← Yaffle

Privacy

Last updated 24 September 2026

Yaffle is a small daily puzzle site. This page describes exactly what it collects, why, and how to get rid of it. It is short because the site does very little.

You can play without giving us anything

You do not need an account to play. If you never sign up, nothing about you is stored on our servers. Your scores live in your own browser and go away if you clear your site data.

If you make an account

What	Why
A username you choose	So the leaderboard has something to show. It is public.
Your scores, and which puzzles you played	To build the leaderboard and show your own history.
A password	Stored only as a scrambled hash (PBKDF2), never as the password itself. We cannot read it, and neither could anyone who stole the database.
A random sign-in token	Kept in a cookie so the site knows it is still you.

We never ask for your real name, your age or your location.

Please don't reuse a password from somewhere important. This is a puzzle game, not a bank.

Email is optional

You can add an email address so your scores follow you to another device, so we can tell you when a new game appears, and so you can reset a forgotten password. You never have to — but without one, a forgotten password means the account is gone.

• Nothing is stored until you click a confirmation link we send you.
• We use it for that, and for occasional news about Yaffle. Nothing else.
• We do not sell it, rent it, or hand it to advertisers.
• You can remove it from your account at any time, which deletes it from our database.

Children

Anyone can play. You must be 13 or older to add an email address, and we ask you to confirm that before we accept one. If you believe a child under 13 has added an email, contact us and we will delete the account and everything attached to it.

Cookies

One cookie, named yaffle_t, which holds your sign-in token. That is the only one. There are no advertising cookies, no tracking pixels, and no analytics on this site.

Other companies involved

Loading a page here means your browser talks to a few other services. They each see your IP address, as any website you visit does.

Who	What for
Cloudflare	Hosts the site and stores the database.
Esri	Supplies the satellite imagery tiles in Zoom Out.
Google Fonts	Serves the two typefaces the site uses.
Resend	Delivers the confirmation email, only if you add one.

Getting your data, or getting rid of it

• See it all: the Download my data link on your profile returns everything we hold about you as a file.
• Delete it all: the Delete account button removes your username, your email, your scores and your sign-in tokens. It happens immediately and cannot be undone.

There is no soft delete and no backup copy kept for later. Deleted is deleted.

Changes

If this ever changes in a way that matters, the date at the top changes and anyone with an email on file gets told.

Contact

Questions, or want an account removed: hello@yaffle.games