Last updated: 18 October 2026
LetterThat is a small hobby word game. We keep as little about you as possible.
Sign-in is handled by Supabase. It stores your account: your name, your email address and an account id. With Google sign-in, we only ask Google for your basic profile: your name, email and profile picture link. Supabase keeps that picture link with your account, but the game never uses or shows it: your avatar is one you pick from the game's built-in set. We use your name to show you to other players in a lobby, and your account id to know it's you when you join a game.
You only give a display name. It lives in the game server's memory while you play and is gone when the match ends. Nothing about guests is stored on our side.
Your browser keeps a few small things so the game works smoothly: your guest name, a random device key (so you can't sit in two games at once), the game you're in (so you can rejoin it after closing the tab), and your sign-in session if you signed in. Signing out clears your sign-in and guest name.
Lobbies and the words you find live in the game server's memory during a match. Other players see your name and score; your words are only shown to others in the end-of-round reveal. For signed-in players we save each finished match (your place, score, number of words found, XP and rating change) to build your profile, level and the public leaderboards, which show your nickname, level, rating and wins. Guests' results aren't saved.
Signed-in players can add friends. We save who you're friends with and any open requests; only the two players involved can see them. Your friends see your nickname, avatar, and whether you're online or in a game (not which lobby) while the site is open. Nothing about being online is saved. Removing a friend or deleting your account deletes the friendship.
No ads, no tracking or analytics, no selling or sharing your data.
The website is hosted on Cloudflare Pages, the game server on Fly.io (Amsterdam), and accounts on Supabase. They process data only to run the service.
Signed in? Use Delete my account at the bottom of the lobby page. It removes your sign-in and everything linked to it, straight away. Guests have nothing to delete.