Your record. Your data.
Move Thirty Seven Games operates COVERED. You can play without an account. We do not sell player data or use advertising trackers.
What we keep
A random first-party cookie identifies guest play. We store guesses, saved progress, scores, completion dates, personal album ratings and historical community votes. Your browser also caches score history. A profile adds your chosen display name and a stable sign-in identifier so your records work across devices. Profiles are private.
Sign-in and service providers
Google or Apple authenticates your identity through Supabase Auth. The provider may share your name, email address and stable account identifier with the authentication service. We do not request your inbox, contacts or music library. Apple may supply a private relay email.
Sites and its Cloudflare infrastructure host the game, database and artwork. Hosting and authentication providers may process connection information such as IP addresses and service logs to deliver and protect their services. Our application error log contains a request identifier, route and error category.
To limit automated abuse, the app uses your connection address to create a secret-keyed identifier that changes daily. Request counters use this identifier, not your raw IP address, and are separate from your profile and gameplay analytics. Our retention job removes counters that have been inactive for more than a day; encrypted backups expire after 30 days.
Why we use it
We save your progress, calculate streaks and scores, enforce one saved rating per player and puzzle, and understand puzzle difficulty. Gameplay analytics are stored with your random player identifier. Sharing happens only when you press Share; shared text contains no album answers or profile identity.
Retention and your controls
Your profile records remain until you delete them. You can download your data and delete your COVERED profile from your profile. Deletion removes its scores, ratings, votes, progress and gameplay events from the live database. It does not delete your Google, Apple or ChatGPT account.
Our retention job removes gameplay events after 90 days, application error records after 14 days and encrypted database backups after 30 days. A restricted deletion journal is retained for 90 days so a backup restore can respect deletions. A provider outage can delay removal from COVERED’s authentication service; the deletion job retries. These scheduled retention jobs must be activated before the public beta.
Guest cookies expire after one year. Clearing browser data disconnects that guest identity and removes the local cache; it does not erase the server’s guest records. You can save guest scores to a profile, then use the profile’s download and deletion controls.
Questions and requests
support@movethirtysevengames.com handles privacy, access and deletion requests. Include your display name and the account provider you used; never send a password. We will update this page when the service or data practices change.