Privacy policy
Last updated October 11, 2026. This policy explains what Duotone (duotone.games) collects, why, and the choices you have.
The short version
- You can play without giving us your name or email address.
- We store your game progress so your stats and streak work.
- If you create an account, we store a username and a scrambled (hashed) version of your password.
- You can delete your data at any time from the account menu in the game.
What we collect
| Data | Why |
|---|---|
| A random player ID, stored in your browser's local storage, and a matching device token on our server (only a one-way hash of the token is stored) | To remember your progress, stats and streak without asking who you are. |
| Your games: which puzzles you played, each board you checked, how long you took, whether you solved them, and when | To restore a puzzle you're partway through and to calculate your stats. |
| Anonymous daily totals, such as how many players solved a puzzle | To show "how everyone did" after each puzzle and in the archive. These totals can't identify you. |
| Account details (only if you create an account): a username, a hashed password and a hashed recovery code | To let you sign in on several devices. We can't see your password or recovery code. |
| Technical data such as your IP address, browser type and the pages you request | Processed by our hosting provider, Cloudflare, to deliver the site, keep it secure and prevent abuse. We don't store IP addresses in our game database. |
We don't collect your name, email address, phone number, location or payment details. Your device's date is sent with each request only so we can show the right day's puzzle.
Cookies and local storage
Duotone doesn't use cookies. It uses your browser's local storage to keep your player ID, your board position and a few preferences, such as whether you've seen the instructions.
Who we share data with
- Cloudflare hosts the site and its database.
- Google provides the fonts used on the site (Google Fonts), which means your browser requests them from Google.
We don't sell your game data or account details. We would only disclose information if the law required it.
How long we keep data
We keep your game history and account for as long as you play, so your stats stay accurate. If you delete your data, it's removed from our database immediately; anonymous daily totals are kept because they contain nothing about you.
Your choices and rights
- Delete your data: open the account menu (the person icon in the game) and choose Delete account. This removes your player record, every game you've played and all your signed-in devices. Guests can do the same.
- Clear your device: clearing your browser's site data removes your local player ID and board positions from that device.
- Ask us: to access, correct or delete your data, or to ask any privacy question, email hello@duotone.games. Depending on where you live, you may have additional rights under laws such as the GDPR or the California Consumer Privacy Act, and we'll honor them.
Children
Duotone is a general-audience game and isn't directed at children under 13. We don't knowingly collect personal information from children under 13. If you believe a child has created an account, contact us and we'll delete it.
Security
Passwords and recovery codes are stored only as salted hashes, device tokens are stored only as hashes, and all traffic to the site is encrypted (HTTPS). Repeated wrong passwords temporarily lock an account.
Changes to this policy
If we change this policy, we'll update the date at the top of this page. Significant changes will also be noted on the game.
Contact
Questions about this policy: hello@duotone.games.