What happens to your data

Updated September 21, 2026.

Your replies and scoring

When you submit a reply, your browser sends it with the selected language and scenario to UH OH’s server on Cloudflare. In live mode, the server sends the scenario, your reply and judging instructions to TypeSafe’s Jev service. Demo mode calculates simulated feedback without sending the reply to TypeSafe.

The current game does not write replies to an application database or intentionally log their text. That does not mean no service processes or retains request information: Cloudflare handles network requests and abuse protection, and TypeSafe processes live scoring requests under its own policy.

TypeSafe’s privacy policy states that input is not used to train or fine-tune its models, and describes its retention and service providers. UH OH does not promise a fixed deletion period on TypeSafe’s behalf. See also Cloudflare’s privacy policy.

Friend challenges

A challenge link contains a signed score, language, level set, completed-level count, pack version and creation time. It does not contain your reply text. Anyone who receives the link can see its challenge information. Signing prevents undetected changes; it does not make the link private.

Usage statistics

We use our self-hosted Umami service on Vercel to understand page visits, referral sources, languages and how people play. Game events include starts, successful and failed judgments, result screens, replays, challenge links created or opened, successful link copies, completed native-share requests and score-card download requests. Event properties may include language, scoring mode, level, HP, completed levels, duration and a fixed error category.

Umami receives the page path and title, referring site origin, browser language and screen size. We remove URL queries and fragments, including challenge tokens, and do not send answer text or full referring URLs. Umami provides visitor and session estimates; event totals can include repeat plays. Its Vercel host receives network information needed to process requests.

We also keep limited event counts in Cloudflare D1: landing visits, starts, first judgments, result screens and challenge links created, grouped by language, broad source and scoring mode. These event payloads do not include answers, challenge tokens or IP addresses.

We do not set analytics cookies or write browser storage for tracking. We respect Do Not Track, Global Privacy Control and the Umami opt-out setting, and skip local development and debug visits. Cloudflare and Vercel still process network requests; provider retention and operational logs are separate from the event fields described above.

Sharing tools and questions

Opening the challenge dialog may load a QR-code library from jsDelivr. Native sharing uses your device’s share sheet only when you choose to share. For project questions, see the maintainer information on About UH OH. Avoid entering sensitive personal information in a game reply or public feedback.