The small print

Privacy

Effective November 14, 2026

Sunblot is a daily puzzle game. In short: you can play without an account, a name or an email. Your answers are checked on your device, not on our servers. We don't sell or rent anything we hold.

Here are the details.

What stays on your device

Your game in progress, your finished days, your stats and streak, and your settings (sound, calm sky, high contrast) are kept in your browser's local storage, on this device only. So does a random receipt for each day you finish, which lets you see that day's worldwide stats and rate the puzzle. It says nothing about who you are. If you sign in, your browser also keeps a sign-in token there until you sign out. Clearing this site's data in your browser erases all of it.

What reaches our server

While you play, nothing. Every answer is checked in your browser against that day's puzzle file, so what you type stays on your device while you play.

When you finish a day, your browser sends your five final answers. Our server scores them, so the worldwide numbers can be trusted, and keeps them lowercased with the tier each one earned, plus any answers you typed that day that didn't count (words not in our list, and answers that missed every circle). We use those only to find answers our lists are missing. That's what we use for “You beat X% of players” and “how many people said the same thing”. No name, email, account or device id is attached, even if you're signed in. The random receipt mentioned above comes back to your browser and is the only link to that finished game.

If you rate the day's puzzle, we store the number of stars with that same anonymous receipt. Only totals and averages are ever shown.

If you press “This should count”, we receive the answer you typed, the date, the level and which circles it missed. We use it only to improve the answer lists.

Signing in

Signing in is optional. It only keeps your stats and streak in sync across your devices. Our sign-in provider, Supabase, keeps your email address and a scrambled (hashed) copy of your password; we never see the password itself. If you sign in with Google, Google also shares your name and profile picture with Supabase. We use only the email, to identify your account. For each day you finish while signed in, we save the date, your score, your five moons and whether level 5 was a Total Eclipse. Your answers are never saved to your account.

When you sign in on a device that already has history, the two are merged: the same day keeps its higher score and counts once. Your saved history is private to you. If you use friends, we also store the display name you choose, a random friend code and your friend list. Friends you've accepted see your display name, scores and streak; nobody else can look you up. Signing out stops syncing. The My Sunblot page has a “Delete my account” button that permanently removes your account and everything saved to it, right away.

Cookies

Sunblot sets no cookies of its own. Signing in keeps its token in local storage, not a cookie. If you use Google sign-in, Google's own sign-in page sets its own cookies on google.com, under Google's policy.

Analytics

We use Vercel Web Analytics to count visits and see which pages are used. It sets no cookies and doesn’t track you across sites. It records the page, the referring site, your browser, device type and country, and identifies visitors only by an anonymous code that resets every day. Your answers are never part of it.

Ads and purchases

Sunblot may show ads and offer paid puzzle packs. If it does, we’ll update this page to say what those services receive.

Abuse protection

To stop bots from spamming the worldwide stats, each finished game is stored with a scrambled version of your network address: it's hashed with a secret key, so it can't be turned back into the address. It's used only to limit how many games one network can submit in an hour.

Reports are limited the same way: we keep the same scrambled address for about an hour to count how many reports one network sends, then delete it. It's never stored with the report itself.

When something breaks

If a page hits an error, your browser sends us a short report so we can fix it: which page, the error message and where in our code it happened, and your browser's name and version. It has no account, no answers and no address in it. Error reports are deleted after 30 days.

How long we keep things

Finished games are kept as anonymous counts (how many players gave an answer, how many reached a score), with nothing that says who played. The scrambled network address stored with a finished game is used for an hour and is never shown to anyone. Reports and missed answers are kept while we use them to improve the answer lists. If you have an account, your email, history and friends are kept until you delete the account, which you can do yourself on the sign-in page; that removes all of them at once.

Age

Sunblot is a general-knowledge game written for adults, and some answers are grown-up ones. It isn't meant for children under 13, or under 16 where local law sets that age, and we don't knowingly collect anything from them. If you believe a child has made an account, write to us and we'll remove it.

Who runs Sunblot

Sunblot is made and run by an independent developer. The site is hosted by Vercel and its database by Supabase, both in the United States; they process what is described on this page on our behalf. Our terms of use and the licences of the fonts and word lists we use are separate pages.

Contact

Questions about any of this, or a request to see, correct or delete what we hold: support@moondle.io.