Curryillion Privacy: No Ads, One Analytics Tag

The short version

No account. You never give Curryillion a name, email or password.
Two first-party measurement cookies. Google Analytics sets its own _ga cookies when it loads; the game itself sets none.
Two measurement tags. Google Analytics 4 and Cloudflare Web Analytics count visits and feature use — never your answers.
No ads. No advertising network is loaded, directly or indirectly.
Two measurement scripts. Google Tag Manager (which loads Google Analytics 4) and Cloudflare's host-injected Web Analytics; everything else is served from this domain.
Your progress is local. Streak, best score and discoveries live in your browser's local storage.

That is the whole policy in six lines. The rest of this page explains the details, because a short policy is only useful if the details back it up.

What is stored on your device

Curryillion uses your browser's local storage to hold two keys. Nothing is transmitted to a server, because the game has no server-side account system.

Local storage keys used by Curryillion
Key	What it holds	Why
curryillion:v1	Streak, best streak, rounds played, total score, best score, per-day history, the rare answers you have discovered, unlocked badges, your sound and theme preferences, and an in-progress round so a reload can resume.	So the game remembers your logbook and your place.
curryillion:theme	Arena or daylight, remember the last theme you picked.	So the page does not flash the wrong theme when it loads.

Both keys are stored only in the browser you play in. They are not synced between devices, not attached to an identifier, and not readable by us. If you clear site data for curryillion.cloud, they are gone — and the game starts fresh on your next visit.

What Curryillion does not collect

The game never asks for, and the site never records, the following:

Your name, email address, phone number or postal address.
Your precise location. The daily reset is fixed to Eastern Time and does not read your time zone for gameplay.
Your typing outside the answer box, your clipboard, your camera, microphone or contacts.
A profile, a device fingerprint or a cross-site identifier.
The answers you guess, sent to a server. The matcher runs in your browser against static data files.

The game itself is cookieless and needs no consent wall. Analytics loads with the page and can be blocked at any time as described above; nothing is gated behind a banner.

Hosting and request logs

Curryillion is served as static files from a content delivery network. Like every website, the hosting provider processes standard request information — such as the requested URL, an IP address, a user agent and the time of the request — in order to deliver files, cache them at the edge and protect the service from abuse.

Curryillion adds Google Analytics 4 (through the Google Tag Manager container below) for aggregate traffic measurement. It does not receive a visitor-level report from the host and does not build user profiles from request data. The game's own logic never talks to the network beyond loading the static page, its styles, its fonts and the three static data files under /data/v1/.

One third-party tag. The only third-party script is Google Tag Manager (container GTM-WBJ9DHBR, which loads Google Analytics 4) and Cloudflare's cookieless Web Analytics beacon injected by our host. There are no advertising pixels, no social embeds and no remote fonts. The content security policy allows only curryillion.cloud plus the Google Tag Manager and Google Analytics domains.

Analytics: what Google measures

The site loads one measurement container, Google Tag Manager GTM-WBJ9DHBR, which in turn loads Google Analytics 4. It exists for two narrow jobs: counting visits (page views, referrers, country, device class) and understanding which parts of the game are used (a new round, a reveal, a shared result). It is not used for advertising, remarketing, advertising-audience building or cross-site profiles.

Our host, Cloudflare, also injects its own Cloudflare Web Analytics beacon into pages served through its network. It is cookieless, records only aggregate performance and traffic signals (no cross-site identifier, no advertising use), and can be blocked by the same content blocker as any Cloudflare Insights request. Everything below applies to both tags.

Cookies. Google Analytics sets its own first-party cookies named _ga and _ga_<container>. They help distinguish sessions and usually expire after 13 months. The game itself sets no cookies.
What is sent. Page URL, referrer, an approximate location derived from IP, browser and device information, and gameplay events such as starting a round or revealing an answer. Your typed answers are never sent to Google.
Who processes it. Google acts as the analytics processor; see Google's own privacy policy for how it retains and processes analytics data.
How to block it. Use any content blocker, block googletagmanager.com and google-analytics.com in your browser, or install Google's Analytics opt-out browser add-on. The game works exactly the same with analytics blocked; this page and everything on it is static.
Consent. We do not gate the game behind a cookie banner. Analytics loads with the page; if you do not want it, block it as described above.

Challenge links and shared scores

When you copy a challenge link, the URL contains the day number and the score you are challenging — for example, a short code identifying round 17 and 415 points. It contains no answers, no prompts and no identifier. Whoever you send it to can replay the same board and compare scores, and nothing connects the link to you beyond the fact that you sent it.

The shareable result is also deliberately spoiler-free: a score, a rank band and a row of tier glyphs. Posting it publicly reveals what you scored, not what the answers were.

Children

Curryillion does not require an account and does not intentionally collect personal information from anyone, including children. Because there is no account, there is nothing to verify and nothing stored remotely. If you are below the age at which you can consent to digital services in your country, use the game with a parent or guardian nearby.

Your controls and rights

Because Curryillion holds no account data on a server, most data rights are exercised directly in your browser:

Clear everything. Use your browser's site-data controls for curryillion.cloud to delete the logbook and theme.
Turn off sound. The sound toggle is a local setting stored in the same save data; audio never leaves the device.
Stop using the site. There is nothing to delete server-side, because there is no server-side account.

If you believe some page collects something it should not, email hello@curryillion.cloud and we will investigate and correct the page or this policy. You can also use that address for any privacy question.

Changes to this policy

If the site ever adds a feature that changes what is stored or requested, this page will be updated before that feature ships, and the effective date at the top will change. The intent is simple and should hold: the game stays static, free, and measured only by one Google Analytics tag. Material changes will be described in plain language on this page rather than buried in a changelog.