The quiet policy
Privacy
Last updated: 19 August 2026. 27Rockets is designed to let you play anonymously, with an optional account for syncing history and accessing account features.
Who controls your data
27Rockets is the operator of this website and its games. For privacy questions or requests, use the contact address published with the service. You can also delete an account directly from the account page.
What stays on your device
If you play without signing in, your board progress, results, streaks, statistics, settings, tutorial state and a random player identifier are stored in your browser’s local storage. This copy is not sent to us unless you sign in and choose to sync it, or an analytics endpoint is configured for the service. Clearing browser or device storage removes this local copy.
What an account stores
When you sign in, Supabase stores your email address and authentication account. 27Rockets can store your synced results and puzzle history for the games you use, account tutorial state, archive entitlement and plan or subscription identifiers. Magic-link authentication means we do not store a password for you.
Why we use data
- To provide sign-in, account sync, archive access and account security.
- To save results and show your history and streaks across devices when you request that.
- To operate, protect, troubleshoot and improve the games.
- To meet legal, fraud-prevention or accounting obligations where those apply.
Account operation is based on providing the service you request; security and limited product measurement use legitimate interests where applicable. We do not sell personal data or use it for advertising profiles.
Analytics
The app records product events such as a puzzle opening, a run, a solve or a share. Events use counts and outcomes, a random local player ID and a timestamp. If no analytics endpoint is configured, events do not leave your device. If an endpoint is configured, those events are sent to the service operator for product measurement; they are not joined to your email by the app.
Service providers and sharing
Supabase provides authentication and database hosting. If paid plans are enabled, Stripe may process payments and billing identifiers; Stripe handles full payment-card details rather than 27Rockets. Hosting, security and analytics providers may process data only to provide those services. When you use a share action, the result content is sent to the platform or link destination you choose.
Retention and deletion
Account data is kept while your account is active so the service can provide sync and archive features. Local data remains until you clear it or use the account deletion control. Deleting your account removes the Supabase authentication account and the account’s synced results, history, entitlements and user-owned records. It also clears 27Rockets data from the current browser. Shared puzzle definitions and aggregate or anonymous records are not account records and are not removed by this action. Deletion is permanent.
Your rights
Depending on where you live and the legal basis involved, you may have rights to access, correct, delete, restrict or port your personal data, and to object to some processing or withdraw consent. Use the account deletion control for a direct deletion request; contact the operator for other requests. You may also complain to your local data protection regulator.
Changes
If the way we use personal data changes materially, this page will be updated before or when the change takes effect.