Sign up5/5

Privacy policy

Last updated 5 October 2026

This policy explains what Tactic Rush (tacticrush.com) collects when you play, why, who it is shared with and what you can do about it. It describes what the site actually does today. If that changes, this page changes first.

Who we are

Tactic Rush is run by the operator of tacticrush.com ("we", "us"). For anything about privacy, write to support@tacticrush.com.

The short version

  • You can play without an account. We do not ask for your name, and we do not ask for your email address unless you sign up.
  • We record how the game is played (which puzzles are started, solved or left) on our own servers, to improve it. In the EU, the EEA, the UK and Switzerland this only happens if you allow it. Everywhere else it is on unless you turn it off, which you can do at any time.
  • No advertising company's code runs on the site: no tracker, ad pixel or ad network is loaded. The videos you can choose to watch for a reward are our own.
  • If you came here by tapping one of our ads on Facebook or Instagram, and you are outside the EU, the EEA, the UK and Switzerland, our server tells Meta (the company behind them) that the click led to someone playing, so our ads are shown to people who like chess puzzles. "Turn off" in the privacy bar stops that too. The details are under Advertising.
  • We do not sell your personal information. Apart from what the line above describes, we do not share it for advertising.
  • Accounts are for people aged 13 and over.

What we collect, and why

When you play without an account

Looking at a page creates nothing. The first time you do something that counts (for example starting a run, solving a puzzle or spending energy) the site quietly creates a player account without any personal details: a random id, kept in a cookie in your browser. It exists so the game can remember your progress and so that rewards are decided by our server, not by the browser. Against that id we store:

  • your game progress: rating and rank, level, XP and streak, energy, the lessons and puzzles you finished and how they went, your unlocked and equipped items;
  • The Run: your coins, unlocks and loadout, which puzzles our server gave to each run and what the run paid;
  • the season: your points and the rewards you claimed;
  • rewarded videos: which video was started, when, and whether it was watched to the end (that is how the reward is confirmed);
  • your browser's time zone (for example "Europe/Paris"), so that the daily energy refills at your midnight;
  • your answer to "How well do you know chess?", if you give one;
  • one word saying which analytics rule applied to you (opt-in region, other region, or unknown). Not the country.

This is the game itself, so it is stored whatever you choose about analytics.

When you create an account

  • Email address and password. The email identifies your account and is used to send the confirmation email. The password is handed to our authentication provider, which stores it in hashed form; we do not keep a readable copy.
  • Date of birth. The sign-up form asks for it once, to check that you are old enough to have an account (13 or over). It is not stored. We store only the time at which the check was passed. If the date entered is below the minimum age, no account is created and nothing about the date is kept; the browser gets a cookie that holds the single word "blocked", so the form cannot simply be tried again.
  • Your progress so far. Signing up turns the player account described above into your account, so nothing is lost. Signing in to an account that already exists moves the progress of the browser you were playing in into that account.
  • A handle, if you choose one. A handle is optional. If you claim one, it is shown publicly on the leaderboard together with your rank, your rating and any membership badge. Do not use your real name if you do not want it shown.

When you buy something

Payments are taken by Stripe on Stripe's own checkout page. We never see or store your card number. We send Stripe your account's email address and account id so that the purchase can be matched to your account. We store Stripe's customer reference, the state of your membership (plan, tier, current period, whether it is set to end), and for each purchase or payment: what was bought, the amount and currency, the date, Stripe's reference numbers, and whether it was refunded. These records are kept whatever you choose about analytics, because they are needed to deliver what you bought and to keep accounts. Stripe handles your payment details under its own privacy policy.

Gameplay analytics (only while it is on)

When analytics is on, your browser sends our server a record of how the game is played. It is stored in our own database. None of these records is passed to anyone else; the one thing that leaves our servers is the short signal to Meta described under Advertising, and only for visitors who came from one of our Meta ads.

