Privacy & cookies

Updated September 21, 2026. This page describes the Boplet website and mobile app and the data it uses to provide saved progress and daily scores.

Guest play

When you open a game without signing in, Boplet sets a necessary first-party cookie named __Host-borough-player. It contains a random player token, expires after one year, and is sent only over HTTPS. Browser scripts cannot read it. The server stores a hashed identity derived from that token alongside your game moves, daily results, points, and generated nickname.

This cookie allows you to close the page and resume on the same browser. Clearing it disconnects that browser from the saved guest identity; it does not automatically delete the old database records. Guest progress stays in this browser unless you sign in with Google. On sign-in, guest game records are transferred to your account; existing account attempts for the same game and day are kept instead of being replaced.

Signed-in play

Optional Google sign-in identifies your account using Google’s stable account identifier. Boplet verifies the sign-in token on the server and creates its own secure, HttpOnly session cookie, __Host-borough-session, lasting up to 30 days. A one-time __Host-borough-login cookie lasts ten minutes and protects sign-in requests. We do not store your Google password or publish your email or full name. The leaderboard uses a generated nickname or the public name you choose in your profile. Google and the hosting provider may use their own operational and authentication cookies. Existing hosting-provider account sessions remain supported for previously saved records.

What other players can see

The daily leaderboard displays your chosen or generated public name, assigned cartoon avatar, completed-game counts, and points. Sharing a score is optional and happens only when you choose the Share score button; word-game shares contain color squares without revealing guesses or answers. Your move history and identity token are not shown to other players. A public nickname is not proof of a unique person.

Sketch rooms

Your room name, guesses, drawings, and room scores are stored on our server and shared with participants who have the private room code. Account identifiers stay private. Only the artist sees the secret word until the reveal. Rooms become inaccessible after six hours; expired records are removed during room cleanup. Keep your room code within your group.

Carry and Wreckyard rooms

Carry has two-player rooms; Wreckyard has up to four players. Room state and connection details are stored on our server for up to two hours and removed during cleanup. A temporary room token in this tab lets you reconnect. Direct peer connections share network connection information with invited players and use Cloudflare’s STUN service to establish connectivity. A server relay carries game state if a direct connection is unavailable. No microphone or camera is accessed.

The installable app stores its offline page, icons and public application assets on your device. It does not cache account API responses or game submissions. Installed apps and browsers may have separate guest identities.

Appearance preferences

The ec-theme cookie remembers your light, dark, or system appearance setting for one year and shares it across easycardboard.com and its subdomains. A local browser preference is used as a fallback. This preference contains no player identity.

This release is available in English. Earlier language preferences are reset to English without changing your player identity or game records. The ec-language preference contains no player identity.

Player reports and blocking

Reports include the reported public name, relevant visible Sketch drawings or guesses, the reason you choose and optional details. They are linked to player identities so authorized reviewers can investigate. We keep report records for up to 90 days, with expired records removed during subsequent report cleanup. Blocking choices and community-rule acceptance are stored with your player identity. Reports are not shared with the reported player. Account deletion also removes reports linked to that identity, block records and rule acceptance.

Guest blocks apply to the saved identity, not every device a person may use. Manage blocked players and read our community rules.

Advertising and analytics

The Google AdSense script is installed to connect this site with our publisher account. It sends requests to Google, which may process device and request information under its privacy policies. Google is listed as an authorized advertising seller. Boplet’s own ad placements remain disabled while approval and consent setup are completed. We have not enabled a separate analytics service.

Storage and deletion

Daily puzzle records are retained in the site’s hosted database until deleted through the control below or removed as part of site maintenance. Use this control before clearing your guest cookie if you want to delete the associated records. A deleted identity or score cannot be recovered through this interface.

To remove your complete Boplet profile and account sessions, use the account deletion control below. This also closes Carry and Wreckyard rooms you created, removes your Wreckyard seat, and ends Sketch rooms you joined. Account deletion instructions.

Contact

For Boplet privacy questions and deletion help, email contact@easycardboard.com or visit Contact & support. You can copy the address into your email app.

Word-list source

The guess dictionary uses the public-domain dwyl English word list with a small supplement. It does not send guesses to an external dictionary service.