Privacy Policy

Updated October 12, 2026

What the game stores

The service stores a random anonymous player identifier, an automatically generated display name, round choices, guesses, scores, completion times and daily progress. This lets you continue a round, keep a streak and appear on the leaderboard. You can play without an account. We do not ask for a password or payment information.

Essential browser storage

The essential gsg_guest cookie lasts up to one year and identifies this browser. It is HTTP-only and uses the Secure flag on HTTPS. The database stores a hash of the cookie token. Without optional Google sign-in, clearing this cookie gives you a new identity, so previous progress will no longer be connected to your browser.

Optional Google sign-in

You can optionally sign in with Google to bind completed game records to an account and find them across devices. Google may include basic profile fields in its sign-in response; we retain only your Google account identifier and email address for account identification and saved progress. We do not store your Google name or photo, and neither appears publicly. Your email is shown only in your signed-in account controls. We never receive your Google password.

Google’s sign-in service connects only when you choose to sign in; its own privacy policy applies. Essential HTTP-only cookies keep your account session and temporarily verify the sign-in request. Your unfinished round stays in its current browser. Completed records from linked browsers are combined without counting the same round twice.

Leaderboards and sharing

Leaderboards show generated display names and game scores to other visitors with access to the site. Your guesses and identifier are not included in leaderboard responses. Sharing is optional and opens your device's share sheet or copies a result. A shared result includes the score, attempt pattern and game link, not the answer.

Hosting and external services

The app is hosted on Cloudflare Workers and stores game progress in a Neon PostgreSQL database. These providers may process network information, including IP addresses and service logs, to deliver and protect the service. You can play without a platform account; your game identity starts with an anonymous browser cookie. Google sign-in is optional.

The app does not add third-party analytics trackers or payment tools. It records first-party totals for page views, game readiness, observed playback progress or failure, accepted guesses, completed rounds, playing again, result sharing and the sign-in flow. Reports use limited categories such as public page, game mode, device category, country and referral channel. Full referral URLs, search queries, song guesses, Google names, email addresses and credentials are not sent in browser analytics events. By default, analytics does not set a browser identifier to link visits. Counts describe recorded activity, not a count of unique people. Technical event digests and timestamps prevent duplicate counting; an operator with the underlying game record could recompute a digest, so this technical data is not claimed to be irreversibly anonymous. Linked event history and deduplication records are limited to 90 days in reports, and aggregate totals to 365 days. Expired records are removed on the next report maintenance read. Fonts and fallback clips are hosted with the app. SoundCloud connects only after you choose to load an embedded player; it receives network information such as your IP address and may use cookies, advertising and its own tracking under its privacy policy. You can choose a fallback song instead. Attribution links also use the external site’s privacy practices.

To diagnose playback problems, we also retain short-lived attempt records: a random attempt ID, the game round and recording reference, audio provider, playback stage, standard error category, requested duration, observed progress, page visibility, and retry outcome. These records help distinguish an actual error from a pause or a background tab. They use the same limited source, country and device categories, without raw error messages, raw IP addresses or full browser information. They can be connected to the underlying game round, so they are not claimed to be irreversibly anonymous. Diagnostic reports cover at most 30 days; older records are removed during report maintenance. These diagnostics do not add a browser tracking identifier.

Library operators use a separate sign-in or an HTTP-only eight-hour operator cookie. Playback checks store provider-reported positions, durations and check times with the recording, without recording microphone audio.

Retention and control

Game data is retained to support saved progress and all-time rankings; this version has no automatic expiry for those records. Clearing the cookie does not delete stored records. Use the control below to delete this browser’s anonymous game data. If signed in, it deletes your GuessSongGame account and linked game records instead, including scores and streaks, and revokes its account sessions. It does not delete your Google account. Sign-in activity may be kept without an account link for service diagnostics. You can also reach this control through Account → Manage / delete data in the header.

Optional return-visit measurement

If you explicitly enable optional measurement below, a first-party cookie lasting up to 90 days lets us link visits and actions in this browser. This optional measurement is separate from essential game cookies and Google sign-in. It does not link different devices or identify unique people. Browser privacy signals can keep it off. Turning it off removes the optional cookie and deletes the history linked to it; anonymous aggregate totals remain. No analytics identifiers are stored in local storage or session storage.

Changes

When data practices change, this page will be updated. The date above identifies this version of the policy.