Privacy policy
Sherlock is a free, non-commercial hobby project run by one person, Sergey Erin (“I” below). This page describes exactly what the site does with your data. It is short because the site does very little: the whole game runs in your browser, and signing in is optional.
Questions, corrections, deletion requests: sergey.erin@gmail.com.
Playing without an account
If you do not sign in, nothing about you reaches the server beyond the ordinary web-server request logs described below. The puzzles are generated in your browser, and your progress is stored in your browser’s localStorage only:
- settings: player name, per-size handicaps, gameplay option flags;
- a map of solved puzzles: board type, puzzle number, best time, hints used, handicap, completion time;
- the unfinished game you are playing and one saved position per puzzle;
- a small sync queue used only after you sign in.
Clearing your browser’s site data deletes all of it. There is no copy on the server: without an account you have no row in the site’s database at all.
If you sign in with Google
Signing in is optional and adds exactly one feature: syncing your results between devices. The sign-in uses Google OpenID Connect with the scopes openid, email and profile. Google’s own privacy policy covers what Google does during that step.
From the Google response I store in the site’s database:
- your Google account identifier (the stable OpenID sub) — the key that identifies your account here;
- your email address — so that I can recognise and contact the owner of an account, for example on a deletion request;
- your display name as Google reports it;
- the time your account was created and the time you last signed in, plus a flag that lets me disable an account in case of abuse.
Your Google profile picture is not stored in the database. Google returns its URL during sign-in; the URL stays inside your own session cookie and is not displayed anywhere in the game today.
Sign-in is open to any Google account with a verified email address. If Google does not report the address as verified, the sign-in is refused and nothing is stored.
Game results stored for signed-in players
Once you are signed in, each solved puzzle is stored on the server as one row: board type (width × height), puzzle number, your best time, hints used and handicap of that run, the generator version, and the timestamps of your first and best completion. That is the whole record — no move history, no replay, no device information.
Its only purpose today is to keep your progress in sync between your browsers and devices. Results are returned only to the account that owns them; nothing is published. If a public leaderboard is ever added, this page will be updated before any result becomes visible to other players.
Cookies
One cookie, and only after you sign in: sherlock_session. It is a signed session cookie holding your account id, email, display name and the profile-picture URL. It is HttpOnly (JavaScript cannot read it), Secure (sent over HTTPS only), SameSite=Lax, and it expires after 30 days. Signing out clears it.
There are no analytics, no tracking pixels, no advertising and no third-party cookies. The pages of this site load no resources from other hosts at all — no fonts, no scripts, no images from anywhere but sherlock.biplane.cc.
Server logs
The web server keeps ordinary access logs: IP address, timestamp, requested path, response code, user agent and referrer. They are used to keep the site running and to deal with abuse, and they are rotated by the standard system log rotation. The sign-in callback is excluded from these logs. Application logs deliberately contain no personal data: no email addresses, no Google identifiers — only an internal numeric user id and the fact that an event happened.
Where the data is stored
On a single private virtual server in Europe, in a PostgreSQL database that only I have access to. Traffic to the site is encrypted with TLS. Database backups are kept on the same server. Deleting an account removes its data from the database immediately; a backup taken earlier may still contain it for as long as that backup is kept, and such data is never restored back into the live database.
Sharing
Your data is not sold, rented, shared or sent to any third party. There are no analytics providers, no ad networks and no external APIs in the running game. Google is involved only at the moment you choose to sign in. The only other exception would be a legally binding request I am obliged to answer.
Retention
Account data and results are kept while your account exists. They are deleted when you ask me to delete the account (see below). Progress stored in your browser stays in your browser until you clear it.
Your rights
- Access. Ask me for a copy of everything stored about your account.
- Correction. Your name and email come from Google and are refreshed on each sign-in; anything else can be corrected on request.
- Deletion. Ask me and your account row and all your results are deleted from the database — the deletion cascades, nothing of yours is left behind.
- Withdraw. Sign out at any time (Player → Sign out); the session cookie is cleared and the game keeps working without an account. Local progress in your browser is not affected.
- Avoid entirely. Simply never sign in: then no data about you ever appears on the server.
All of these go to one address: sergey.erin@gmail.com. This is a one-person hobby project, so requests are handled by hand — normally within a few days.
Changes to this policy
If what the site does with data changes, this page changes with it and the “Last updated” date above is bumped. There is no mailing list to notify you, so the date is the honest signal.