1.Cookies
Parlor sets one cookie, and only when you sign in:
| Name | Contents | Attributes | Lifetime | Purpose |
|---|---|---|---|---|
parlor_session | A random token; nothing about you | HttpOnly; SameSite=Lax; Secure (production); Path=/ | 180 days, or until you sign out | Keeps you signed in |
ruckus_session | Same, for the separate Ruckus experiment at /ruckus | Same | Same | Keeps you signed in to Ruckus |
There are no analytics cookies, no advertising cookies and no third-party cookies. Because the only cookies are strictly necessary for a feature you chose (signing in), there is no cookie consent banner.
2.Browser storage (localStorage)
Instead of cookies, Parlor uses your browser’s localStorage, which never leaves your device on its own. Every key starts with parlor:. Clearing this site’s data in your browser removes all of them.
| Key | What it holds | Lifetime |
|---|---|---|
parlor:playerId | Random device id issued by our server | Until site data is cleared |
parlor:playerSig | Server signature for the device id | Same |
parlor:playerId:legacy | Flag: this device was upgraded from the older unsigned id | Same |
parlor:session | Analytics session id, last-event time, event counter, games started this sitting | Rolls over after 30 minutes idle |
parlor:hud | Local play streak, last score, today’s completed games | Indefinite |
parlor:played:{game}:{seed}:{difficulty} | You already played this daily on this device | Indefinite (one per day played) |
parlor:turn:{game}:{seed} | Checkpoint of an in-progress turn game (the moves so far) | Until the game ends |
parlor:pending-score:{game} | A score submission waiting to be retried after a failed network | Until it succeeds |
parlor:{game}:stats | Personal bests and play counts for that game | Indefinite |
parlor:clock:{game}:{seed}:{difficulty} | When a timed run ends, so a reload keeps the clock honest | Removed when the run ends |
parlor:backgammon:autoplayForced | Backgammon auto-play preference | Indefinite |
parlor:rooms:name | The guest name you typed for a multiplayer room | Indefinite |
parlor:game-night | Game Night chain progress | Indefinite |
parlor:achievements-seen-at | When you last looked at your badges | Indefinite |
parlor:install-dismissed | You dismissed the "install app" bar | Indefinite |
parlor:mute | Sound off/on | Indefinite |
parlor:haptics | Vibration off/on | Indefinite |
parlor:ref | You arrived from a shared link (game, time, whether this device had played before) | 24 hours |
parlor:continuation-via (sessionStorage) | Which "play next" suggestion you tapped, so the next game start can credit it | This tab; used once within 15 minutes |
Only a few of these ever reach us: the device id and signature (with scores and events); the analytics session id and counter, and the outcome of the share-link marker, as event fields; the checkpoint or pending score when a game is submitted; the “play next” suggestion you tapped, on the next game start; and the guest room name when you sit at a table.
3.First-party analytics events
Your browser posts small events to /api/event on our own server. No third-party analytics script runs by default. Each event is one row in our database with these fields, and no others:
| Field | Value |
|---|---|
anon_id | Your device id |
event | One of: visit, game_open, game_start, game_complete, game_abandon, next_game_click, task_view, task_start, assist_used, continuation_shown, share_exposed, share_clicked, share_completed, share_landing, share_converted, score_submit, share_click |
game, difficulty, mode | Which game and setting, where relevant |
meta.path | The page path, e.g. /hearts. Never the query string. |
meta.ref | The host name of the site that linked you here, e.g. www.google.com. Never the full URL. Blank when you navigated within Parlor. |
meta.src | organic / social / referral / direct / internal, derived from ref |
meta.campaign | The utm_source value if the link had one |
meta.vw | phone / tablet / desktop, from the window width |
meta.pwa | true if running as an installed app |
meta.sid, meta.sq, meta.attempt | Analytics session id, event number within the session, and how many times you started this game this session |
meta.analytics_version | The version of this event contract |
| Per-event extras | score and whether it was accepted (game_complete); seconds elapsed (game_abandon); which suggestion was shown or tapped and its position; which task; hint or check (assist_used); share method (native / clipboard) and the day (share events) |
ts | Server time the event arrived |
Not in the row: your IP address, your user-agent string, your screen size, your language, your location, cookies, or anything you typed. The server reads the user-agent header only to drop bots and headless browsers, then discards it. The server also truncates every string to a fixed length and drops anything nested, so an event cannot carry more than the fields above.
4.Third-party scripts and requests
| Who | When | What they can see |
|---|---|---|
Cloudflare Web Analytics (static.cloudflareinsights.com) | Only if the site owner has enabled it. Whether it is on in production is UNSPECIFIED as of this draft. | Page-timing metrics. Cloudflare states it uses no cookies or localStorage and does not fingerprint by IP or user agent. |
| Cloudflare (hosting) | Every request | IP address and request logs, as the host, on our behalf |
No Google Analytics, no Google Fonts (fonts are self-hosted), no ad network, no social-media pixels, no error-reporting service, no chat widget. We checked by searching the code for every outbound address. If an ad partner is ever added, this page will name it and what it receives before it goes live.
5.How to control this
- Clear this site’s data in your browser to remove every key above and the device id. You will get a fresh id next visit.
- Sign out to delete the session cookie.
- Mute sound (the speaker button) to stop any Freesound request.
- A content blocker that blocks
cloudflareinsights.comstops the optional Cloudflare beacon; the site works without it. - There is no opt-out switch for the first-party events yet; blocking
/api/eventin a content blocker has the same effect and breaks nothing.
6.More
How this data is used and kept is in the Privacy Policy. The developer-facing inventory this page is generated from lives in the repository as docs/legal/data-inventory.md.