Last updated 16 September 2026
Privacy
Don't Think! is run by David Alonzi as an individual, from Canada. This page explains what the site holds about you, who else can see it, and how to get rid of it. It is written to be read rather than to be legally impressive.
The short version
The site keeps your email so you can sign in, your username so the leaderboard has a name on it, and a record of the puzzles you play. It has no advertising, no tracking pixels and no analytics of any kind. Nothing is sold or shared for marketing. Your card details never touch this site.
What's collected
Your account. An email address, and a password stored only as a cryptographic hash — nobody, including me, can read it back. A username you choose, and optionally a display name. If you sign in with Google instead, Google tells the site your email address and basic profile details; it does not share your Google password.
How you play. For each puzzle: which game, which day, whether you won or lost, your score, how many mistakes you made, the moves you made and when you started and finished. From that the site works out your streaks, win rates and score distribution. The move-by-move record exists so a game can be resumed if you close the tab, and so scores can be checked rather than taken on trust.
Payment. If you subscribe, Stripe handles the payment. Card numbers are entered on Stripe's own page and are never sent to this site — it isn't a promise about how careful the code is, it's that the data never arrives here at all. What this site stores is an identifier for you at Stripe, whether your subscription is active, and when the current period ends.
Your browser. A session cookie keeps you signed in. Your theme choice and accessibility settings — text size, reduced motion, high contrast — are stored in your browser and never sent anywhere. So is a note of which games you've already seen the rules for. All of that stays on the device you set it on.
What isn't collected
- No advertising or tracking of any kind, on this site or across others
- No analytics service — the site does not measure your visits
- No data sold, rented or shared for marketing, ever
- No location, contacts, microphone or camera
- No card or bank details
What other people can see
Your username is public. It appears on the leaderboard next to your scores and times, and anyone can read it, signed in or not. Pick it with that in mind — and that is why the site never derives a username from your email address.
Your display name, email address, and which puzzles you got wrong are not shown to anyone else.
Who else handles it
Running a website means relying on a few companies. These are all of them:
- Supabase — stores the database and handles sign-in. The data is held in Canada.
- Vercel — hosts and serves the site. Pages are served from servers in the United States.
- Stripe — takes payments, and is the only one that sees your card details.
- Google — only if you choose to sign in with Google.
Each of them handles your data to provide their service to this site, not for their own purposes. Because the site is served from the United States, your data crosses borders on its way to you.
How long it's kept
Your account and play history are kept for as long as your account exists. Delete your account and they go with it, immediately and permanently — there is no thirty-day grace period and no archived copy to restore. Records Stripe has to keep for tax and accounting law stay with Stripe.
What you can do about it
Both of these are buttons on the site, not requests you have to send me and wait for:
- Take a copy — Account → Data & privacy gives you a file with your profile, every play and every statistic.
- Delete everything — the same page removes your account and all of it.
You can also correct your username or display name at any time from Account → Profile. Depending on where you live you may have further rights — to object to how data is used, or to complain to a data protection regulator. Email me and I'll help rather than make you fight for it.
Age
You need to be 13 or older to make an account. The site is not intended for children under 13 and doesn't knowingly collect anything from them. If you believe a child under 13 has made an account, email me and I'll delete it.
Security
Passwords are hashed, traffic is encrypted, and the database enforces who can read what at the database itself rather than trusting the website to ask nicely. Puzzle answers are held in tables the browser cannot read at all. No system is perfect; if something does go wrong in a way that affects you, I'll tell you.
Changes
If this policy changes, the date at the top changes with it. If a change is significant, I'll say so on the site rather than quietly rewriting this page.
Contact
Questions, or anything you want removed: jdalonzi@gmail.com.