Last updated 2 October 2026

Privacy

No sign-up, no ads, no tracking cookies. Your settings stay on your device. If you take part in the online leaderboards, your single-player games are ranked under a name you choose, without e-mail or account. We count how the game is used with our own copy of Umami, which sets no cookies and stores no IP addresses. Multiplayer connects devices through a PeerJS server.

1. Who is responsible

Sven Fritsch
[Street and number]
[Postcode, city, country]
E-mail: privacy@playninetynine.com

2. Visiting the website

playninetynine.com runs on our own server, rented from Hetzner Online GmbH (Gunzenhausen, Germany) in a data centre in Germany. When you open a page, your browser sends the server your IP address, the date and time, the address requested, the referring page and your browser’s user agent. The server needs these to deliver the page and records them in its access log, which helps us fix errors and fend off attacks. The logs are overwritten automatically once they reach 30 MB.

Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in running the website securely).

3. Cookies

We set one cookie, nn_lb. It keeps your browser on the same server instance while we roll out an update, so all of the game’s files come from the same version. It names a server container, contains nothing about you and is deleted when you close your browser. It is strictly necessary to deliver the website (§ 25(2) no. 2 TDDDG), so it needs no consent. We set no other cookies.

4. What stays on your device

The game keeps the following in your browser’s local storage: your settings, your best scores, the mode you played last, the number of rounds for multiplayer and the name you give yourself in multiplayer. For the online leaderboards (section 7) it also keeps your profile’s secret key and name, games not yet sent while you are offline, and whether you played today’s challenge. While you are in a multiplayer game, its room code is kept in session storage so you can rejoin after a reload; it is deleted when you close the tab. So that the game works offline, your browser also stores its files in a cache.

Apart from what the leaderboards send (section 7), none of this is sent to us. You can delete it at any time by clearing this site’s data in your browser’s settings.

5. Usage statistics (Umami)

To see how the game is played and what to improve, the game (not this page) counts its use with Umami, open-source software that runs on our own server at stats.playninetynine.com. No data goes to third parties.

What is counted:

• the screens you open (menu, game modes, settings, instructions, …)
• game events: game started, each round’s result, points and presses, game over with the score, highscores opened, settings changed, multiplayer started (number of players and rounds) or joined
• your browser, operating system, device type, screen size, language, the page you came from, and the country derived from your IP address

Umami sets no cookies and does not store your IP address. It uses the IP address and user agent only to calculate an anonymous visitor ID, combined with a secret value that changes regularly, so visits cannot be linked to you or to each other over longer periods. Player names are never counted. If your browser sends Do Not Track, nothing is sent at all.

Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in improving the game). You can object at any time: switch on Do Not Track, block stats.playninetynine.com with a content blocker, or write to us.

6. Multiplayer

This only happens when you open multiplayer.

To find each other, devices connect to the public PeerJS server (0.peerjs.com), run by the open-source PeerJS project. It receives your IP address and a random ID for the room or your device. To set up a direct connection, your browser asks a STUN server of Google LLC (stun.l.google.com) for your public IP address. If no direct connection is possible, game messages are relayed through PeerJS’s TURN servers (eu-0.turn.peerjs.com or us-0.turn.peerjs.com). These servers may be outside the EU.

After that, the game talks directly between the devices. The other players’ devices receive your IP address, the name you enter and your moves. We do not store any of this.

Legal basis: Art. 6(1)(b) GDPR (providing the multiplayer game you asked for). Google LLC is certified under the EU–US Data Privacy Framework.

7. Online leaderboards and daily challenge

This only happens while Take part is on in the game’s settings under Leaderboards (it is on by default), and only for single-player games (Classic, Standard, Advanced and the daily challenge). You can switch it off at any time.

When you open a single-player mode, the game asks our leaderboard server (on our own server, see section 2, at playninetynine.com/api) for the starting value of a ranked game. The first time, the server creates an anonymous profile for you: a random ID, a secret key that stays on your device (we only keep a hash of it) and a name, a placeholder such as “Player 4821” until you choose your own.

To play with the same profile on another device, Link another device in the settings asks the server for a one-time code (shown as a QR code too). The server keeps only a hash of the code, and deletes it when it is used or after 10 minutes at the latest. The other device that enters the code gets a secret key of its own for your profile (again, we only keep a hash of it); the profile it had before stays as it is.

When a ranked game ends, the game sends it to the server: the mode, the starting value and each of your moves (which tile, pressed or held, and when, to the millisecond). The server replays the game to check its score and keeps with your profile: the mode, the score, the number of rounds, the moves, the date and time, and a note if the timing looks implausible for a person (to spot cheating).

Everyone can see on the leaderboards: your name, your best score with its number of rounds and your place, per mode for today, this week and all time, and for each day’s challenge. Choose a name that doesn’t identify you if you don’t want to be recognised.

We ask for no e-mail address and don’t link your profile to your IP address. The leaderboard server uses the IP address only in memory, for about an hour, to limit how many requests one address can make; requests are also written to the access log like any page view (section 2).

Your profile and games are kept as long as we offer the leaderboards, or until you delete them. Starting values of games that were never finished are deleted after two days. Delete my leaderboard data in the settings removes your profile and all your games from our server at once, for all your linked devices, and switches Take part off. Without your device (for example after you cleared this site’s data) we can’t tell which profile is yours; write to us with your name on the leaderboards and roughly when you played.

Legal basis: Art. 6(1)(b) GDPR (providing the leaderboards and the daily challenge you take part in); checking games and limiting requests: Art. 6(1)(f) GDPR (our legitimate interest in fair leaderboards and in protection against abuse).

8. Links

Links to GitHub, Twitter, Facebook and other sites only send data to them when you click them; their own privacy policies apply there.

9. Your rights

You have the right to access your data, to have it corrected or deleted, to restrict its processing, to data portability and to object to processing based on Art. 6(1)(f) GDPR (Art. 15–18, 20 and 21 GDPR). Write to us at the address above. You can delete your leaderboard data yourself in the game’s settings. As we don’t know who you are in the statistics or the logs, we can usually only find data there if you tell us your IP address and the time of your visit.

You can also complain to a data protection supervisory authority, for example the one where you live.

10. Changes

If the game changes what it processes, we update this page. The date at the top shows the latest version.