Privacy & cookies
Updated September 20, 2026. This page describes the Borough game application and the data it uses to provide saved progress and daily scores.
Guest play
When you open a game without signing in, Borough sets a necessary first-party cookie named __Host-borough-player. It contains a random player token, expires after one year, and is sent only over HTTPS. Browser scripts cannot read it. The server stores a hashed identity derived from that token alongside your game moves, daily results, points, and generated nickname.
This cookie allows you to close the page and resume on the same browser. Clearing it disconnects that browser from the saved guest identity; it does not automatically delete the old database records. Guest progress stays in this browser unless you sign in with Google. On sign-in, guest game records are transferred to your account; existing account attempts for the same game and day are kept instead of being replaced.
Signed-in play
Optional Google sign-in identifies your account using Google’s stable account identifier. Borough verifies the sign-in token on the server and creates its own secure, HttpOnly session cookie, __Host-borough-session, lasting up to 30 days. A one-time __Host-borough-login cookie lasts ten minutes and protects sign-in requests. We do not store your Google password or publish your email or full name. The leaderboard uses a generated nickname or the public name you choose in your profile. Google and the hosting provider may use their own operational and authentication cookies. Existing hosting-provider account sessions remain supported for previously saved records.
What other players can see
The daily leaderboard displays your chosen or generated public name, assigned cartoon avatar, completed-game counts, and points. Sharing a score is optional and happens only when you choose the Share score button; word-game shares contain color squares without revealing guesses or answers. Your move history and identity token are not shown to other players. A public nickname is not proof of a unique person.
Advertising and analytics
The Google AdSense script is installed to connect this site with our publisher account. It sends requests to Google, which may process device and request information under its privacy policies. Google is listed as an authorized advertising seller. Borough’s own ad placements remain disabled while approval and consent setup are completed. We have not enabled a separate analytics service.
Storage and deletion
Game records are retained in the site’s hosted database until deleted through the control below or removed as part of site maintenance. Use this control before clearing your guest cookie if you want to delete the associated records. A deleted identity or score cannot be recovered through this interface.
Your saved progress
Delete the scores and game history for your current signed-in account, or for this browser’s guest identity if you are not signed in. This cannot be undone. It does not delete a separate guest identity or account on another browser.
Word-list source
The guess dictionary uses the public-domain dwyl English word list with a small supplement. It does not send guesses to an external dictionary service.