Privacy Policy

Last updated: 12 October 2026

Expedition Games is a small independent studio. This page explains, in plain language, what happens to your information when you play our games at expeditiongames.app — what we store, what Google stores for analytics and advertising if you let it, and how to change your mind.

The short version

• You can play every public game without an account.
• Your game progress is saved on your own device, not on our servers.
• We don't sell your personal information. Analytics and advertising cookies are off until you say yes. If you allow them, we use Google Analytics to count visits and see which games are played, and Google Ads to measure whether our own ads bring people here. Reject is one tap, the games work exactly the same either way, and Cookie settings at the bottom of every page changes your choice — see Cookies and your choices.
• If you send us feedback, we keep the message and the account you sent it from, so that we can read it and reply — see Feedback you send us.
• We show ads through Google AdSense. Google and its partners use cookies to serve those ads, and ads are only requested once you allow advertising — see Advertising below.

Who we are

This site is operated by Expedition Games, an independent game studio run by Keegan Faulkner. For any privacy question, or to ask us to delete your account and data, write to us through the contact page. We read everything.

Information we collect

Information stored on your device

Our games save your progress locally in your browser using localStorage — things like the current board in Fifteen, your best time, your high score in Flyer, and whether you chose to play as a guest. This data stays on your device. We can't read it, and it never reaches our servers. Clearing your browser's site data erases it.

Account information (optional)

If you choose to create an account, sign-in is handled by Clerk, a third-party authentication provider. Clerk stores the email address (and, if you use a social login, the basic profile information that provider shares) needed to sign you in, and sets cookies so you stay signed in between visits. We use this only to recognise you across our games and to attach a screen name to any score you choose to publish. You can read Clerk's privacy policy for details on how they handle it.

Feedback you send us

The feedback page is the one place on this site where you deliberately send us something, and it asks you to be signed in first. When you submit a message, we store the following in our own database, hosted with the rest of the site on Cloudflare:

• the message you wrote, and the separate note about games you'd like to see, as you typed them;
• the page you were on when you sent it — a path such as /games/chess/, so that a bug report says which game it is about;
• the account it came from: your Clerk user id, the email address on that account, and your username or name if you have set one;
• your browser's user-agent string, which is what makes "it breaks on my phone" a question we can answer;
• the date and time you sent it, and whether we have read it yet.

The account details are read from your signed-in session on our server, not from anything you type: there is no name or email field on that form, and we do not ask for one. That is why signing in is required — it means we can reply to you, and it keeps the form from filling up with automated spam. We do not store your IP address alongside a message.

We use this for one purpose: reading what players tell us, and responding to it. Feedback is visible only to us. It is not published, it is not attached to your public screen name, it is not shared with our advertising partners, and it does not pass through any third-party form service. If you would rather send us something without signing in, the contact page takes plain email and reaches the same person.

The new-game notify list

The home page has a single field offering to email you when a new game goes up. It is entirely optional, it needs no account, and the only thing it asks for is an address. If you use it we store, in the same Cloudflare database as feedback:

• the email address you typed, lowercased so the same address cannot end up on the list twice;
• the date and time you signed up, and which form on the site it came from;
• a random unsubscribe token, generated at signup so that any email we later send you can carry a working one-click link;
• whether the address is still active, and whether it has been confirmed.

We do not store your IP address against a signup. To stop one script submitting a thousand addresses we keep a one-way hash of the connecting address combined with the current date, which lets us count how many signups came from one source today and does nothing else — it changes at midnight and cannot be turned back into an address or used to recognise you on another day.

This list is used for exactly one thing: telling you when we publish a new game. It is not a newsletter, it is not shared or sold, and it is not passed to our advertising partners. The only third party it ever reaches is the mail provider that delivers the message, named below. Every email we send from it carries an unsubscribe link, and you can also ask us to remove you from the contact page.

The list is double opt-in. Giving us an address is not enough to get mail from us: we send one confirmation email to it, and unless somebody presses the button in that email, the address stays unconfirmed and is never sent anything else. If you did not ask for it, doing nothing is the whole of what you have to do.

