Last updated: 28 September 2026. Osteodle is operated by Cameron Hayward. For privacy questions, email haywardosteopathy@outlook.com.
Information we use
You can play without an account. Your browser stores daily progress, guesses and basic statistics on your device using local storage. You can clear this in your browser settings.
If you choose to add a guest result to the leaderboard, we store a random guest identifier, your optional display name, and the submitted puzzle, guesses, outcome, clue count and completion time. Your display name and aggregate scores are public. A secure cookie lasting up to one year connects submissions in that browser. Clearing the cookie or using another device loses that connection, but does not delete previously submitted results.
If you create an account, we store your email address, optional display name, a password hash, account dates, session records and completed game results. Saved results include the puzzle, outcome, number of clues used, guesses and completion time. Your display name and aggregate scores may appear on the public leaderboard. Your email address does not.
We also process information needed to protect the service, including security events and request information used for rate limiting and Cloudflare Turnstile checks. Please do not submit patient information or confidential clinical details.
Why we use it
We use account information to provide sign in and save results across devices, relying on our agreement to provide the account service. We use security information to protect accounts and operate the site, relying on our legitimate interests in a safe service. Local game storage supports the game you choose to play.
Cookies, storage and providers
When you sign in, a secure session cookie keeps you signed in. It is set for up to 30 days and is needed for the account service. The game uses local storage for progress and statistics. We do not use Osteodle game data for advertising or trend logging.
Cloudflare hosts the site and processes account data in Workers and D1. Cloudflare Turnstile checks account requests for abuse. Cloudflare may process service data outside the UK; contact us for information about applicable safeguards. If you follow a link to a social platform to share a result, that platform handles your visit under its own privacy terms.
How long we keep it
Account details and saved results remain while your account exists. You can delete your account and its saved results from the account page after confirming your password. This does not clear progress stored only in your browser. Security records are kept as needed to investigate abuse and protect the service.
Guest results remain until you remove them using the guest controls on the leaderboard or request deletion through our contact page. Signing in from the same browser transfers guest results to your account and removes the separate guest entry. The guest cookie and result storage provide the leaderboard service you choose to use.
Your choices and rights
You can play without signing in, clear local storage in your browser, or delete your account. You can ask for access to, correction of, or deletion of personal information, or object to or restrict certain uses, through the contact route. We may need to confirm your identity. You can also complain to the UK Information Commissioner’s Office.
We will update this notice if the service or its data practices change.