Cairn British History Quest

Privacy Policy

1. The short version

Cairn is a game. It collects as little as it can get away with, it does not sell anything to anyone, and you can play the whole thing without giving us your name.

2. Playing without an account

You can play without registering. When you do, we store your guesses, the hints you opened and your results against an anonymous identifier held in a cookie-backed session. That identifier is not linked to you, and if you clear your cookies it is gone — along with the progress attached to it.

3. If you create an account

We store your display name, your email address and a hashed password (we never hold the password itself). If you played anonymously first, that progress is moved onto your account so you do not lose the solve that prompted you to sign up.

We use your email address to activate the account, to let you reset your password, and — only if you ask for it — to tell you when a new quest is live. Every such email has an unsubscribe link.

4. What we do with your play data

  • To run the game: to show your guess history, work out your score and keep your streak.
  • To publish leaderboards. Only your display name and score appear there — never your email address.
  • In aggregate, to see which quests were too hard or too easy.

5. Using the app

The Android and iOS apps play the same game against the same server, and everything above applies to them too. Three things work differently on a phone:

  • There is no cookie. Instead, the app generates a random identifier the first time you open it and sends that with each request, which is what lets you play without an account. It is not built from anything about your phone, it is not shared with anyone, and uninstalling the app destroys it along with the progress attached to it.
  • Signing in with Google or Apple happens on the device. Your provider hands the app a signed token, the app passes it to us, and we check it with the provider. We learn your email address and name; we never see your password, and nothing about your Google or Apple account beyond that reaches us.
  • The app asks for no permissions beyond access to the internet. It does not use your location, your contacts, your photos or your camera.

The apps carry no advertising. They do count use, through Google Analytics for Firebase: how many people open the app, how often they come back, which screens they reach, roughly where in the world they are and which version they are running. It is not joined to your Cairn account, and we never see an individual person in it — only totals.

The apps do not ask to track you across other companies' apps and websites, and they do not read your device's advertising identifier: the version of the analytics library they are built with does not contain the code that reads it. That is why iOS never shows you the "allow this app to track you" prompt.

Map tiles are fetched from the same third-party service the website uses, which will see your IP address as a consequence of serving them.

6. Cookies

Two kinds, and only one of them is up to you.

  • Strictly necessary. A session cookie, which is what keeps you signed in and holds anonymous progress, and a cookie to remember that you have already seen the "how this works" explainer. These are what you asked for by playing, the game cannot work without them, and so we do not ask permission for them.
  • Analytics. One Google Analytics cookie, so we can count visits. It is off until you say otherwise: when you first arrive, nothing is stored and Google is told that you have not consented. Choose "Allow all" and the cookie is set; choose "Necessary only" and it never is, and the game is exactly the same either way.

You can change your mind at any time from the Cookies link in the footer of every page. We ask again once a year regardless.

There is no advertising and no cross-site tracking on this site.

7. Third parties

Map tiles, fonts and a small number of JavaScript libraries are loaded from third-party services, which will see your IP address as a consequence of serving them. Historical information links out to Wikipedia; following those links is between you and them.

Google Analytics is the one we choose to send something to rather than merely load a file from: if you allow it, or if you use the apps, Google processes the visit data described above on our behalf. Google is in the United States, so that data leaves the UK.

If you choose to sign in with Google or Apple, that provider tells us your email address and name and nothing else.

8. How long we keep it

Account and play data for as long as the account exists. Deleting your account deletes your results, guesses and streak with it — including from the leaderboards.

9. Your rights

You can ask for a copy of your data, ask us to correct it, or delete your account outright from your profile page. If you would rather ask a person, contact us.