Privacy

Breadbox needs no account, sets no cookies, shows no ads and uses no tracking or analytics companies. It keeps what the game needs to work, under an anonymous ID, and nothing that says who you are.

Breadbox is made and run by Iain Skinner. Questions about this page, or about your data: hello@playbreadbox.com.

What we keep, and why

• An anonymous player ID and a made-up name ("Brave Otter 12"), created when you start typing your first question, or start or join a race. The ID links your games together, and it notes when you first played and when you were last here (the reminder skips anyone who's been away for two weeks). It's random, and it's never tied to your name, email or device.
• Your games: which puzzle, how many questions you used and the color of each answer, how many of them were guesses, the traits you found (the pills, and the sparks you were shown), whether you solved it and how long it took, your country, and how far your time zone is from UTC (for the Early Bird and Night Owl trophies). It also keeps the questions you asked, word for word, with the answer each got, so we can see which questions people ask and which answers confuse them (that's how the game's answers get better). Each game, with its questions, is kept for 60 days; after that, only the day's totals remain.
• Your races (Breadrace): who made each race and who joined it (your anonymous IDs), the word each of you picked, how many questions you chose and whether there were sparks, the color of each answer, the traits your answers found and the sparks you were shown, and when each of you started and finished, but not your questions' words. We count races (how many are made, finished and rematched, and how many friends a race brings to Breadbox) to see whether Breadrace works; a race we play ourselves is marked as ours, so it's left out of those counts. The friend you race never sees your made-up name: they see your answers' colors as you go, and at the end your word and how long you took. While you both have a race open, your friend can see that you're on it right now (and before you've picked your word, just that someone with the link is on it); the game only remembers that for a few seconds, in memory. A race cancelled before it starts keeps only that it was cancelled, and when. Anyone with a race's link can see that it's waiting for a friend, and nothing else. Each race is kept for 60 days.
• Your stats, streak, cards and trophies, kept until you delete them. A card is kept for every game you finish, won or lost, with the color of each answer and the rarest trait you found.
• Your Field Guide: every trait you've found, been given by a spark or asked about, and the puzzle number where each one happened. It's kept until you delete it.
• Your country comes from our network provider, Cloudflare, which works it out from your connection, or else from your device's time zone. It's used for your place ("38th in the UK") and First Solve.
• If you report an answer with the thumbs-down, we keep that question, the day's word, the answer it got and which game it came from (so, while that game is kept, your ID), so we can improve the answers. In a race it's the race's word and which race it came from (so, while that race is kept, your ID), and you can also tell us a race's word was too weird or too hard: we keep that word, and which race. We review reports weekly, and each one is deleted 180 days after you send it. If your report leads to a fix, that ID is how we give you the Fact Checker trophy.
• Visit counts: daily totals only, such as how many visits came from a shared result, from which website (its name, never the page), or from a link we posted with a tag on it (like ?s=reddit). Nothing is counted per person.

The reminder

With the reminder on, we keep your browser's push address (at Google's, Apple's, Mozilla's or Microsoft's push service) and its keys, your time zone and your anonymous ID, only to send one reminder a day. It's skipped if you've already played that day, which is the only reason we look. The push service delivers it, encrypted, so it knows a message was sent, but not what it says. Turning the reminder off, or Delete my data, removes it; one that stops working is removed by itself; and it's never used for anything else.

What we don't keep

• Your IP address. The game holds it in memory for up to an hour, only to stop floods of requests, and never writes it down. (Our hosts, Render and Cloudflare, handle it to deliver the page, under their own privacy policies.)
• Anything that says who you are: no names, emails, phone numbers or accounts. The only thing you type is your questions.
• Cookies. There are none, so there's no cookie banner.

On your device

Your browser keeps its own copy of your games (with your questions), your stats and your settings, so the game opens instantly and works without a connection. It stays on your device. Delete my data clears it, and so does clearing your browser's data for this site.

Who else sees what

• Your questions are answered by an AI model, through the service OpenRouter. It gets each question with the day's word or its kind (an animal, say), and nothing about you.
• Render hosts the game and its database. Cloudflare carries the traffic.
• Other players never see anything you type. The only thing they can see is your made-up name, if you're the first in your country to solve a puzzle (First Solve), shown to others in your country that day.
• The push service of your browser, if you turn the reminder on (see above).

Nothing is sold or shared for advertising. There are no ads. If there ever are, they'll be about the page, never about you, and this page will say so first.

Your choices

• Delete my data, in Settings, deletes your player, stats, streak, cards, trophies, Field Guide, reminder and the questions you asked from our server, and this device's copy (all but today's game, so today's puzzle can't be played again). Your past games stay only as anonymous counts, and go after 60 days.
• The reminder can be turned off at any time in Settings.
• Your backup link, in Settings, brings your progress to another device. It's your anonymous ID, so anyone who has it can play as you: keep it to yourself.

Children and classrooms

Breadbox is made for adults, and it's fine to play in a classroom. It asks for no personal details, lets nobody send messages to other players, gives every player a made-up name, and has no ads or tracking.

Last updated 1 October 2026.