Privacy Policy
Effective August 6, 2026 · Last updated August 25, 2026 · Version 1.4
Your current settings
Necessary storage is always active. Manage privacy settings to change optional analytics.
Who we are
Guessistan is managed and operated by Exalted Morning Star Group LLC, a New Jersey limited liability company. Questions and privacy requests may be sent to admin@guessistan.com.
Information stored on your device
Necessary browser storage keeps puzzle progress, completed results, streaks, theme preferences, the last puzzle seen, and your privacy choice. Your privacy choice is synchronized across open Guessistan tabs in the same browser. This storage is required for those features and cannot be disabled through our settings. You are not required to create an account or provide contact information to play. If browser storage is blocked or cleared, these features may not work or may be reset.
Optional measurement storage records consent-scoped focused-game-time, move, and mistake baselines, whether an event was already counted, a session's allowlisted campaign or share-channel attribution, and one bit indicating whether this device has previously allowed measurement. A game clock starts when its puzzle is playable and counts only while that page is visible and focused; if analytics is allowed later, the baselines exclude earlier time, moves, and mistakes from completion measurement even though the player's displayed result retains them. These values let resumed games and one attributed arrival per browsing session be measured without a custom player or session identifier. When analytics is turned off, Guessistan removes those records and Google Analytics cookies it can access. When optional Google Analytics is enabled, Google Analytics may assign a pseudonymous client identifier through first-party analytics cookies such as _ga.
Information we collect
Cloudflare Web Analytics provides an always-on, cookie-free aggregate baseline such as page views, performance timing, country, device, browser, and referring-site categories. Cloudflare also processes IP addresses and ordinary request, network, and security information needed to deliver and protect the site. Its Web Analytics beacon is designed to collect limited performance information without tracking individual visitors across sites.
When optional analytics is allowed, we send coarse events for one attributed arrival per browsing session, page views, focused-page seconds, game selection, starts, completions, duration and attempt buckets, Yaad Hai and Aur Yaad Hai move and mistake buckets, System Jam move buckets, hints, sharing intent and browser-reported outcomes, daily-set completion, and grouped API errors to our first-party Cloudflare Analytics Engine dataset and Google Analytics 4. Move and mistake buckets measure only play after analytics permission becomes active. They never record individual card flips, matches, misses, vehicle positions, board layouts, or movement directions. Our custom events may include a registered page or game ID, broad device type, broad referrer category, consent region mode, visitor classification as new or returning on this device, a bounded player-share source or target, and a source-controlled campaign code. They do not intentionally include puzzle answers, guesses, clues, free-form text, raw query strings, fingerprints, or a custom page-view, session, or player identifier.
Google Analytics may automatically receive a pseudonymous analytics identifier, browser and device information, approximate country-level geographic information, and the limited page and referring information associated with our events. We send registered canonical Guessistan paths and page titles, never the browser's raw query string; an unknown route is represented as /404/. For the first page, an external HTTP or HTTPS referrer may retain only its scheme, hostname, and pathname after credentials, port, query, and fragment are removed. Later client-side page views refer only to the previous registered Guessistan route. Registered campaign links provide a reviewed UTM ID, source, medium, campaign, and optional content value, including separate values for player sharing and official promotion. Google receives an IP address during transmission to derive approximate location and states that it discards the IP address before logging Analytics data. We disable automatic page views, Google Signals, advertising storage, advertising personalization, and granular location and device collection.
We record a limited privacy-choice event even when optional analytics is denied. It contains the choice, decision source, policy version, broad consent region mode, GPC status, and coarse technical categories, without campaign attribution, share attribution, visitor classification, or a persistent player identifier. We use it to honor and audit choices and understand measurement bias.
Legal bases
Where applicable, we rely on consent for optional analytics; the need to provide features you request for necessary browser storage; our legitimate interests in operating, securing, debugging, and understanding the Service for necessary technical and security processing where those interests are not overridden by your rights; and compliance with legal obligations where required.
