Privacy Policy

Effective date: upon owner-approved publication of this revised policy on playyaoku.com.

YAOKU at playyaoku.com is operated by Elijah Maxwell. This Privacy Policy explains how information is handled when you play puzzles, use an optional account or the leaderboards, or contact us. “YAOKU,” “we,” “us,” and “our” refer to Elijah Maxwell as the operator of the service. Privacy questions and requests may be sent to privacy-policy@playyaoku.com.

1. Playing and saving progress

You do not need an account to play. YAOKU has one game, the Daily: three puzzles (Easy, Medium, and Hard) that are the same for everyone on each calendar day in America/Chicago and change at Chicago midnight, including daylight-saving-time changes. The server chooses the current Daily from a set of puzzles prepared in advance, each with a verified unique solution. Your browser does not generate puzzles, and the server does not send the answer with the puzzle.

Loading the Daily is an ordinary web request that carries no identifier of yours. If you are signed in to an optional account, your browser also sends the session cookie described in section 3a with requests to YAOKU.

The game uses your browser’s local storage to remember the Daily boards you play (the puzzle, entered numbers, pencil notes, elapsed time, hints and checks, mistakes, completion, and how each square was solved for the optional result summary), Daily completion records used for local statistics and streaks, your settings, and whether you have seen the how-to-play tips. These records use the storage keys yaoku5-games, yaoku5-stats, yaoku5-settings, yaoku5-tutorial-done, and yaoku5-intro-seen, plus yaoku5-marks: records that keep the result-summary marks for an official attempt on this device. A service worker also keeps a copy of the site’s pages and scripts in your browser so YAOKU can open offline. YAOKU does not use gameplay analytics, so no analytics identifier or analytics event queue is stored.

Local storage records saved by the earlier version of YAOKU, such as yaoku-local-records-v1, a local player name, a visit streak, achievements, or an unsent analytics queue, are not changed or uploaded by the current site. It only reads the Daily completion records in yaoku-local-records-v1, on this device, so a guest Daily streak can continue and Settings can count them. Those records remain until you clear YAOKU’s site data in your browser.

When you play as a guest, your entered numbers, notes, and saved progress stay in this browser on this device; they are not uploaded, backed up, or synchronized. If you choose to start an official Daily attempt with an optional account, each card you place or erase and each hint or check you request is sent to the server so it can time and verify that attempt, as described in section 3a; that does not upload your guest boards or local history. Other people using the same browser profile may be able to see local records. Private browsing, browser settings, storage limits, or clearing site data may prevent saving or erase your records.

2. Gameplay analytics

YAOKU does not currently collect gameplay analytics or present analytics consent controls. This deployment does not send analytics report emails. Cloudflare may still process request information to deliver and secure the site, as described in the hosting section.

3. Shared puzzles and result summaries

After finishing a Daily, you can choose to share a text summary of your result: the Daily number, difficulty, elapsed time, mistake, hint, and check counts, whether it was an official result, a grid of colored squares showing how each square was solved (never the digits), and the address playyaoku.com. The summary is created in your browser and handed to your device’s share sheet or clipboard; YAOKU does not receive or store it. Services you share it on handle it under their own policies.

The earlier puzzle-link (/p) and result-link (/r) features have been retired: those links now open the YAOKU home page, and the current site does not save puzzle definitions or results for sharing. Puzzle definitions saved by the earlier sharing feature, which include each puzzle’s solution, were not deleted by this change and remain in the earlier service’s storage on Cloudflare Durable Objects. You can ask about their removal at privacy-policy@playyaoku.com, including the puzzle code. A code alone does not establish who created a puzzle because that registry has no creator-ownership records.

3a. Optional accounts, official Daily results, and leaderboards

Accounts are optional. An account adds official, server-timed Daily attempts, public Daily and Weekly Leaderboards, and statistics that follow you between devices. Every puzzle stays free to play without one. Account creation and leaderboards are offered only while they are enabled for this deployment; while they are not, the features in this section are unavailable and no account information is collected.

New account registration requires a username (3–20 letters, digits, or underscores, starting with a letter), confirmation that you are 13 or older, acceptance of the Terms of Service and this Privacy Policy, and acknowledgment that your username and official results are public. The age confirmation is a self-attestation, not age verification: the server records when you confirm, but does not verify your actual age. Accounts created before the age-attestation requirement may have no recorded age confirmation. YAOKU stores the username, the time you confirmed your age, the versions and times of the terms, policy, and leaderboard notice you accepted, when the account was created, and a random account handle given to your passkey provider. Do not use your real name, email address, phone number, or other personal information as a username. YAOKU does not ask for or store an email address, phone number, password, real name, or payment information.

