Privacy

Analytics

Page views are counted with Cloudflare Web Analytics, which sets no cookies, builds no cross-site profile, and does not fingerprint your browser. It reports aggregate figures: pages, referrers, country, and Core Web Vitals. There is no advertising pixel and no session recording on this site.

We also load Google Analytics 4. It runs with Google's consent mode defaulted to storage denied: as the page loads, GA writes no cookie and keeps no identifier that survives the visit, so it can report that a page was seen without being able to connect that visit to your next one. GA would switch to its own first-party cookies, and count you as a returning visitor, only if you agreed to it — and the site does not ask: there is no consent banner, so today GA stays in this cookieless mode for every visitor. Nothing else on the page would change either way.

If your browser sends Global Privacy Control or Do Not Track, Google Analytics is never loaded at all: no request reaches a Google host. That is a stronger promise than consent defaults give, and it is deliberate — an explicit opt-out is not a default we override.

The newsletter

If you submit the form we store your email address, the time, and where the visit came from — the referring site and any campaign parameters in the link you clicked. That last part is how we tell which posts actually reach people; it is attached to the signup, not to your browsing.

We also record the country Cloudflare reports for the request, and a salted hash of your IP address so that one machine cannot submit the form a thousand times. The address itself is never written down: the hash cannot be turned back into it.

The list is stored in Cloudflare D1. It is never sold, rented, or shared. You will receive one email when Episode 1 launches and occasional notes about how it is being built. Every one of them carries an unsubscribe link, and you can remove yourself at any time by writing to hello@uncertainity.dev — we delete the row, not just flag it.

Bot protection

The signup form is rate-limited and screened for automated submission. It is also wired for Cloudflare Turnstile, a CAPTCHA replacement that usually requires no interaction from you; when the challenge is switched on it appears only on this page and only around the form. It is currently switched off, so at the moment nothing is asked of you at all.

Where your map starts

The game is a map of the world that fills in as you play, and it starts where you are. To do that the page reads the country code Cloudflare already attaches to your request — the same two letters that arrive with every visit to any site behind Cloudflare. It is used once, to choose which region lights up first, and it is never stored against you: read from the request, written into the page, forgotten.

This is not the browser's location feature. There is no permission prompt, no coordinates, no GPS, and nothing that could place you more precisely than the country you appear to be connecting from. If that is wrong — a VPN, a proxy, a quiet corner of the routing table — the map simply starts somewhere else, and your progress is kept in your own browser where we cannot see it.

How the page is doing

When you leave, the site sends one summary of that visit: whether you ever moved in the game, roughly how soon (under two seconds, two to five, and so on), roughly how much, whether you reached the end of a round, and roughly how long it has been since your last visit (first time, earlier today, yesterday, within a week, longer). That last one is worked out in your browser from a date it keeps in its own local storage; the date never leaves your device, only the coarse word does. That is the entire message — a handful of coarse words. It carries no identifier, no session, no timestamp, and it is added to running totals rather than stored as a record of your visit, so there is nothing left afterwards that could be about you.

It exists because the alternative is guessing. Whether people click the thing at all is what decides how the page gets rebuilt, and it cannot be answered without asking. The totals are public at /api/metrics — a project that publishes its graph openly should not keep its own numbers behind glass. If your browser sends Global Privacy Control or Do Not Track, nothing is sent at all.

Cookies

We set none of our own. Google Analytics sets none either unless you agree to it (see Analytics above), and nothing on the site asks you to. If you did, its _ga cookies would give your browser an id that is sent to Google with each page view, so a later visit could be recognised as yours. Cloudflare sets one, cf_clearance, as part of the bot protection in front of the site; it records that your browser passed a security check, not who you are or where you have been. Nothing we build reads it.

Which endings people reach

When the episode is live and you reach an ending, the site records one thing: which ending it was. No identifier, no session, no cookie, and nothing that ties it to you or to your other visits — the stored total is a single number per ending. It is what lets an ending screen tell you how rare yours was, which is a feature rather than a measurement of you. We keep a salted, one-way hash of your IP address for an hour so one machine cannot inflate a rarity figure; it cannot be turned back into an address, and the counts are approximate by design.

How many people are here

The page shows how many people are walking right now and how many have been today, which is the first thing anyone wants to know about a dark map. What is stored to produce those two numbers is a salted, one-way hash of your IP address and the minute you were seen — nothing else, no identifier, no session, no cookie. The hash cannot be turned back into an address, rows older than a day are deleted, and the counts are approximate by design. If your browser sends Global Privacy Control you are not added to the count; you still get to see it.

Walking with other people

Everyone playing the same country on the same day shares one room. While you are in it, your position on the map, the ground your light has cleared, and the name you chose (if you chose one) are sent to the others in that room, and theirs to you, so the country fills in faster than one person could fill it. Nothing about your device crosses, and nothing connects one day to the next. What you have found is never shared — the dark is shared, the findings are yours. The room exists for one country for one day and then it is gone. Global Privacy Control does not keep you out of it: it is a signal about selling and sharing personal data, and a lamp on a map shared with the people walking beside you is neither.

Playing with a friend opens a private room that only people with the link can join. There you can also chat: a line you type is relayed to the others in that room at that moment and is not stored, logged or kept anywhere — someone who joins later does not see it, and once everyone has left there is nothing to read. A private room is cleared about two days after it opens.

Leaderboards

If you put yourself on a board you choose a handle, and that handle and your score are shown to everyone — so pick something you are happy for strangers to read, not your name. We keep a salted hash of your address alongside it to stop one machine filling the board; as everywhere else on this site, it cannot be reversed. Not entering a handle means nothing is stored.

The game itself

The episode runs entirely in your browser. Your playthrough — where you walked, what you found, which calls you got right — stays on your device in local storage unless you deliberately choose to share it. Clearing your browser data erases it, and there is no copy anywhere else.

Last updated 23 August 2026. Questions: hello@uncertainity.dev.