Privacy Policy
AlibiCat (“the Game”, “we”, “us”) is a free browser-based logic puzzle game operated by an independent developer. This policy explains what information the Game handles, why, and the choices you have. We collect as little as possible: you can play the whole Game without creating an account, and an account is only needed to sync your progress across devices.
1. Information we handle
1.1 Playing without an account
- Game progress and settings (solved cases, best times, unfinished games, language, visual mode, auto-check preference) are stored only in your browser’s local storage. They never leave your device unless you sign in.
- Server logs. Our hosting provider (Vercel) receives standard technical data with every request, such as your IP address, browser type and the page requested, and keeps it in short-lived logs for security and reliability. We do not use analytics or advertising trackers.
1.2 Creating an account with email
- Your email address.
- Your password, stored only as a salted hash by our authentication provider (Supabase). We never see it.
- Sign-in timestamps and a session token kept in your browser so you stay signed in.
1.3 Signing in with Google
If you choose “Continue with Google”, we ask Google only for the basic profile scopes (openid,
email, profile). From Google we receive:
- your Google account email address,
- your name,
- your profile picture URL,
- a Google account identifier used to recognise you on your next sign-in.
We do not request or access anything else from your Google account — no Gmail, Drive, Contacts, Calendar, Photos or YouTube data.
1.4 Cloud save
When you are signed in, your game progress (the same data described in 1.1) is copied to our database so it can be restored on another device. It is stored as one record per account and is only readable by you.
2. How we use information
| Data | Purpose |
|---|---|
| Email address | Identify your account; send account emails you request (confirmation, sign-in link, password reset). No newsletters or marketing. |
| Name and profile picture (Google) | Shown to you in the account bar so you can see which account is signed in. |
| Google account identifier | Link your Google login to the same account each time. |
| Game progress | Save and sync your puzzles and best times across devices. |
| Server logs | Keep the site running and detect abuse. |
We do not sell personal information, do not use it for advertising or profiling, do not use it to train machine learning models, and do not combine it with data from other sources.
3. Google user data: additional commitments
Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, Google user data is:
- used only to provide and improve the sign-in and cloud-save features described above;
- not transferred to third parties except as necessary to provide those features (see section 4), to comply with law, or as part of a merger or acquisition with notice to you;
- never used for serving advertisements;
- never read by humans unless you have given explicit consent for a specific piece of data, it is necessary for security or legal compliance, or it has been aggregated and anonymised.
4. Who else processes your data
We use a small number of service providers who process data on our behalf and under our instructions:
- Supabase Inc. — authentication and database hosting (account records, hashed passwords, cloud saves). Supabase privacy policy.
- Vercel Inc. — website hosting and delivery (server logs). Vercel privacy policy.
- Google LLC — only if you choose Google Sign-In, as the identity provider. Google privacy policy.
These providers may store data on servers outside your country of residence. We do not share your data with anyone else, except where required by law.
5. Retention and deletion
- Account data and cloud saves are kept for as long as your account exists.
- Delete your cloud save at any time from the game: Case files → Settings → “Reset progress” while signed in. This removes the record immediately.
- Delete your account by emailing us (see section 9). We delete the account and all associated data within 30 days and confirm by email.
- Revoke Google access at any time from myaccount.google.com/permissions. This stops future sign-ins with Google but does not by itself delete your AlibiCat account.
- Local browser data can be removed by clearing your browser’s site data for alibicat.com.
- Hosting logs are retained by Vercel for a short period according to their retention schedule.
6. Cookies and local storage
The Game does not set tracking cookies. It uses your browser’s local storage for your settings, your local progress and, when signed in, a session token issued by Supabase. These are strictly necessary for the Game to function and are not shared with third parties.
7. Security
All traffic is encrypted with HTTPS. Passwords are hashed by Supabase and never stored in plain text. Database access is protected by row-level security so each account can only read and write its own record. No method of transmission or storage is completely secure, but we follow current best practices for a service of this size.
8. Children
The Game is suitable for all ages, but account creation is intended for people aged 13 or older (or the minimum age in your country). We do not knowingly collect personal information from children below that age. If you believe a child has created an account, contact us and we will delete it.
9. Your rights and how to contact us
Depending on where you live you may have the right to access, correct, export or delete your personal data, or to object to its processing. You can exercise these rights by emailing support@alibicat.com. We respond within 30 days.
10. Changes to this policy
If we change how we handle personal data, we will update this page and the effective date above. Material changes affecting signed-in users will also be announced inside the Game.