  • Gameplay events: a puzzle or lesson shown, started, each move tried, hints, finished or left; runs, floors, perks, coins and Locker purchases; daily puzzle results; rank changes; the energy, rewarded-video, season, store and membership screens that were shown; which version of a feature being tested you were shown.
  • With each event: a random device id that the site makes up and keeps in your browser's storage, a session id, the time, and your player account id once you have one.
  • How the visit arrived, once per visit: the campaign tags on the link you followed (utm_source, utm_medium, utm_campaign, utm_content, utm_term), the domain of the site you came from (not the full address), whether the link carried an advertising click id (yes or no only; the id itself is never stored in analytics; the one exception, for our own Meta ads, is described under Advertising), the path of the page you landed on, and your country as two letters. The first of these is kept with the device id and, later, with your account.

Analytics events never contain your name, your email address or anything you typed. We use them to see where players get stuck or leave, to rank lessons, to compare two versions of a feature, and to see which links and ads bring players.

Technical information

Like every website, our servers receive your IP address and your browser's details with each request. We do not write the IP address to our database. It is used in the server's memory to limit abuse (too many requests from one address), it is passed to our authentication provider for the same reason, and our hosting provider uses it to tell us the country you are in (two letters), which decides which analytics rule applies to you. For visitors who came from one of our Meta ads, the IP address and the browser's details are also passed on to Meta with the signals described under Advertising; we do not keep them. Our hosting, database and authentication providers keep their own technical logs (such as IP address, browser type and time of request) for security and operations.

If you write to us

If you email us, we receive your email address and whatever you write, and use it to answer you.

Analytics: your choice, by where you are

Where you are
EU and EEA countries, the United Kingdom, Switzerland (and their territories)
Gameplay analytics
Off until you choose "Allow"
What you see
A question, with "No thanks" and "Allow"
Where you are
Any other country
Gameplay analytics
On from the first page, until you choose "Turn off"
What you see
A notice, with "Turn off" and "OK"
Where you are
Country not known
Gameplay analytics
Off until you choose "Allow"
What you see
The same question as in the EU
  • To turn analytics off (or on) use the button in the privacy bar, or go to Profile > Privacy at any time. You do not need an account.
  • Turning it off takes effect at once: anything waiting to be sent is thrown away, the device id and session id are removed from your browser, and nothing more is recorded. Your choice is remembered for 180 days; after that the bar is shown again.
  • Where analytics is on by default, the first moments of a visit may already have been recorded before you turn it off. Turning it off does not delete those earlier records; you can ask us to delete them (see "Your choices and rights").
  • Your country is worked out by our hosting provider from your network address. On a VPN or a company network it can be wrong, and you may then see the other version of the bar. The buttons work the same either way.
  • Playing the game works exactly the same whatever you choose.

Cookies and storage on your device

The site uses a small number of cookies and entries in your browser's storage. All of them are our own (first-party). Two of them (${META_CLICK_COOKIE} and ${AD_EVENTS_COOKIE}) exist for the advertising signal described under Advertising; no other is used for advertising. You can delete them in your browser's settings; the game will then treat you as a new visitor, and progress that was only attached to that browser may be lost.

