Rarish is a free daily general-knowledge game, operated by Jack Fishwick ("we", "us"). For any privacy question or request, contact us at rarishapp@gmail.com.
Our approach
The game is designed to collect as little as possible. You can play without an account, and we never ask for your name or email address. Saving your progress is optional: if you choose to, we keep a passkey, or a username and password, as described below. We do not use advertising or third-party tracking, and we do not sell or share your data.
What we collect, and why
An anonymous player ID (essential cookie). When you first visit, we set a random, anonymous identifier in a cookie so the game can remember your plays, keep your streak, and stop a single player submitting more than the allowed answers. It is not linked to your identity and is not used to track you on other websites.
Your own play history (stored on your device). Your answers and results are saved in your browser's local storage so your history works without a login. This stays on your device. A compact copy of the answers you gave (not your results) is also kept on our servers, linked to your anonymous player ID, so your history can be restored if your browser clears its storage or you move to a new device.
Answer submissions. When you lock in an answer we store the answer, timing, and, to keep the game fair and detect abuse: a one-way daily hash of your IP address (we never store your actual IP address, and the hash cannot be linked across different days), your approximate country, and a short one-way fingerprint of your browser's user-agent string (not the string itself).
A way back to your progress (only if you save one). If you choose to save your progress, we keep a username and password or a passkey so you can restore your history in a new browser or on a new phone. For a username and password we store the username you chose and only a salted one-way hash of the password, never the password itself; restoring needs both, and repeated wrong guesses lock the account for a while. We suggest a made-up username (a made-up animal, such as "rainbow-manatee"), so you need not use anything that identifies you; if you choose to use your name or email address as your username, we keep it only for this. For a passkey we store only its public key: the private key, and whatever unlocks it (Face ID, a fingerprint or your screen lock), stay on your device and in your password manager and never reach us. Anyone holding your username and password, or your passkey, can restore your play history, so keep them private. All of it is deleted with the rest of your data when you use Delete my data.
A morning reminder (only if you turn it on). If you tap “Remind me”, your browser gives us a push address for this device, which we keep, with your device’s time zone (such as “America/New_York”), linked to your anonymous player ID, so we can send one notification each morning once the results are in, at a reasonable hour where you are. The notification carries no message from us: your device shows fixed text. Turn it off with “Turn off” or in your browser or phone settings; an address that stops working is deleted automatically, and all of them are deleted when you use Delete my data.
Challenge links (only if you send one). We store which puzzle it is for and how many answers you gave, never the answers themselves. When someone opens it we record that it was opened and whether they went on to play, to understand how challenges are used.
Anonymous usage statistics. We record which screens and puzzles are used, and basic timing, to understand and improve the game. We also record how you arrived: whether through a link someone shared from the game, or the name of the website that linked to us (for example reddit.com, never the full address of the page), and whether this is your first visit, which your browser remembers in its local storage. These statistics are not linked to your player ID or to you, and are kept for about three months, after which only totals are kept.
Legal basis (UK GDPR)
We rely on our legitimate interests in operating a fair, functioning game for the essential player cookie and the fair-play data described above. Our usage statistics are anonymous and are not tied to any identifier.
Cookies
We use a single, essential first-party cookie for the anonymous player ID described above. It is set with HttpOnly and SameSite=Lax, and is used only to run the game. We do not use advertising, analytics, or third-party cookies.
Who processes your data
The game is hosted on Cloudflare, which processes requests and stores game data on our behalf as our infrastructure provider. We do not send your data to any other third parties.
How long we keep it
Full answer submissions, with the fair-play data above, are kept in our live database for about two days after a day's results are revealed, then moved to archive storage (also with Cloudflare) where they are kept to allow fair-play checks. The compact copy of your own answers is kept so your history can be restored. The daily IP hash is scoped to a single day and cannot be correlated across days. The anonymous player cookie expires after a period of inactivity.
Your rights
Under UK data protection law you have rights including access, correction, and erasure of your personal data. You can erase your data yourself at any time from History → Delete my data: it removes your answers, history and challenges from our live database straight away and clears your browser. Answers from past days that have already moved to the fair-play archive are not individually edited out of it. To make a request, email us at rarishapp@gmail.com. Because the game is anonymous, we may need your player ID (or other details) to locate your data, and in some cases we may be unable to identify it.
Children
Rarish is intended for a general audience. We collect only minimal data and do not profile users or serve advertising. If you are under 13, please ask a parent or guardian before playing.
Changes
We may update this policy; the "last updated" date above will change. Continued use after an update means you accept the revised policy.
Complaints
If you have a concern we have not resolved, you can complain to the UK Information Commissioner's Office at ico.org.uk.