Privacy Policy
Last updated: 2026-08-04
This page explains what information Shahmat.org collects, why, and how it's handled. We keep this simple on purpose: we don't sell data, we don't run ads, and we don't use third-party trackers or analytics.
Information we collect
- Account information: the username, email address, and password you provide when you sign up. Your password is never stored in plain text — it's hashed with bcrypt before it touches our database, so even we can't see it.
- Gameplay data: your puzzle rating, solve history, streaks, and game activity, so your progress and stats persist between visits.
- Session cookie: a single cookie that keeps you logged in. It's
HttpOnly(not readable by page scripts) and is not used for tracking or advertising.
How we use it
- To create and secure your account, and keep you signed in.
- To save and display your puzzle/game progress and stats.
- To email you a one-time verification code if you use "Forgot password" — this is sent only when you request it, and the code itself is hashed and expires shortly after being issued.
What we don't do
- We don't sell or rent your data to anyone.
- We don't share your data with advertisers.
- We don't use Google Analytics, Facebook Pixel, or any other third-party tracking script — there isn't one on this site.
Third parties
The only outside service involved is our email provider (SMTP), used solely to deliver password-reset codes you request. No other third party receives your data.
Data retention & deletion
Your account data is kept for as long as your account exists. We don't yet have a self-service "delete my account" button — if you'd like your account and data removed, contact us at privacy@shahmat.org and we'll take care of it.
Security
Passwords are hashed with bcrypt. Session cookies are HttpOnly and restricted with SameSite=Lax. Password-reset codes are hashed and time-limited.
Changes to this policy
If this policy changes in a meaningful way, we'll update the date at the top of this page.
Contact
Questions about this policy or your data? Reach us at privacy@shahmat.org.