Cookies

Name
sb-…-auth-token (the name contains our database project's id; it can be split into numbered parts)
Set when
Your player account is created (the first thing you do that counts), or you sign in
What it is for
Keeps this browser signed in to your player account, anonymous or registered
Kept for
Up to 400 days, renewed while you keep visiting; removed when you sign out
Name
consent
Set when
You answer the privacy bar or change the privacy settings
What it is for
Remembers your analytics and ad-measurement choice
Kept for
180 days
Name
feed_seed
Set when
Your first visit
What it is for
A number from 0 to 9,999, shared by many browsers. Keeps the order of the lesson list stable for you. It is not an identifier and is never sent to analytics
Kept for
1 year
Name
exp_unit
Set when
Your first visit
What it is for
A random id that decides which version of a feature being tested this browser shows, so it does not flip between versions. Once you have a player account it is linked to it on our server, so the same version follows you to another device. It is never sent to analytics
Kept for
2 years
Name
tz
Set when
Your first visit
What it is for
Your browser's time zone, so the daily energy refills at your midnight
Kept for
1 year
Name
skill_placement
Set when
You answer "How well do you know chess?"
What it is for
Remembers your answer, so the first puzzles fit you
Kept for
1 year
Name
age_gate
Set when
Only if a date of birth below the minimum age is entered at sign-up
What it is for
Holds the word "blocked", so the form cannot simply be tried again. It does not hold the date
Kept for
1 year
Name
mclk
Set when
Only if you arrive by tapping one of our ads on Facebook or Instagram, outside the EU, the EEA, the UK and Switzerland, and have not turned analytics off
What it is for
Holds the click id that Meta put on the ad's link, so our server can tell Meta that this click led to play (see Advertising). Scripts on the page cannot read it. No longer used from the moment you choose "Turn off", and removed with the next page you open
Kept for
Until you close the browser; ignored and removed after 24 hours at most
Name
ad_events
Set when
Only when you sign up, while the advertising signal is in use
What it is for
Holds one word: "ok" if the date of birth given at sign-up was 18 or over, "off" if it was under 18. "off" stops the advertising signal for this browser. It does not hold the date
Kept for
1 year
Name
pending_merge
Set when
Only if moving a browser's progress into your account failed at sign-in
What it is for
Holds the id of the anonymous player account, so the move can be tried again
Kept for
7 days, or until the move succeeds
Name
exp_override
Set when
Only if you open a link that carries a test parameter (?exp=)
What it is for
Used by us to preview a version of a feature. It is ignored for players
Kept for
1 day

Browser storage

"Local storage" stays in your browser until you clear the site's data. "Session storage" belongs to one tab and is removed when the tab is closed.

Name
analytics.anonymousId
Where
Local storage
What it is for
The random device id of gameplay analytics. Only written while analytics is on; removed when you turn it off
Sent to our server?
Yes, with analytics events
Name
analytics.session
Where
Session storage
What it is for
The analytics session id. Only written while analytics is on; removed when you turn it off
Sent to our server?
Yes, with analytics events
Name
attribution.pending.v1
Where
Session storage
What it is for
Only where analytics is opt-in and you have not answered yet: how this visit arrived, held so it can be recorded if you choose "Allow" later in the same visit. Deleted on "No thanks"
Sent to our server?
Only if you allow analytics
Name
attribution.sent.v1
Where
Session storage
What it is for
Only while analytics is on: notes that this visit's arrival has been recorded, so it is recorded once
Sent to our server?
No
Name
lesson-attempt:<lesson>
Where
Session storage
What it is for
The id of a lesson you have started and not finished, so reloading the page does not cost energy twice
Sent to our server?
The id is sent when you play
Name
run.history.v1
Where
Local storage
What it is for
Your Run history in this browser: recent runs, personal bests and the puzzles you saw recently
Sent to our server?
The list of recent puzzles is sent so you are not given the same ones again
Name
run.locker.v2 (and the older run.locker.v1)
Where
Local storage
What it is for
A copy of your Locker (coins, unlocks, loadout) and any changes not yet confirmed by our server
Sent to our server?
Yes: it is your game progress
Name
daily.history.v1
Where
Local storage
What it is for
Your progress in the daily puzzle in this browser
Sent to our server?
No
Name
vfx.muted, vfx.animations, vfx.animations.new
Where
Local storage
What it is for
Sound on or off, and the board animations you chose
Sent to our server?
No
Name
offers.v1, earn.seen.v1, skill.placementSkips, exp.exposed.v1
Where
Local storage
What it is for
Which notes and offers you closed or have already seen, so each is shown (or counted) once
Sent to our server?
No

When you buy something you leave our site for Stripe's checkout page, which sets its own cookies under Stripe's cookie policy.

