saltfire is intended for a general audience. It is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, email us and we will look into it and delete whatever we find.

Changes to this policy

If this policy changes we will update the date at the top of this page. That date is the one reliable way to tell whether what you are reading is current.

Contact and data rights

To exercise your GDPR or CCPA/CPRA rights, opt out of personalised ads, or ask a privacy question, email auto-ai-agency@quantum-solutions.hr. We respond to verified requests within 30 days.