What we keep, and why.

The short version

• No account needed for gameplay, no advertising, and we don’t sell your information. Following uses optional email verification.
• Game progress is linked to a random browser cookie. If you verify an email for Following, it is associated with that player record.
• We only learn your email address if you type it into a Following or sponsor form.
• Analytics is off until you choose it. Your choice is saved in local storage; if you accept, PostHog saves an anonymous browser ID there. Analytics and error reports never include your name, email, organization or messages.
• Payments happen on Ko-fi, not on this site.

What we collect

When you play

The first time a game saves progress, or you like a chapter or send feedback, we create an anonymous player record and set a whs_session cookie in your browser. It holds a random token; we store only a scrambled (hashed) copy of it. With that record we keep:

• Chapter progress: a short save marker sent by the game (up to 256 characters).
• Whether you completed or failed a chapter, and the result the game reports.
• Chapters you liked or disliked.
• When each of these was created and last updated.

Feedback

If you use the feedback form we store the features and games you picked and any message you write (up to 2,000 characters), linked to your anonymous player record. Please don’t put personal details in the message.

Followed games and chapters

If you choose to follow a game or chapter, we create or reuse your browser’s player session and send a verification email when email service is configured. We store your email, the requested game or chapter, a hashed single-use code, its expiry and a hashed rate-limit client key. The code expires in 15 minutes and confirms only in the browser where you requested it. After verification, your email is associated with your existing player; if that email already has a verified player, this browser reconnects to that player and retains its anonymous gameplay history. You can follow more games and chapters without re-entering email, and unfollow them in Following. Older unverified requests are preserved but not activated automatically. We’ll email you when a game or chapter you follow is released.

Sponsor inquiries

If you send a sponsor inquiry we store your name, email address, organization (optional), what you’re interested in, your message (optional), the page and game or chapter you sent it from, the button you used, any campaign tag in the page address, and the date and status of the inquiry. We use it only to reply to you. To stop abuse, the form counts submissions per IP address for up to an hour in the server’s memory; that address is not saved with your inquiry.

Kept only in your browser

Some settings stay in your browser’s local storage and are never sent to us: your sound and volume choice (wh:settings), whether you confirmed you’re old enough for a game marked 13+ (wh:age-confirmed-13), and which chapter opening videos you’ve already watched (whp:opening:…). To make the Back button work while you search, the page library also keeps the current page address and copies of recently viewed search results in this tab’s session storage (htmx-current-path-for-history, htmx-history-cache), which your browser clears when you close the tab.

Analytics

Optional analytics is off by default. If you accept, PostHog counts page views and button/form use. We send the page path (without anything after a ? or #), event name, device category (desktop, mobile or tablet), and where relevant the game or chapter, button position, sponsor interest category, and a validated source, medium and campaign tag. We also send only the hostname of the page that referred you (or that the visit was direct), never its full address. PostHog stores a random anonymous visitor ID and session data in this browser’s local storage, plus tab-specific session data in session storage (no PostHog cookie). The ID survives reloads and later visits until you withdraw consent or clear site data; sessions renew after 30 minutes without activity and have a maximum length. We do not link this ID to player records, names or sponsor inquiries. Recording and automatic click tracking are off. Names, email addresses, organizations, messages, query strings and full referrers are removed before anything is sent. WHP disables IP/geolocation enrichment in the analytics SDK. PostHog still receives your IP address and your browser’s standard connection details as part of the network request, as any web service does.

Error reports

We use Sentry to find out when something breaks. Reports from your browser contain only a fixed failure type (game connection, saving progress or completion) and the game and chapter IDs; error text, page addresses, request details and user information are removed first. Server reports contain only a fixed failure category. Sentry receives your IP address as part of the connection; we don’t ask it to record personal information.

Server and network logs

Our application logs the request method, page path, response status and timing, but not IP addresses or anything after a ?. Our hosting and network providers handle your IP address to deliver and protect the site and may keep their own logs.

Games, images and video

Games are loaded from our own sub-addresses such as rabbit.oopshistory.com inside a restricted frame. They receive normal web requests from your browser and may keep their own data in your browser for that address. Images and videos come from media.oopshistory.com.

Payments and Ko-fi

“Buy me an ale” opens Ko-fi in a new tab. We don’t process payments and never see your card or payment details. Whatever you give Ko-fi is handled under Ko-fi’s own privacy policy. On our side we can only see, through analytics, that the button was shown or clicked, not whether you paid.

Who processes it

• Render runs the website (United States).
• Neon hosts our database, including player records, feedback, followed games and sponsor inquiries.
• Cloudflare provides our domain’s network, security and DNS, hosts the games and stores images and videos.
• PostHog receives analytics events (United States endpoint).
• Sentry receives error reports (United States endpoint).
• Ko-fi, only if you choose to open it.
• Resend delivers optional verification emails when configured, receiving the recipient address and verification message.

These providers may process information outside your country, including in the United States.

How long we keep it

• Sponsor inquiries: deleted 12 months after our last contact, unless we end up working together. A deleted inquiry can remain in our database provider’s short-term recovery backups until they expire.
• The whs_session cookie: expires after 90 days.
• Player records, progress, likes, feedback and Following email addresses: kept until we delete them. We have not set a fixed deletion period for these yet; when we do, it will be listed here.
• Analytics and error reports: kept by PostHog and Sentry according to the retention settings of our accounts.
• Browser settings and consent choice: until you clear your browser’s site data or change your choice; tab storage until you close the tab. With analytics consent, PostHog’s local anonymous ID remains until withdrawal or clearing site data.
• Rate-limit counters: memory counters last up to one hour. Verification requests use database-backed hourly limits; verification records and their hashed client keys are removed on the next request after 24 hours. When there are no new requests, they remain until maintenance cleanup.

Your choices

You can ask for a copy of the information we hold about you, or ask us to correct or delete it. Without email verification, anonymous game data isn’t tied to your name or email, so we usually can’t tell which record is yours. Clearing this site’s cookies and data cuts the link between your browser and that record and removes your saved settings.

Essential storage for game progress, settings and page history remains available regardless of your analytics choice. The banner lets you Accept or Reject optional analytics. “Analytics preferences” opens the single optional PostHog setting, shows your saved choice and lets you Save or Cancel changes. Use “Privacy preferences” in the footer at any time to withdraw: future analytics stops and the browser’s PostHog identity and session storage are cleared; previously received events remain with PostHog until their retention period ends. You can also clear site data, use private browsing, or block analytics; the site keeps working. We don’t currently change behavior based on Do Not Track or Global Privacy Control signals.

If you think a child has given us an email address or other personal information, please contact us and we’ll delete it.

Contact

For any privacy question or request, email [email protected].

Changes

When our practices change we’ll update this page and the date at the top. We keep the site secure with HTTPS, store session tokens only in hashed form and restrict the owner dashboard to the site owner.