The short version
Outlier Duel has no user accounts. You play anonymously. We store your game answers, scores and a scrambled network identifier while you play and for a short period after, so the game works fairly and can stop abuse. We run no advertising, and we never sell anything. The analytics we do run are aggregate and cookieless (see below).
What is stored, and why
| Data | Purpose | Retention |
|---|---|---|
| Game answers you type (raw text and the matched label), round outcomes, points | Server-authoritative scoring, your resume-in-progress screen, and friend-duel results | Up to 30 days, then deleted or anonymized |
| Session record: random id, hashed capability secret, question set, timestamps | Keeping your game refresh-safe; the secret itself is never stored, only its SHA-256 hash | Session lifetime + 30 days |
| Challenge records: hashed invite token, inviter/invitee session references, duel outcome | Friend duels and rematches | 30 days after challenge creation |
| Truncated, salted hash of your IP address (16 hex characters — not the address itself) | Daily session quotas and abuse limits only; it cannot be reversed to your IP without brute force | Deleted with its session |
| Answer reports (round reference + your note, max 500 characters) | Reviewing missed valid answers to improve the question bank | Until resolved, then deleted |
What is deliberately NOT collected
- No names, emails, or account data — there is no sign-up.
- No precise location, device fingerprint, or cross-site identifiers.
- Analytics runs in cookieless mode: Google Analytics 4 (
client_storage: none, IP anonymization) and Plausible Analytics are both active, and neither sets cookies or stores a persistent device identifier. They receive only aggregate page views and game events (mode, round number, score bucket) — never your answer text, invite tokens, or identifiers. No advertising or cross-site trackers exist on this site. - Your answers to one duel are never shown to your opponent before they submit their own answer to the same round.
Cookies
One functional cookie (od_cap) stores an opaque session capability so you can refresh mid-game without losing progress. It is HttpOnly (JavaScript cannot read it), SameSite=Lax, and expires after 48 hours. A second non-essential pointer in localStorage remembers which session to resume; it contains no secret and you can clear it any time via your browser settings.
Sharing
If you use “Challenge a friend”, the invite link contains a random 256-bit token. Anyone with the link can accept that one duel. Don't post invite links publicly unless you're fine with strangers playing your set.
Your choices
- Clear site data in your browser to forget the resume pointer immediately.
- Don't share an invite link and nobody can see your answers.
- Contact us (see below) to request deletion of a specific session or duel.
Children
The game is not directed at children under 13 and collects nothing beyond the anonymous gameplay data described above.