Accounts sign in with passkeys. A passkey’s private key, and any fingerprint, face, or screen-lock data used to unlock it, stay on your device or with your passkey provider and are never sent to YAOKU. For each passkey, YAOKU stores its credential ID, public key, signature counter, transport hints, device type, whether it is backed up (synced), the name you give it, and when it was added and last used. There is no email or password recovery: if every passkey on an account is lost, access may not be recoverable.

Signing in sets one cookie, __Host-yaoku_session (HttpOnly, Secure, SameSite=Strict), holding a random session token. YAOKU stores a one-way hash of that token rather than the token itself, a session identifier, when the session was created, last used, and expires, when you last signed in with a passkey, and a coarse device label such as “Chrome on Android” derived from your browser’s User-Agent header; the full User-Agent is not stored. Sessions end after 24 hours without activity or 7 days at most, and you can see and sign out your sessions from your account. Sign-in challenges are single-use and expire after five minutes.

An official attempt starts only when you choose to start it while signed in, and uses the same public Daily puzzle everyone else gets. The server records the puzzle, its date and difficulty, and the start time, and receives each card you place or erase and each hint or check you request, so it can apply the move, measure time with its own clock, and count hints, checks, and wrong cards (mistakes). Mistakes are not shown during the attempt. The attempt record keeps your current entries, those counts, a move sequence number, and a one-way hash of your last move with the server’s response to it, so that a repeated request is not counted twice. Browser-reported times are not accepted. An attempt not finished within 24 hours expires.

When the server confirms that every card is correct, it records one official result for that puzzle: the server-measured elapsed seconds, hints, checks, mistakes, and completion time. Your username and official results appear publicly. Each Daily Leaderboard covers one Chicago date and difficulty, is viewable for the most recent 30 Chicago days, and shows rank, time, assists (hints plus checks), and mistakes. Each Weekly Leaderboard covers one difficulty and one UTC week (Friday through Thursday), counts at most one official completion per account, difficulty, and UTC date, and shows rank, completions, total time, mistakes, and hints. Earlier weeks remain viewable; official results and Weekly Leaderboard entries are not removed just because the Daily window rolls forward or a week ends—they remain until account deletion. Anyone can read or copy public standings, and copies outside YAOKU’s control may remain after deletion. Changing your username changes it on every leaderboard.

To limit abuse, account and leaderboard requests are rate-limited. A short-lived key is derived from a secret value, the action, the current minute, and either your connection’s IP address or, for some signed-in actions, your account, and Cloudflare’s rate limiter counts that key for that minute. The raw IP address is not stored in YAOKU’s database. No device fingerprint, browsing history, or advertising identifier is collected by the account or leaderboard services.

Account information, passkeys, attempts (finished, unfinished, or expired), official results, and Weekly Leaderboard entries are kept until you delete your account. Official results and weekly history remain in the standings after a Daily falls outside the 30-day view or a week ends. Sessions end after 24 hours without activity or 7 days at most; expired sessions and used or expired sign-in challenges are removed by routine cleanup. From your profile you can download your account data as a JSON file, change your username, sign out sessions, remove passkeys while keeping at least one, and permanently delete your account. Deletion requires a recent passkey sign-in and username confirmation. It removes the account, its passkeys, sessions, attempts, official results, and Weekly Leaderboard entries, so they no longer appear on YAOKU’s leaderboards. These application deletions do not guarantee immediate removal from Cloudflare-managed recovery copies or copies already made by other people. Deleting an account does not remove guest progress saved in your browser.

These protections deter casual abuse and duplicate results; they do not prove that a person solved a puzzle unaided. Because the Daily is public, server timing cannot show whether a player studied it beforehand. An official result is not a verified identity or a guarantee of fair play.

4. Hosting, fonts, and technical information

Cloudflare hosts YAOKU: the website (Cloudflare Pages), the YAOKU API (Cloudflare Workers), and the account database (Cloudflare D1). Delivering pages, assets, and API responses involves processing connection and request information, such as your IP address, requested URL, and browser-provided headers. YAOKU’s account database does not include IP addresses; this does not mean hosting or security infrastructure keeps no technical records.

YAOKU uses fonts already installed on your device and does not load fonts from Google Fonts or another font service. Cloudflare describes its handling of information in its Privacy Policy.

