Privacy Policy
Last updated: August 22, 2026
The important part
Passwords you type into the game or any tool on this site are processed entirely in your browser. They are never transmitted to us or anyone else, never logged, and never stored on a server. You can verify this: load a tool page, disconnect from the internet, and it keeps working.
One clarification, because "processed in your browser" and "stored nowhere" are not the same promise: the tools store nothing, while the game saves your run, including the password you are building, in your own browser's storage so you can come back to it. Details are in the next section.
What is stored on your device
Nothing you type leaves your browser, but some of it is kept inside your browser, in
localStorage, under keys beginning with tpg-:
-
tpg-save-classic,tpg-save-blitzandtpg-save-daily-YYYY-MM-DD: your saved game, so you can resume a run. This save includes the password you are building in the game, stored as plain text. That is a throwaway string invented to satisfy the game's rules, not a credential, and it is readable by anyone who can already read your browser profile. Please do not type a real password into the game. tpg-sound: whether game sound effects are on.tpg-theme: light or dark.tpg-text-size: your chosen text size.
The tools are a separate case, and the distinction matters. The generators, the strength checker and the other tools on this site store nothing at all: what you type into them lives only in the page and is gone the moment you close the tab. Only the game writes a save.
The game's restart button (and starting a fresh run after a loss) deletes only the save for the mode you are playing. It does not touch your sound, theme or text-size preferences, nor the save for a different mode. Opening the Daily also deletes any Daily saves from previous days. To remove everything, clear this site's data in your browser settings.
Analytics
This site uses Google Analytics to count visits and see which pages people read. It records the page you are on, the site or search that sent you, your approximate location from your IP address, and your device and browser. It sets cookies to recognise a returning browser. It does not receive anything you type: not the password you are building in the game, and not what you paste into any tool.
What this changed, stated plainly. This site used to ship a Content
Security Policy with connect-src 'none', a rule telling your browser to refuse
every outbound network request from these pages. That made "nothing you type leaves your
browser" something your browser enforced rather than something we asked you to take on
trust. Analytics cannot function without sending data, so that rule has been relaxed to
allow Google's collection endpoints. The password promise at the top of this policy is
still true, and the code is still written so that no password is ever transmitted, but it
now rests on our word and on the site being open to inspection, not on a browser-level
block. We would rather write that down than quietly drop a claim we used to make.
You can opt out of Google Analytics in every browser with Google's opt-out add-on, and most content blockers stop it too. The game and every tool keep working normally with analytics blocked, because nothing here depends on it.
The contact form
The contact page embeds a form hosted by Google Forms. Loading it contacts Google, which may set its own cookies and log the request, and anything you submit goes to Google and is stored in our Google account rather than on this domain. Google's own privacy policy governs what happens inside that frame, because our Content Security Policy cannot reach into it.
If you would rather not load it, email the address on the contact page instead: it reaches the same place and involves nobody else. Contact is the only page that embeds a third-party frame; every other page on the site still refuses to load one at all.
We intend to fund the site with advertising from Google AdSense. Nothing has shipped yet, and the paragraph above will be rewritten the day it does. A privacy policy is worth little if it only describes the past, so here is what will change and what will not.
What will change. Google and its advertising partners set cookies and similar identifiers to serve ads, measure them, and in some regions personalise them using your earlier visits to this and other sites. You can review or switch off personalised advertising at Google My Ad Center, and opt out of many third-party vendor cookies at aboutads.info. Where the law requires consent, you will be asked before any of it loads.
What will not change. Ads will run on the written pages: rule guides, blog posts and reference articles. No advertising script will share a page with the password box, so the game and every tool stay free of them. We will not add analytics that record what you type, and the analytics described above does not.
Hosting
The site is served as static files from Cloudflare Pages, whose infrastructure logs standard request metadata (IP, user agent) for security and delivery; see Cloudflare's privacy policy for details.
Contact
Privacy questions: see the contact page.