Privacy
No ads, no third-party trackers, no cookies, and nothing sold. Almost everything the game knows about you stays in this browser. What leaves is one line about each round you finish, two counts your Words page sends to compare you with the crowd, and a tally of how the site is used. None of it says who you are, and you can play the whole thing without giving me your name or your email.
What stays on your device
Your streak, your scores, your words and your settings live in this browser and go nowhere unless you sign in. There are no cookies here at all, and no page loads a script from anyone else, so loading a page announces your visit to this site and to nobody else. The one exception waits until you start signing in by email, below.
Clearing your browser data clears all of it. Safari does the same for sites you have not opened in about a week, unless the site is on your home screen, so sign in or add False Root to your home screen to keep a streak safe. On an iPhone or iPad the home-screen copy keeps its own storage, apart from Safari’s, so sign in there to bring a streak across.
The full list, if you want it
- Your streak, your scores, your collected words, and a half-finished round if you leave one.
- Which words you have already tried today, which word the homepage opened for you today, and your light or dark preference.
- Your answer to the first-language question, if you answered it, so it is asked only once.
- Housekeeping: whether you have finished a round here, which retires the line on the board that explains a tap, whether the sign-in suggestion has been dismissed, whether the home-screen suggestion has been shown and what you answered, your answer to the mailing-list question or how many times it has been shown, when this browser last synced, which account it last synced with, and a copy of anything above that gets corrupted, set aside rather than deleted so a bad save never quietly wipes your streak.
- A random identifier this site generated on your first visit, signed in or not. For a few weeks it also decides which of two words a new visitor meets first, and nothing more is sent because of it: the identifier already goes with the tally, and the first word you finish says which. Signed in, also Supabase’s session keys, which beginsb-.
What leaves: your answer
The first time you finish a word, the site keeps one line describing how you read it: which stories you struck, in what order, whether the truth caught you, which story you named as the truth if you named one, and a few plain facts about the play. Once enough people have met a word, its reveal says how many touched the truth, or named a lie, or swept it clean, and which story more of those who lost took for the truth than any other: a count first, a percentage only when one would mean something, and never an invented number.
Only your first attempt counts, once per word: by your account if you have one, otherwise by a random string this browser made up. Nothing in it points back to you, and no other site can read it.
Once you have finished ten words, your Words page asks how you compare with everyone else. It sends two numbers, how many words you have met and how many you swept at first sight, and gets back how many players have met ten or more and what share of them swept a smaller part of theirs. Nothing from the question is stored, in this browser or in the database, and the answer names nobody.
A result you share carries your own round inside the link, scrambled so it does not read as an answer in the address bar. It goes only where you send it: nothing is stored here or sent to anyone.
What that line holds
Which of the four stories you struck and in what order, whether the true one caught you, which story you named as the truth and whether it was (blank if you only struck), the word, its number, the day you played it, whether it was the round that counted for your day, the moment it was written, how many words you had finished before this one, the seconds from seeing the board to your first tap, a strike or a name, and to the end (capped at ten minutes, blank if you came back to a round part-way), whether you arrived by a shared link, the installed app or neither, whether the link carried a friend’s round, and the first two or three letters of your browser’s language setting. No browser make, screen size, address or location: nothing that could tell one browser from another.
If you sign in
Signing in is optional and the whole game works without it. It stores your email address and backs up your streak, scores and words so they follow you to any device. Google sign-in tells Google you were here, and may hand over the name and picture on your account. Nothing here reads them.
Asking for a sign-in email first runs a spam check, Cloudflare Turnstile, so that nobody can use this site to mail strangers. It loads fromchallenges.cloudflare.com once you start signing in by email (moving into the address field is enough), and never before: playing, and signing in with Google, do not load it. It watches how your browser behaves to tell a person from a script, it does not read what you type, and it usually asks nothing of you; now and then it shows a box to tap. It runs in a frame of Cloudflare’s own, which can keep cookies and storage of its own under Cloudflare’s address; this site still sets none. What Cloudflare keeps from it is set out in its Turnstile privacy terms.
What gets backed up
For each day you play: the day, the word’s number, your score, the score available, which kinds of lie you spotted, which kinds you were shown, and when you finished. For each word: the word, its origin family, the date you first played it, your first and best result, how many times you have played it, and when the row last changed. No profile, no location, no advertising identifier, nothing about what you do anywhere else.
What the site counts
The site keeps its own tally of how it is used, so I can tell whether anyone is playing, where they come from, how far they get, and whether a word is too hard: page views, boards started, first taps, rounds finished, boards left unfinished, shares, sign-ins, home-screen installs, references opened from a reveal, the way forward taken from a reveal, a tap on the reveal’s line about ranking, reveals read, and answers to two optional questions. Each is one short line sent to the web host and kept there for three months, under the random identifier this browser made up, so the tally can tell a returning player from a new one. It never carries your account, even when you are signed in. It is not a cookie, it is not shared with any advertiser, and there is no third-party script: the line goes to this site and nowhere else.