The game’s application code does not include an advertising SDK, third-party advertising tracker, tracking pixel, or analytics collector. The only cookie it sets is the sign-in session cookie described in section 3a, when you sign in to an optional account. It uses local storage and an offline copy of the site as described in section 1. This description is limited to the application: hosting, security, and email services also process information, and their own features, settings, and policies may apply. It should not be read as a statement that no technical data is processed or that every provider operates without cookies.

5. Email and information you provide

If you email us, the information involved may include your email address, message, attachments, and message headers. The purposes of handling correspondence include responding to questions, troubleshooting, considering puzzle ideas or business inquiries, and addressing privacy or legal concerns.

The published YAOKU addresses use Cloudflare Email Routing to forward incoming messages to the mailbox used for correspondence. Email delivery and storage also involve the sending and receiving email providers. We do not publish the private forwarding destination. Please include only information needed for your request; do not send passwords, passkeys, payment-card details, or unnecessary sensitive information.

6. Information use, disclosure, and retention

The application’s information flows support delivering the website, remembering games locally, and providing the optional accounts, official results, and leaderboards described in section 3a. The game code does not send gameplay records to advertising services or include a mechanism for selling player data. This describes the game’s functionality, not an assurance about every independent practice of an infrastructure provider.

Information may also need to be disclosed where required by law or to address security incidents, abuse, or legal claims, subject to applicable law. This does not provide us with remote access to records saved only in your browser.

Local game records remain until removed or overwritten by you, the application, or your browser. Account records are kept as described in section 3a. Puzzle definitions saved by the earlier sharing feature have no programmed expiration. There is no single fixed retention period stated in this policy for email, hosting records, or provider backups. Do not assume those records are deleted when you close the website or clear your browser. For questions about information associated with a particular message or request, contact privacy-policy@playyaoku.com. A request does not guarantee that every record or externally held copy can be deleted, and applicable legal requirements may affect the response.

7. Your choices and requests

You can remove locally saved games, statistics, and preferences with “Clear YAOKU data on this device” in Settings, or by clearing YAOKU’s site data in your browser settings, which also removes records left by the earlier version of YAOKU. YAOKU has no account-based recovery for those local records. Blocking local storage may prevent saving. Clearing local data does not delete an optional account or its official results; use account deletion in your profile for those. Clearing local data also does not erase puzzle definitions saved by the earlier sharing feature or correspondence.

Depending on where you live and the laws that apply, you may have rights to request access, correction, deletion, restriction, objection, or a portable copy of personal information, or to complain to a relevant privacy regulator. Send requests to privacy-policy@playyaoku.com. We may need proportionate information to understand the request and verify that it concerns you. Applicable exceptions may limit a request. We cannot retrieve gameplay-progress content that exists only in your browser. Account holders can download and delete their account data from their profile; a username alone does not establish ownership of an account. Do not send unrelated sensitive information to establish a connection.

8. Children under 13

YAOKU is for people age 13 and older. We do not knowingly allow children under 13 to use our services. Children under 13 must not use YAOKU or send us personal information; parental permission does not override this minimum age. Users age 13 or older who have not reached the age of legal majority where they live must have a parent’s or guardian’s permission to use the service.

If you believe a child under 13 has used YAOKU or provided personal information, contact privacy-policy@playyaoku.com. Provide only information necessary to identify the concern. If we learn that we have collected personal information from a child under 13, we will take appropriate steps to stop further collection and delete the information as required by applicable law.

The website does not verify ages or provide a parental-consent process. Optional account registration requires a self-attestation that you are 13 or older; the server requires this confirmation and records when you make it, but it does not verify your age. This restriction does not mean children’s access is technically prevented, and it does not replace any obligations imposed by children’s privacy law.

9. Security and policy updates

No website, browser-storage system, passkey provider, or email service can guarantee absolute security. Keep your devices and passkeys secure: anyone who can use one of your passkeys can use your account. If you share a device, consider who can access the browser profile containing your saved games.

We may update this policy to reflect changes in the service or applicable requirements. Updates will show a revised effective date. Where additional notice or consent is legally required, posting an updated page alone will not replace that requirement.

10. Contact

Operator: Elijah Maxwell, operating YAOKU.

Privacy and children’s privacy: privacy-policy@playyaoku.com.

Help: support@playyaoku.com.

See our Terms of Service and contact page for additional information and the other YAOKU email addresses.