Advertising

  • No ad network, tracker or ad pixel is loaded on Tactic Rush, for anyone. Your browser never contacts an advertising company because of this site.
  • The videos you can choose to watch for a reward (energy, a revive, doubled coins) are our own demonstration videos for invented products, labelled "Sponsored (demo)" and served from our own site. Watching one sends nothing to any advertiser. We record that the video was started and finished, against your player account, to confirm the reward and to enforce the daily limit of 5 energy videos.
  • There is a separate "ad measurement" choice in the privacy bar and under Profile > Privacy. It is off unless you turn it on, it can only be turned on by a signed-up account, and nothing uses it today. If we ever load an advertising partner's code on the site, it would only load for signed-up accounts that turned this on, and this policy will be updated before that happens.
  • If you arrived from an advertisement, the ad platform knows you clicked. We record the campaign tags described above. For ads on platforms other than Meta's, we send nothing about you back to the ad platform.

If you came from one of our ads on Facebook or Instagram

We advertise Tactic Rush on Facebook and Instagram, which belong to Meta. So that Meta shows those ads to people who actually want to play, rather than to people who tap by accident, our server tells Meta when a tap on one of our ads led to play. Nothing of Meta's runs in your browser for this; the message goes from our server to Meta's.

Who it applies to
What happens
Only a visit that arrived by tapping one of our Meta ads (the ad's link carries a click id that Meta adds, called fbclid). Only outside the EU, the EEA, the UK and Switzerland, and never when we cannot tell your country. Only while gameplay analytics is on for you. Only adults: our ads are shown to people Meta believes are 18 or over, and if you sign up with a date of birth under 18 it stops for your browser.
When a message is sent
What happens
At most once each, the first time you: see the page at full size (not the small preview under a video), pick up a piece, play a move, solve a puzzle, finish a run, or complete sign-up.
What the message contains
What happens
The name of that event (for example "PuzzleSolved"), the time, a random-looking reference number so it is counted once, the address of the page without anything after the "?", the click id from the ad's link, and your IP address and your browser's description (its "user agent"), which Meta requires to accept the message.
What it never contains
What happens
Your name, your email address, your account id, our analytics ids, which puzzle it was, your moves or your results.
What we keep
What happens
The click id is held in a cookie in your browser (mclk, see the cookie table) for the visit, 24 hours at most. It is not written to our database or our logs, and neither are the IP address or the user agent we pass on. We keep a list of which events were sent (a scrambled reference that cannot be turned back into the click id, the event's name and the time) for 30 days, so that nothing is sent twice.
What Meta does with it
What happens
Meta matches the click id to the Facebook or Instagram account that tapped the ad and uses the event to measure our ads and to decide who sees them. Meta handles it under its own terms and privacy policy.
How to stop it
What happens
Choose "Turn off" in the privacy bar, or turn analytics off under Profile > Privacy. It stops at once, and the click id is removed from your browser with the next page you open. Closing the browser also ends it. What was already sent to Meta stays with Meta; you can manage it in your Facebook or Instagram settings ("Your activity off Meta technologies").

Who we share information with

We do not sell your personal information. The one case in which information goes to another company for advertising is the signal to Meta described under Advertising, for visitors who came from one of our Meta ads. We use these service providers, who process information for us:

Provider
Supabase
What it does for us
Database and sign-in (authentication)
What it handles
Everything stored on our server: accounts (email, hashed password), game progress, analytics events, purchase records. Receives your IP address when an account or session is created
Provider
Vercel
What it does for us
Hosting: serves the site and runs our server code
What it handles
Every request to the site, including IP address and browser details; works out your country from the IP address
Provider
Stripe
What it does for us
Payments and subscriptions
What it handles
Your payment details (which we never see), your email address, our account id for you, and what you bought
Provider
Resend
What it does for us
Sends our emails
What it handles
Your email address and the content of the email (the account confirmation message)

Meta Platforms (Facebook and Instagram) is not one of our service providers: it receives the advertising signal described under Advertising (event name, time, page address, ad click id, IP address, browser description) for visitors who came from one of our Meta ads, and uses it under its own terms.