What each line holds
Every line: the kind of event, the time it arrived, your local hour, and the country your connection comes from, which the web host adds. Nothing finer than the country: no region, city, network or address.
- A page view adds the page, whether you arrived by a shared link or the installed app, the name of the site that sent you (never the page on it), the campaign tag on the link you followed if it carried one (the utm_source part of the address), whether you are on a phone, a tablet or a computer, whether the site is installed, and whether this browser holds any word you have finished, which once you sign in includes words finished on your other devices.
- A new board adds the word, its number, whether you arrived by a shared link or the installed app, and whether you are on a phone, a tablet or a computer. On the board a page opens with, it also adds roughly how long the page took to become playable: under a second, one to three seconds, three to ten, or longer.A first tap adds the word, its number, and how many of the four stories had been at least half on screen by then.
- A board left unfinished adds the word, its number, how long the board was on screen while the page was in front (not at all, under three seconds, three to fifteen, fifteen to sixty, or longer), and how many of the four stories had been at least half on screen. It is sent at most once a page: the first time you leave the page, or switch away from it, while a new board on it is unfinished.
- A finished round adds the word and its number, how you arrived, whether it counted for your day, how it ended, your score, how long it took, which stories you tapped in what order and how long before each tap (capped at ten minutes), how many words you had finished before, your streak, how many words you have mastered, the first two or three letters of your browser’s language setting, your answer to the first-language question if you gave one, and whether you switched away from the page during the round and came back to finish it.
- A share adds the word, its number, and whether the round counted for your day.
- A reference opened from a reveal adds the word, its number, and which reference.
- A way forward taken from a reveal, once for each round you finish on the page, adds the word, its number, and which way: the next word, the Words page, or Roots.
- A tap on “See how you rank”, a line the reveal carries for two weeks once you have finished a word before, is counted the same way, with the word and its number. There is no ranking behind it yet: the tap is how the site learns whether anyone wants one, and the line says so.
- A reveal read adds the word, its number, and how long after the round it was. It counts when the end of the true story stays on screen, with the page in front, for as long as the story takes to read: a quarter of a second a word, four seconds at least.
- The first-language question adds your answer: yes, no or skip.
- A sign-in or a home-screen install adds nothing more.
No browser make, no screen size, no full address of the page you came from. Blocking requests to this site’s own address stops all of it, and the game does not notice.
If you ask to hear about new words
After a finished round, and at the foot of the Words page, the site asks whether you want an email when new words land. Say no and it is gone for good on this device; ignore it and it asks on three days at most, then stops. Say yes and your address is stored with nothing from the game copied into it: not your streak, your scores, your words or the answers described above. Signed in, it is one tap for the address you signed in with, which the page shows you first, and the account menu has the same switch; your sign-in address joins only when you tap, never because you signed in. A row added from your account also records which account asked, so that deleting the account takes you off the list, and that link is never used to look at what you played. Apart from the sign-in link you ask for, these are the only emails the site sends. Every one carries a link off the list, and the list is never sold, rented or shared.
What the list holds
Your address, where you last gave it, the exact sentence you agreed to (written by the site, not by whoever typed the address), the date you last gave it, whether the address has been confirmed and how, and a random key that makes your unsubscribe link work. Added from your account, it also holds which account asked. When you leave, the row stays with the date you left, so that leaving is remembered rather than forgotten; signing up again brings it back.
Nothing will be sent to an unconfirmed address. An address typed into the form counts as unconfirmed, because anybody could have typed it, and there is no way to confirm one yet. An address added with one tap from your account counts as confirmed, because signing in already proved it is yours; the same tap confirms an address you typed in earlier. One address per account: if you change your account’s address and join again, the old one leaves the list.
Who else is involved
Supabase stores the data and handles sign-in. Google, only if you choose Google sign-in. Cloudflare, the web host, serves these pages, keeps the tally, and runs the spam check in front of the sign-in email. All three see the usual server-log things, an IP address and a browser name. I never use those to build a picture of you, and the tally is never joined to them. Resend delivers the sign-in email, so it is handed your address and the message. It gets them from Supabase, not from your browser, and the email carries no tracking pixel and no rewritten link.
Deleting it
Clear this site’s data in your browser and every local trace is gone. Delete your account from the account menu and it goes immediately, taking your results and your words with it.
If you joined the mailing list, the link at the foot of any email takes you off it, as does the switch in the account menu, or write to me and I will do it. Deleting your account takes you off the list too; leaving the list does not touch your account.
Two exceptions. Your recorded answers stay, because a word’s difficulty is built from everybody’s first impression and one person leaving should not rewrite it. They are cut loose from you first, each given a fresh random label, so nothing ties a line to you or your lines to each other. And the tally’s lines stay until they expire at three months, because the web host has no way to delete them one at a time.
Asking me things
Questions, or a request to see or delete something, go to corrections@falseroot.com.