Privacy Policy — Chill Plays

Privacy Policy & GDPR Notice

Last updated: 16 July 2026 (rev. 4)

1. The short version

Chill Plays is a collection of free browser games with no accounts, no sign-up and no forms. The games themselves do not collect, store or transmit your guesses, results or any personal data. However, the site is funded by advertising served by Google AdSense, which may use cookies and similar technologies. For visitors in the EEA, UK and Switzerland, no advertising cookies are used before a consent prompt has been shown and answered, and consent can be refused or withdrawn at any time.

2. Who we are (Data Controller)

The data controller for this website is Drizzling Bytes LLC ("Chill Plays" is a project by Drizzling Bytes LLC). For any privacy matter, including exercising your rights under the GDPR, contact: [email protected]

3. What the game itself processes

Nothing personal. Game state (the hidden words, your guesses, lives) exists only in your browser's memory for the current session and is discarded when you close or reload the page. The games set a small number of localStorage entries (all prefixed mw-) that remember purely functional things: that you dismissed the first-visit notice, which tutorials you have completed, your preferred board size and keyboard layout, audio and appearance preferences (such as the circus performer's outfit), your level progress and unlocks, games you have bookmarked or marked with a heart, your own daily-challenge results and streaks, and a display name. Display names are always auto-generated (e.g. "ChillyPanda42") — you can shuffle and pick among generated options, but free-text names are not accepted, so no real names can be entered. The name is stored only on your device and is embedded in results only when you choose to share them. Apart from what you deliberately share, these entries never leave your device, are strictly necessary for those functions (no consent required under the ePrivacy rules), and can be removed at any time by clearing your browser's site data.

The site can be installed as an app and played offline: a service worker stores the games' files on your device so they keep working without a connection. This cache contains only the site's own files, never personal data. If you finish a daily challenge or press ♥ while offline, the anonymous +1 described below waits in a local queue on your device and is sent when you are back online; it contains no personal data either.

A small set of features send an anonymous +1 to our statistics database and nothing else: finishing a daily challenge (a "played" / "cracked" counter shown to everyone), clicking the ♥ heart on a game (a public "loved" tally), and aggregate gameplay statistics — the total number of times a game is started, won or lost, and how often each level is attempted or cleared. These are simple counter increments: no personal information, no IP address, no user ID and no gameplay detail is stored by us in connection with them, and the resulting totals are public aggregates. This helps us see which games people enjoy and which levels are too hard, so we can improve them. The transport of these requests is handled by our processor Google Firebase (see section 4). When you win a daily challenge, your auto-generated display name (e.g. "ChillyPanda42") and your result (e.g. "cracked in 3 guesses") are published on that day's public leaderboard. These names are generated pseudonyms — free-text names are not possible — so no personal data can appear there; you can switch to a new generated name at any time. We delete or further aggregate the day-level statistics and leaderboards within 24 months. Bookmarks (the ★) are stored purely on your device and are never transmitted.

4. Hosting & content delivery (Cloudflare, Google)

This site is served through Cloudflare (Cloudflare, Inc.). Like virtually all web servers, Cloudflare temporarily processes technical data needed to deliver the page and keep it secure — your IP address and standard request metadata (time, requested URL, user-agent) — and provides us only aggregate, cookie-less traffic statistics (e.g. total requests per country). See the Cloudflare Privacy Policy. A mirror of the site is additionally served from Google Firebase Hosting (Google LLC / Google Ireland Ltd), which processes the same kind of technical data when you access the site through it. The anonymous daily-challenge counters described in section 3 are stored in Google Firebase on servers in the United States (us-central1); requests to it carry the same kind of technical metadata. See Firebase Privacy and Security. The optional feedback link on the site leads to a questionnaire hosted on Google Forms; anything you choose to submit there goes directly to Google and is governed by the Google Privacy Policy.

We use Google AdSense to display advertisements. Google and its certified advertising partners may use cookies, web beacons and similar identifiers to serve ads, measure their performance, prevent fraud and — where you have consented — personalize the ads you see based on your visits to this and other websites.

EEA / UK / Switzerland: no advertising cookies are set until a consent message has been shown and you have made your choice. If you decline, only non-personalized ads (or no ads) with strictly limited technical processing are shown. You can change or withdraw your consent at any time via the “PRIVACY SETTINGS” link in the site footer (which reopens the consent tool) or by clearing this site's cookies.
Google as controller: for ad personalization and measurement, Google acts as an independent data controller. How Google uses data from sites that use its services is described at policies.google.com/technologies/partner-sites and in the Google Privacy Policy.
Your ad choices: you can opt out of personalized advertising at Google Ads Settings, aboutads.info/choices (US) or youronlinechoices.com (EU).
US state privacy rights (California CCPA/CPRA and similar laws in Colorado, Virginia, Connecticut and other states): we do not sell personal information ourselves. Interest-based advertising may qualify as "sharing" or "targeted advertising"; you can opt out via the links above or your browser's Global Privacy Control.

6. Legal bases (GDPR)

Consent (Art. 6(1)(a)) — personalized advertising and any advertising cookies in the EEA/UK/Switzerland; withdrawable at any time with effect for the future. Legitimate interest (Art. 6(1)(f)) — delivering the website you requested, keeping it secure, and strictly limited non-personalized ad delivery and fraud prevention where permitted.

7. Your rights

Under the GDPR (and similar laws such as the UK GDPR) you have the right to access, rectify, erase, restrict or object to processing of your personal data, the right to data portability, the right to withdraw consent, and the right to lodge a complaint with your local supervisory authority. For data processed by Google for advertising, you can also exercise choices directly via the links in section 5. You are always welcome to contact us and we will help where we can.

8. Children

The game's content is suitable for all ages, but the site is not directed at children. We do not knowingly collect personal data from children; ad personalization requires consent, which children under the applicable digital-consent age cannot give.

9. International transfers

Cloudflare and Google may process data on servers worldwide. Both Cloudflare, Inc. and Google LLC participate in the EU–US Data Privacy Framework and use Standard Contractual Clauses where applicable. We rely on these processors' standard data-processing terms (which incorporate the SCCs) for all processing they perform on our behalf.

10. Changes to this policy

If the site's data practices change (e.g. new features or ad partners), this policy will be updated first and the date above revised.