What this site knows

Nothing is sent anywhere. Which puzzles you have finished, how each one went and which camo you have equipped are written to your browser’s local storage, under keys beginning cod-minigames: and cod_skin. They stay on that device, they are readable only by this site, and clearing your browser data deletes them for good — including any streak, which is the one reason to think twice before doing it.

There is no sign-in wall, no tracking pixel and no cross-site profile. A signed-out visitor who never scrolls to an advert leaves no record here at all.

An account exists to carry your progress to a second device, and stores the least that can do that. Signing in works one of two ways: an email link, in which case your email address is held by the authentication service; or Discord, in which case Discord tells us your user ID, your username and the email on that account, and nothing else about you.

Alongside it we keep a display name and the username you pick for the leaderboard, the camo you have equipped, and one row per puzzle you play — which game, which day, and, once it is over, whether you won and how many guesses it took. That last set is what the Barracks and the leaderboard are built from. Accounts and their data live in Supabase, and every table is behind row-level security: your rows are readable by you, and the leaderboard is served through a function that returns places and usernames rather than the underlying rows.

Only the username you choose is ever shown to anyone else. Your email address is not published, not shared and not used to send anything beyond the sign-in link itself.

Payments run entirely through Stripe. Card numbers are entered on Stripe’s own checkout page and never reach this site or its servers in any form. What comes back, and all we store, is a Stripe customer ID, a subscription ID where there is one, and the fact that your account is a supporter until a given date.

Page views are counted with Vercel Analytics, which is cookieless: it records that a page was viewed, not who viewed it, and builds no profile that follows you to another site.

Visits are also measured with Google Analytics, which does use cookies: it records the pages you view, roughly where you are visiting from, and your device and browser type, so we can see which games people play and how they find the site. We do not send it your account, your username or anything you type. In the UK, the EEA and Switzerland it sets no analytics cookies unless you agree through Google’s consent notice; until then it sends only cookieless signals that cannot be tied to a returning visitor.

Finished puzzles are counted too, whether or not you are signed in: when a board ends, the site records which game and day it was, whether it was won and in how many guesses, alongside a random ID your browser makes for itself so the same board is not counted twice. No IP address or device details go with it. If you are signed in at the time, the count is linked to your account; otherwise nothing ties it to you.

The suite is aimed at adults following competitive Call of Duty, and accounts are not intended for anyone under 13. No age is collected, so none can be verified — if you believe a child has made an account here, say so and it will be removed.

Ask, and your account and everything attached to it is deleted: profile, username, every completion, every replay grant and the entitlement row. Deleting the account deletes the rest with it. Ask instead for a copy and you will get one. There is no waiting period and no reason you need to give.

Progress kept in your browser is not ours to delete and never was — clearing site data in your browser removes it in one step.

Write to sam@codminigames.com. That is the address for anything to do with your data — a copy, a correction, a deletion, or a question about what any of the above actually means in your case. The Discord is the quicker route for anything that is not about your data, and where the rest of how the suite works gets answered.

If what happens to your data changes, this page changes with it and the date at the top moves. Anything that would be a material change — a new third party, a new category of data — will be said plainly here rather than folded quietly into a paragraph.