Privacy Policy

1. Privacy-First Principles

MazeToMaze ("we", "our", or "us") is built around a privacy-first, account-free architecture. You do not need to create an account, log in, or provide personal credentials to play the game. We never sell your personal information or track you across third-party websites.

The game itself runs entirely on your device and plays fully without any server. A small amount of server infrastructure exists for one purpose only — sharing mazes with other people — and everything it stores is described in section 3. Nothing you do alone on your device is sent anywhere.

2. Local Game Data

All core gameplay data is processed locally in your browser or native device environment:

• Gameplay State & Persistence: Player statistics, streak counters, avatar selections, played maze history, and game preferences are stored strictly inside your device's browser localStorage.
• Shareable Race & Challenge Links: Shared race URLs encode maze seeds and completion times directly inside the URL hash fragment (#c= or #g=). A link in this form is evaluated entirely client-side and is never saved to a remote database.

3. Shared Mazes You Send (Public by Design)

When you create a share link, the game also stores a copy of that maze so the link can be short, previewable, and countable. Anything stored this way is public to anyone holding the link. There are no accounts and no sign-in; the unguessable link itself is the only key. Specifically:

• The maze and your chosen name: the same encoded maze bytes the URL already carries, plus the display name you typed (14 characters or fewer) and the time you set on that maze.
• The per-maze leaderboard: each player's chosen name, best/worst/average time, and attempt count for that one maze. This board is readable by anyone with the link.
• A preview image: your browser renders a card showing your name and your time, and uploads it so the link shows that card when pasted into a chat. It is readable by anyone who has its URL, including outside the game.
• A preview page: visiting a /p/<id> link returns a page whose social preview names the sender and the current fastest player for that maze.

We deliberately do not store anything that links you across mazes. Your device keeps a private random token in localStorage that never leaves your device; what gets published with a score is only a one-way hash of that token combined with the specific maze id. The same device posting to two different mazes produces two unrelated values, so your activity cannot be correlated from one board to another. We do not store your email, IP address, or any account identifier alongside a maze or a score.

Because there are no accounts, a published maze, board row, or preview image cannot be edited or withdrawn from within the game. If you want something removed, contact us using the details at the end of this policy.

4. Email Collection (Newsletter & Feedback)

We only collect an email address when you choose to give us one — by subscribing to product updates via our email notification form, or by optionally including your email when you send feedback:

• Email addresses submitted through the signup form are processed securely via Netlify Forms.
• We collect email addresses exclusively to send product news, feature launches, and game updates.
• If you optionally provide your email address when submitting feedback through our feedback form, we use it solely to follow up on that specific feedback. It is never added to marketing lists. Feedback submissions are also processed via Netlify Forms.
• You may request removal or unsubscribe at any time by contacting us at hello@mazetomaze.com. We do not sell, rent, or trade email lists to third-party ad networks.

5. Analytics Telemetry & Events

We use privacy-conscious Google Analytics 4 / Firebase Analytics to monitor aggregate performance and game stability, and to understand how many players are new versus returning. Analytics only runs after you opt in:

• Consent-Gated: On your first visit we show a consent banner and load no analytics until you choose. Analytics runs only if you select Accept; if you select Decline, no analytics cookie is set and no events are collected. Your choice is remembered on your device (in localStorage) so the banner is not shown again. To change your mind, clear your browser storage for this site and the banner will reappear.
• First-Party Analytics Cookie: If you Accept, Google Analytics stores a first-party cookie (_ga) containing a pseudonymous client identifier. We use it solely to distinguish new from returning visitors and to measure aggregate sessions and retention. It is not shared with advertising networks and is not used for cross-site tracking.
• Anonymization & No Advertising: IP anonymization is enforced, Google Signals (cross-device advertising tracking) is disabled, and Consent Mode denies advertising storage, ad personalization, and ad user data at all times — including after you Accept analytics.
• Event Taxonomy: We log aggregate, non-identifying events covering app load, the gameplay lifecycle (starting and completing daily, race, practice, and single-player mazes), match outcomes, and share interactions (sending or opening a challenge link) — for example app_loaded, daily_start, solve_complete, race_complete, race_win, share, and share_open. Event payloads carry only numeric timings, counts, and category labels (such as difficulty tier or share surface); they never contain player names, email addresses, avatar (emoji token) selections, or the contents of challenge link parameters.

6. Native iOS Application & Push Notifications

If you use our native iOS app via Capacitor:

• FCM Push Notifications: Upon explicit permission, the app registers a token with Firebase Cloud Messaging (FCM) to subscribe to the daily-maze topic for daily maze reset notifications.
• Native Hardware: Haptic feedback and native share sheets execute entirely on-device without remote data sharing.

7. Children's Privacy

MazeToMaze does not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us for prompt removal.

8. Contact Information

For questions or privacy inquiries, contact us at hello@mazetomaze.com.