Privacy policy

Morning Coffee Games ("we", "us") is a daily puzzle game site at morningcoffee.games. We care about your privacy and collect as little data as possible.

We have no interest in advertising or selling your information. We're all here to have a good time.

If you play without creating an account, your game progress is stored entirely on your device using your browser's local storage.

We do collect anonymous usage data (see "Analytics" below), but this is not tied to any personal information.

If you create an account, we store the following on our server:

• Username: the name you play under, which you can change at any time
• Email address: if you sign in by email link, or if you sign in with Google or Facebook and they share your address with us. We use it to sign you in and to recognise you across different sign-in methods. We do not send marketing email
• Passkey credential: a public key used for authentication (we never see or store your password or biometrics)
• Linked accounts: if you sign in with Google or Facebook, the account identifier they give us, so we recognise you next time
• Avatar: the shapes and colors you pick for the face shown next to your name
• Game progress: your puzzle state and completion times, so they sync across devices
• Settings: your choices about how the site behaves, such as the order of the games and whether the timer is shown
• Groups: the groups you create or join, and when you joined, so members can see each other's results

Signing in this way sends you to Google or Facebook to approve it. We never see your password for those accounts.

In return, they give us:

• An identifier for your account with them, which is how we recognise you on your next visit
• Your email address, if they share it and you allow it
• Your name, used only to suggest a starting username, which you can change straight away

We do not ask for, receive, or store anything else: no friends or contacts, no posts, and no ability to post anything on your behalf.

If a verified email address from Google or Facebook matches an account you already have here, we connect it to that account rather than making a second one, so the same address reaches the same puzzle history whichever way you sign in.

Using these options means Google or Facebook knows you signed in to this site. What they do with that is covered by their policies, not ours: Google and Facebook. If you would rather not involve them, an email link or a passkey signs you in without either.

Our email is delivered by Amazon SES, which receives your email address in order to deliver the message. We use it for two things: sending you a sign-in link, and passing on a message you send us from the contact page, which carries your address so we can reply. We never send marketing email.

We use a session cookie (mcg-session) to keep you logged in. It is HTTP-only, cannot be read by JavaScript, and expires after 90 days of inactivity.

Signing in also sets a short-lived cookie for the few seconds the process takes: mcg-oauth when you use Google or Facebook, mcg-challenge when you use a passkey. Both exist to check that the sign-in coming back is the one you started, and both are discarded as soon as it finishes.

We do not use tracking cookies or third-party cookies.

We collect our own simple, self-hosted analytics to understand how the site is used. We do not use any third-party analytics services, advertising networks, or tracking scripts.

We collect:

• Page views and interactions: which pages are visited and which features are used (e.g. starting a puzzle, sharing a result)
• Where you arrived from: the address of the page that linked you here, and any campaign tags on the link you followed, so we can tell how people find the site
• Browser and device: the description your browser sends with every request, which tells us the browser and operating system, and separates real visits from crawlers
• Visitor ID: a random identifier stored in your browser's local storage, used to count unique visitors. It is not derived from anything about you or your device. While you are signed in, events also carry your account ID, which ties them to your account

We do not record IP addresses with analytics events, fingerprint your browser, or build profiles across sites. An address is used only to rate-limit abuse, such as a bot flooding the contact form, and is never linked to your account.

If you choose to support Morning Coffee Games with a donation or subscription, payments are processed by Stripe. We do not collect or store your payment card details. Stripe receives your payment information directly and is subject to their own privacy policy.

We store a Stripe customer ID on our server to manage your subscription status. No billing details, card numbers, or financial information are stored by us.

We do not sell or transfer your data to third parties. Where data does leave us, it is only to do the job you asked for:

• Payment details go to Stripe, solely to process your transactions
• Your email address goes to Amazon SES, solely to deliver a sign-in link you requested or a message you sent us from the contact page
• Signing in with Google or Facebook tells that provider you signed in here. We send them nothing about you beyond the sign-in request itself

You can delete your account at any time from your settings. Deleting it erases your username, your email address, any linked Google or Facebook account, your passkeys and unused sign-in links, your saved puzzle progress and stats, and your group memberships. A group you created passes to its longest-standing member, or is deleted if nobody else is left in it. We also delete the analytics events recorded against your account.

After deletion, some things remain outside of our control:

• Stripe keeps a record of payments you made, which we both have to hold on to for tax and accounting
• Anything you sent us through the contact page stays in our email, since it reaches us as ordinary email

Puzzle progress saved in your browser stays on your device. Clearing this site's local storage removes it.

If we make changes to this policy, we will update this page and the "last updated" date above.