Privacy

Updated October 7, 2026. This page describes the rebuilt Brawldle site operated by MortipinS. The original site's account service may also be used when you sign in with an older account.

Accounts and email

We store your username, a salted password hash for accounts created or recovered here, and a fingerprint of your email address for account matching. We do not store your new password in plaintext. When you request a signup or recovery link, your email address and message are sent to Resend for delivery. Email delivery records may therefore contain your address. Links expire after 30 minutes and work once.

If your account still uses the original MortipinS password, sign-in sends your username and password to the existing MortipinS account service to verify them. Recovering your account on the rebuild sets a separate password here; it does not change your old-site password.

Gameplay and public content

We store guesses, scores, game progress, bookmarks, clip ratings, multiplayer participation, submissions, and reports. Leaderboards display usernames and scores, including generated guest nicknames in separate guest standings. Guest nicknames identify browser profiles, not verified people. Signing into an existing account on the same browser transfers solo guessing history; conflicting Daily or challenge attempts remain history without a second ranked attempt. Submitted clip titles and credits can become public after review. Historical guess totals and leaderboard snapshots were imported from the original site. Aggregate guess and profile counts may be shown publicly.

Cookies and preferences

A session cookie keeps your guest progress or signed-in session associated with your browser. Sessions expire after 30 days. Theme and motion preferences use local browser storage. Clearing cookies can disconnect you from guest progress. Signing out removes the current server session; resetting your password invalidates other sessions on the rebuild.

Hosting and abuse prevention

Cloudflare hosts the application and database. Requests include network information such as your IP address, browser details, and request URL. We use request logs and rate limits to diagnose errors and prevent abuse. Some rate-limit records contain an IP address or its fingerprint. Expired sessions, email links, and rate-limit records are periodically removed. Account and gameplay records remain until removed; backups and service-provider logs may retain data separately.

YouTube and other services

Clip thumbnails load from YouTube's image service. Playing a clip loads an embedded YouTube player, which connects your browser to YouTube. Following Discord or other external links takes you to services with their own privacy practices. The rebuilt application does not currently load Google Analytics or AdSense scripts.

Requests and contact

For account help, privacy questions, or deletion requests, use the contact page. Please identify your username and request without sending your password or recovery link. We may need to verify account ownership before changing or removing data.

Children

This site is not intended for children under 13. If you believe a child has provided personal data, contact us to request removal.

This notice will be updated if the site's data practices change.