  • Public information. If you claim a handle, the handle, your rank, your rating and any membership badge are visible to everyone on the leaderboard. "How did others do" on the daily puzzle shows percentages only, never individual players.
  • The law. We may disclose information if the law requires it or to protect the service and its players against fraud and abuse.
  • Artwork. Some of the game's artwork was created with an AI image tool (fal.ai) while the game was being built. No information about players is sent to it.

Where information is processed

Our service providers may store and process information in countries other than the one you live in, including the United States.

How long we keep it

We want to be plain about this: today the site has no automatic deletion schedule.

  • Accounts and game progress are kept for as long as the account exists. Anonymous player accounts (created by playing without signing up) are not deleted automatically either.
  • Gameplay analytics events are kept without a time limit at present.
  • Purchase and payment records are kept for as long as we need them for accounting, tax and disputes.
  • The list of advertising signals sent to Meta (a scrambled reference, the event's name and the time; see Advertising) is deleted after 30 days. How long Meta keeps what it received is set by Meta.
  • Cookies and browser storage last as long as the tables above say, or until you clear them.
  • You can ask us to delete your information at any time (next section). We will set fixed retention periods and state them here when they are in place.

Your choices and rights

  • Turn analytics off: the privacy bar, or Profile > Privacy. This also stops the advertising signal to Meta, if it applied to you.
  • Clear the browser's data: your browser's settings remove the cookies and storage listed above.
  • Delete your account or your data. There is no delete button in the game yet. Write to support@tacticrush.com from the email address of your account and ask; we will delete the account and the game records linked to it. If you played without an account, tell us you want the browser's player record removed and we will explain how to identify it. Records we must keep by law (for example of payments) are kept, without more than is needed.
  • See, correct or get a copy of your data, or object to how it is used: write to support@tacticrush.com.
  • Cancel a membership: the membership page, "Manage or cancel membership".

Depending on where you live, the law may give you rights over your personal information, such as the right to access it, correct it, delete it, receive a copy of it, restrict or object to its use, and withdraw a consent you gave. We will not treat you differently for using them. If you live in the EU, the EEA, the UK or Switzerland you also have the right to complain to your data protection authority.

Where European data protection law applies, we rely on: the contract with you to run the game, your account and your purchases; your consent for gameplay analytics and for ad measurement; and our legitimate interests in keeping the service secure, limiting abuse, keeping the site consistent for you (for example which version of a feature you see) and, outside the countries where we ask first, understanding how the game is played. The advertising signal to Meta is not sent for visitors in the EU, the EEA, the UK or Switzerland.

Children

  • Tactic Rush is meant for players aged 13 and over. It is not directed at children under 13.
  • Accounts are only for people aged 13 or over; the sign-up form checks this with a date of birth that is not stored. Purchases need an account.
  • The game can be played without an account, and we do not ask your age to do that. We do not knowingly collect personal information from children under 13.
  • The advertising signal to Meta (see Advertising) is meant for adults only. Our ads are shown only to people Meta believes are 18 or over, the signal is sent only for visits that come from those ads, and it is switched off for a browser in which someone signs up with a date of birth under 18.
  • If you are a parent or guardian and believe your child under 13 has given us personal information, write to support@tacticrush.com and we will delete it.
  • If you are under 18, please read this policy with a parent or guardian.

Security

The site is served over an encrypted connection (HTTPS). Rewards, coins and purchases are decided by our server, and the database only accepts changes from it. No system is perfectly secure; if you think your account has been misused, write to us.

Changes to this policy

When what we collect or how we use it changes, we update this page and its date before the change takes effect.

Contact

Questions, requests and complaints: support@tacticrush.com. See also the terms of use.

We record how puzzles are played, to improve them. Visits from our ads are reported to Meta. Privacy settings · Policy