The short version
Outlier Duel has no user accounts. You play anonymously. We store your game answers, scores and a scrambled network identifier while you play and for a short period after, so the game works fairly and can stop abuse. We do not run advertising or third-party analytics today, and we never sell anything.
What is stored, and why
| Data | Purpose | Retention |
|---|---|---|
| Game answers you type (raw text and the matched label), round outcomes, points | Server-authoritative scoring, your resume-in-progress screen, and friend-duel results | Up to 30 days, then deleted or anonymized |
| Session record: random id, hashed capability secret, question set, timestamps | Keeping your game refresh-safe; the secret itself is never stored, only its SHA-256 hash | Session lifetime + 30 days |
| Challenge records: hashed invite token, inviter/invitee session references, duel outcome | Friend duels and rematches | 30 days after challenge creation |
| Truncated, salted hash of your IP address (16 hex characters — not the address itself) | Daily session quotas and abuse limits only; it cannot be reversed to your IP without brute force | Deleted with its session |
| Answer reports (round reference + your note, max 500 characters) | Reviewing missed valid answers to improve the question bank | Until resolved, then deleted |
What is deliberately NOT collected
- No names, emails, or account data — there is no sign-up.
- No precise location, device fingerprint, or cross-site identifiers.
- Analytics runs in cookieless mode: Google Analytics 4 is active with
client_storage: noneand IP anonymization, so it sets no cookies and stores no persistent device identifier. It receives only aggregate game events (mode, round number, score bucket) — never your answer text, invite tokens, or identifiers. No advertising or cross-site trackers exist on this site. - Your answers to one duel are never shown to your opponent before they submit their own answer to the same round.
Cookies
One functional cookie (od_cap) stores an opaque session capability so you can refresh mid-game without losing progress. It is HttpOnly (JavaScript cannot read it), SameSite=Lax, and expires after 48 hours. A second non-essential pointer in localStorage remembers which session to resume; it contains no secret and you can clear it any time via your browser settings.
Sharing
If you use “Challenge a friend”, the invite link contains a random 256-bit token. Anyone with the link can accept that one duel. Don't post invite links publicly unless you're fine with strangers playing your set.
Your choices
- Clear site data in your browser to forget the resume pointer immediately.
- Don't share an invite link and nobody can see your answers.
- Contact us (see below) to request deletion of a specific session or duel.
Children
The game is not directed at children under 13 and collects nothing beyond the anonymous gameplay data described above.