The confirmation and any later announcements are delivered by Resend (resend.com), a transactional email provider acting on our behalf. To send you an email they necessarily receive your address; they are not permitted to use it for anything else, and we do not upload the list to them in advance — an address reaches them at the moment a message to it is sent, and not before. Every message carries a one-click unsubscribe, which takes effect without a login and without a reply.

When those emails do start, they will come from [email protected], which is a send-only address that nobody reads — the domain receives no mail. Replying to one of those emails reaches nobody, so every message we send will say so and point at the two places that do reach a person: the contact page, which takes plain email, and the feedback page, which is the right one for anything about a game. Both are linked from the footer of every page on this site.

Duel notifications

If you play online duels (Chess and 8 Ball against a friend), you can ask to be told when it is your move or when someone challenges you. Both kinds are off until you turn them on, in the game's own settings, and either can be turned off there at any time.

• Notifications on a device. When you turn them on, your browser asks your permission and, if you agree, gives us a push subscription: an address at your browser maker's push service (Google, Apple, Mozilla or Microsoft) and two keys. We store that against your account, with when it was added and last worked, in the same Cloudflare database as the leaderboards — nothing else about the device. Each notification is encrypted to those keys before it leaves us, so the push service carries it without being able to read it. It says only whose move it is and in which game. Turning it off, or removing the site from your browser, deletes the subscription.
• Email. If you switch duel emails on, we send them to the verified primary email address on your account, which we look up from Clerk (our sign-in provider) at the moment a message is sent; we do not keep a copy of it. They are delivered by Resend, as above, from [email protected], only about your own games, at most one “your move” email per game every six hours, and each carries a one-click link that turns them off.

Neither is used for anything but your own games: no announcements, nothing shared with advertising partners.

Information we do not collect

Beyond Google Analytics and Google Ads, described under Cookies and your choices and used only as you allow, we add no analytics or tracking product to our pages — no other beacon or tracking pixel. We do not ask for your real name, address, or phone number. We never ask for payment information — the games are free. We do not build advertising profiles ourselves, and we do not sell or rent personal information to anyone.

Server logs

This site is hosted on Cloudflare Pages. Like essentially every web host, Cloudflare processes standard request data — IP address, browser user-agent, the page requested and the time — to deliver the site and to protect it from abuse. See Cloudflare's privacy policy.

Traffic measurement

We look at aggregate, anonymous traffic counts for the site — daily totals for page views, requests, and an approximate number of unique visitors. These are read from the summary our host, Cloudflare, already produces from the edge logs described above; the unique-visitor figure is one Cloudflare derives from IP addresses at its edge, and we receive only the daily number, never the addresses themselves.

Nothing is added to the pages you load to produce these numbers — they come from the host's logs, whatever you choose in the cookie banner. What we see are site-wide totals, not people: the figures are not attached to your account, are not used to build a profile of you, and cannot be traced back to an individual visitor by us. We use them for one thing — to know roughly how many people are playing.

Cookies and your choices

The first time you visit, a small banner asks whether we may use analytics and advertising cookies. Reject and Accept are the same size and equally easy, nothing is pre-ticked, and the banner doesn't come back once you have answered (we ask again after about 13 months). Choose… lets you allow one and not the other. You can change your mind at any time with Cookie settings (open it now) in the footer of every page — withdrawing consent deletes the Google cookies on this site.

We use Google Consent Mode to pass your choice to Google. Until you allow a category, it is set to denied: Google Analytics and Google Ads may not set or read cookies or similar identifiers, and AdSense requests no ads at all. In that state our pages still send Google a minimal, cookieless signal when a page is viewed or a game is started — no cookie, no identifier, no record that links one visit to the next — which Google uses only in aggregate, to estimate totals. If your browser sends a Global Privacy Control signal, we treat it as a refusal of advertising cookies.

