Privacy

A game is stored as an unguessable session token in an httpOnly cookie, plus the guesses you lock in: latitude, longitude, distance, and score. The cookie is what proves the browser owns that game.

The location catalog stores coordinates, optional names, categories, difficulty, and Google panorama ids and capture dates. It does not store Street View image tiles or panorama JPEGs. Imagery is requested from Google when a round is on screen.

An account stores your princeton.edu email, a public username, and a bcrypt hash of your password, never the password itself. Sign-in is a separate httpOnly cookie. Leaderboards show your username, not your email. Creating an account does not send a confirmation email. A multiplayer room does not use that account. It stores the display name you type for that room and a separate httpOnly cookie for your seat.

Admin sign-in uses a separate httpOnly cookie signed with the server’s admin secret. The secret is not included in the pages sent to players.

Google receives the map and Street View requests your browser makes, under Google’s own privacy policy, once an API key is configured.