Privacy

Last updated: 26 October 2026

Burrow is a small daily puzzle made by one person, Simon, in Croatia. It has no ads, no accounts, no cookies and no tracking of you as a person. Questions or requests: hello@burrow.day.

What stays in your browser

Your arrows, scores, streaks, the sound setting and whether you have seen the how-to-play steps are kept in your browser's local storage. They never leave your device unless you share a result yourself. Clearing your browser data removes them.

What reaches the server

When you submit, the game sends this so everyone can see how the day went:

the puzzle number,
your score, and the best possible score of that day,
a random id made by your browser, so the same result isn't counted twice.

To stop one machine from flooding a day with fake scores, the server also keeps a one-way hash of your IP address mixed with the day, so it changes every day and can't be turned back into the address. Your route is never sent. Nothing here is linked to a name, an email or an account. The scores are kept so the day's chart keeps working.

If you rate a garden, the server keeps the puzzle number and your rating (1 to 5) with the same random id and daily hash, so a rating can be changed and not counted twice.

Legal basis: legitimate interest in counting results fairly (Art. 6(1)(f) GDPR).

Daily reminder

Only if you turn it on: your browser gives the game an address at its own push service (Google, Mozilla, Apple or Microsoft). The server keeps that address, the hour you picked, the random id (so you are not reminded on a day you already played) and a one-way hash of your IP address, so one machine cannot sign up hundreds of times. The reminder itself carries no data. "Turn off", or blocking notifications for the site, removes it.

Hosting

The site and the score database run on Cloudflare (Cloudflare, Inc.). The database is kept in the European Union. Like any web host, Cloudflare handles your IP address to deliver the pages and protect the site from attacks. See Cloudflare's privacy policy.

The fonts, pictures and sounds come from this site itself.

Visit counts

To know roughly how many people visit and from which countries, the site uses Cloudflare Web Analytics. It sets no cookies, does not follow you across sites and does not build a profile; it only counts page views, the page, the referring site, the country and the browser type. Your IP address is not kept for this. See Cloudflare Web Analytics.

The game also keeps a few plain counters per day: how often each share button is used, how many shared links were opened, and how many people finished or skipped the how-to-play lessons or turned on the reminder. These are just numbers; nothing is stored about who did it.

Legal basis: legitimate interest in knowing how the site is used (Art. 6(1)(f) GDPR).

Sharing

The share buttons only open X, Facebook, Reddit or WhatsApp in a new tab with your score filled in. Nothing is sent to them until you post it yourself, and their own privacy policies apply there.

The shared link looks like burrow.day/s/26/12/15: the puzzle number, your score and the best possible score. That is all it carries, so the link preview can show a picture of the score. Nothing is stored when someone opens it.

Your rights

You can ask what is stored about you, and ask for it to be corrected or deleted, at hello@burrow.day. Since the scores only carry a random id, include the puzzle number and your score so I can find them. You can also complain to your data protection authority; in Croatia that is AZOP (azop.hr).