What each category does

• Necessary — always on. Your game saves and settings (localStorage, on your device), your cookie choice itself (eg_consent_v1, localStorage), and, if you have an account, the sign-in cookies set by Clerk (__session, __client_uat and related). These don't track you and can't be switched off without breaking what they do.
• Analytics — only if you allow it. Google Analytics 4 sets _ga and _ga_<ID> (first-party cookies, up to 2 years), which hold a random identifier so that two visits from one browser can be counted as one person. It records the pages you view, where you came from (including the campaign of an ad you clicked), your browser, device type and approximate location (country and city, derived from your IP address, which Google Analytics does not store), and a few events: that a game started (which game and mode), that you signed in, and that you came back on a later day (we keep a small counter of the days you visited, eg_visits_v1, for that). We do not send your name, email or account id to Google Analytics, Google Signals is off, and analytics data is kept for 14 months.
• Advertising — only if you allow it. When we run ads for this site on Google, the Google Ads tag lets Google count that someone who clicked one of our ads went on to start a game or sign in (a "conversion"); it uses the _gcl_au cookie on this site (90 days) and Google's own cookies. Allowing advertising also lets AdSense show personalised ads (below).

Managing your choices

• On this site: Cookie settings in any page's footer.
• Everywhere Google Analytics runs: Google's opt-out browser add-on.
• Your browser: block or delete cookies, or turn on Global Privacy Control. Blocking all cookies will also sign you out of any account here.

Google processes this data under its own terms; see how Google uses information from sites that use its services and its privacy policy.

Advertising

We use Google AdSense to show advertising on this site. This is how the games stay free to play. The AdSense script is loaded on our public pages. It receives your cookie choice from our banner: unless you have allowed advertising cookies, it requests no ads at all on your visit. If you allow advertising, Google and its partners may use cookies to serve and personalise ads as described below. The following disclosures are required of every AdSense publisher:

• Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to this website or other websites.
• Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the Internet.
• Google uses cookies — historically including the DoubleClick DART cookie and cookies set on the doubleclick.net and google.com domains — to serve and measure advertising, to limit how often you see the same ad, and to detect invalid traffic and fraud.
• Third-party ad networks and exchanges other than Google may also serve ads here through AdSense, and may themselves set or read cookies in your browser.

How to opt out

You are in control of personalised advertising, and none of the options below stop you from using the site:

• On this site: Cookie settings in the footer — untick Advertising, or choose Reject all.
• Turn off personalised ads from Google at Google Ads Settings. You may also want Google's own explanation of how Google uses information from sites that use its services and its advertising policies.
• Opt out of many third-party vendors at once at aboutads.info/choices (Digital Advertising Alliance), the Network Advertising Initiative opt-out page, or Your Online Choices if you're in the EU.
• Block cookies in your browser. Every major browser lets you block or delete third-party cookies. Doing so may mean you see less relevant ads, and will sign you out of any account you've created here.

Wherever you are, advertising on this site needs your permission first, given through our cookie banner; you can withdraw it at any time with Cookie settings.

Children's privacy

Our games are suitable for a general audience, but this site is not directed at children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has given us personal information, contact us and we will delete it.

Your rights

Depending on where you live — for example under the GDPR in Europe or the CCPA/CPRA in California — you may have the right to access, correct, export or delete the personal information a site holds about you, and to object to certain processing. Because we hold very little — an email address if you made an account, plus any feedback you have chosen to send us — these requests are usually simple for us to honour. Write to us via the contact page and we'll action it.

We do not sell personal information. Under California law, letting Google use advertising cookies here can count as "sharing" for cross-context behavioural advertising — which is why it is off unless you turn it on. You can opt out at any time with Cookie settings (Reject all, or untick Advertising), and we honour the Global Privacy Control signal as an opt-out. You can also object to or withdraw consent for analytics the same way; doing so never affects your access to the games.

Data retention and security

Locally saved game progress lives on your device until you clear it. Account information is retained by Clerk for as long as your account exists; ask us to delete the account and it goes. Google Analytics data is kept for 14 months, then deleted by Google. Feedback you send is kept so that we can refer back to it — there is no fixed expiry — and it is deleted if you ask us to delete a message, or when you ask us to delete your account. The site is served over HTTPS everywhere.

Links to other sites

Ads and occasional links may take you to sites we don't operate. This policy covers only expeditiongames.app — once you follow a link elsewhere, that site's own privacy policy applies.

Changes to this policy

If we change how we handle data — for example by adding a new service — we'll update this page and change the date at the top. Material changes will be noted on the site.

Contact

Questions about this policy, or about anything we hold on you? Reach us through the contact page. See also our Terms of Use.