Optional analytics is not required to use Guessistan. Where we ask for consent, you may withdraw it at any time through Privacy settings. Withdrawal does not affect the lawfulness of processing performed before consent was withdrawn.
How we use information
- Provide, secure, debug, and improve the games and website.
- Understand aggregate engagement, reliability, and which games players find useful.
- Prepare de-identified, aggregate reports for internal decisions and potential sponsors. Sponsor engagement reports cover measured analytics-enabled traffic and are not ad-impression or ad-viewability reports.
- Comply with law, enforce our terms, and protect users, Guessistan, and others.
When we share information
We use Cloudflare for hosting, security, Web Analytics, and first-party event storage, and Google Analytics 4 for optional analytics. These providers process data for us under their applicable terms. We do not give sponsors raw event-level data or player identities; sponsor reporting is aggregated and de-identified.
We may disclose information when we reasonably believe it is required by a valid subpoena, court order, law, or other legal process; to investigate fraud, abuse, or security incidents; to protect rights and safety; or as part of a merger, financing, acquisition, or sale of assets, subject to appropriate protections. We do not currently sell personal information or share it for cross-context behavioral advertising.
We do not currently use Google Signals, Google advertising features, remarketing audiences, or Google Ads links for personalized advertising. Those practices and this Policy would need to be reviewed before advertising technology is activated.
Retention
Raw first-party product events in Cloudflare Analytics Engine are retained for approximately three months. Google Analytics event and user data is configured for 14 months. Cloudflare Worker logs on our current plan may be available for up to three days. Cloudflare Web Analytics keeps unsampled data for a limited period and may retain aggregated or sampled reporting afterward under its service rules.
Necessary game and preference data remains on your device until you clear it. We may retain de-identified aggregate business summaries indefinitely. We may preserve limited relevant records longer when reasonably necessary for a legal claim, security investigation, or binding legal obligation, then delete them when the hold ends.
Your choices and rights
Visit the Privacy Policy page and select Manage privacy settings to allow or deny optional analytics. In the EEA, United Kingdom, Switzerland, and when location is unknown, analytics starts only after permission. In other recognized countries, analytics may start by default and a disclosure notice links to this Policy; use Privacy settings on this page to turn it off. If you turn analytics off, it remains off unless you later allow it; we may show a neutral reminder after approximately 30 days in opt-out regions or after approximately six months in consent-required or unknown regions.
Minor policy clarifications do not cause a new prompt. After a major change to privacy choices, a prior refusal remains off and we may ask you to review the updated choice immediately. In consent-required or unknown regions, a prior permission may also require review before analytics resumes; elsewhere it may continue when the change remains within the previously described analytics scope. If your browser sends Global Privacy Control, optional analytics is disabled everywhere and we do not ask you to re-enable it.
Depending on where you live, you may have rights to access, correct, delete, or receive information, or to object to or restrict certain processing. Email admin@guessistan.com. We may need to verify the request. Because we intentionally avoid accounts and custom persistent identifiers, we may be unable to link an event to you; we will explain when that is the case. You may also clear Guessistan site data in your browser. Where applicable, you may complain to the data-protection or privacy regulator in the place where you live or work.
Security, de-identified information, and automated decisions
We use reasonable administrative, technical, and organizational safeguards appropriate to the nature of the information we process. No system, browser storage, or transmission method can be guaranteed completely secure.
We maintain de-identified information in de-identified form and do not attempt to reidentify it except when reasonably necessary to test whether our de-identification measures are effective or as otherwise permitted by law. We do not use personal information to make decisions that produce legal or similarly significant effects concerning users.
Provider information
These providers publish additional information about their services and privacy controls:
International transfers, children, and changes
We operate in the United States and our providers may process information in the United States and other countries using the safeguards available under their terms and applicable law.
Guessistan is a general-audience service and is not directed to children under 13. We do not knowingly collect personal information from children under 13. Contact us if you believe a child provided such information.
We may update this policy as the service or law changes. We will change the date above and provide an appropriate notice or request a new choice when a material change requires it.