Orderwick

Privacy Policy

Applies to the Orderwick game's online features and to this website. Last updated: 2026-11-12.

Who is responsible

Milan Vasovic, an individual, is the controller of the data described here. Contact: [email protected].

Website account

To download the game you create a free account on this website. We then keep:

  • Your e-mail address and the name you chose, to run the account, send the confirmation and password-reset mails and answer your messages.
  • A password hash (never the password) if you sign up with a password, or the ID Google gives us if you sign in with Google. Google tells us only your verified e-mail address and name.
  • Your activation key and, per device that uses it, a hash of a random install ID, the operating system family and the first and last use. This lets us stop one key from being passed around.
  • An activity log of your own account actions (sign-in, password change, key reset) with the IP address and browser string, kept for 180 days.
  • Messages you send through the contact form with your name and e-mail, until you ask us to delete them or you delete the account.

Staff changes on the site (for example blocking a player or editing a page) are written to an audit log that is kept for two years; personal values in it are hidden. Deleting your account removes your account data, keys, activity log and messages, and removes your e-mail address from the audit log.

Signing in with Google

You can create an account or sign in with your Google account instead of a password. This is optional.

  • What we ask Google for: only the basic sign-in scopes openid, email and profile. We receive your Google account ID, your e-mail address (and whether Google has verified it), and your name. We do not receive or ask for access to your Gmail, contacts, calendar, Drive or any other Google data, and we get no password from Google.
  • What we use it for: only to create your Orderwick account, to recognise you when you sign in again and to link the account to your activation key. If an Orderwick account with the same verified e-mail already exists, the two are linked.
  • What we do not do: we do not sell or share this data, do not use it for advertising, and do not transfer it to anyone except the service providers listed below that run this website. No person reads it other than the operator when handling your account.
  • How long: until you delete your Orderwick account. Deleting it (account page) removes the Google ID, e-mail and name from our database.
  • Taking back access: you can remove Orderwick from your Google account at any time at myaccount.google.com/permissions. We keep no Google token after sign-in, so nothing continues to run in the background.

Orderwick's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Cookies

The website sets one strictly necessary cookie, ow.sid, only when you sign in or open a form. It keeps you signed in (14 days) and protects forms against forgery. It is not used for tracking and there is no consent banner because none is needed for it. The browser version of the game stores an anonymous player ID and key in your browser's local storage instead of a cookie.

Who else handles data

We do not sell or rent your data. It is handled only by:

  • Cloudflare, which sits in front of this website (traffic passes through it, so it sees visitors' IP addresses and requests) under its own privacy policy;
  • the hosting server that runs the website and its database;
  • an e-mail (SMTP) provider, only to deliver the confirmation, password-reset and contact mails;
  • Google, only if you choose to sign in with Google (see above);
  • itch.io, which sells the game and handles your payment and purchase under its own terms; we do not receive your payment details.

The game works without any of this

Orderwick runs fully offline. Your progress, settings and local scores stay on your device. Nothing is sent to the server unless you switch on online features in the game, which asks you first and shows what is sent.

What is sent when online features are on

  • A random player ID and a secret key. The key stays on your device; the server stores only a hash of it.
  • Your nickname (you choose it; do not use your real name or anything personal).
  • Your game version and operating system family (for update checks).
  • The moves of each board you solve in a ranked mode (Campaign, Hard mode, Daily board), the time you needed and your run's score. The server replays the moves to check the result. After the check only the totals (score, level, time, number of moves, date) are kept; the move list itself is not stored.
  • Your achievements and coin balance. The server counts them from the boards it verified (for example boards solved, highest level, daily streak, number of undos and rescues in solved boards, play time of solved boards) and keeps the counters, the date each achievement was reached and a log of coin payouts so that the balance can be explained. They are tied to your player ID and are deleted with it.
  • Items you own and shop purchases. The server keeps which cards, looks and themes you own (earned, bought with coins or granted) and the coin payments for them. They are tied to your player ID and are deleted with it.

Not collected by the game itself: your name, e-mail address, location, device identifiers, contacts, files or anything else on your computer. There are no advertisements, no analytics and no third-party trackers.

What is public

On the leaderboards everyone can see your nickname, score, level, time, number of moves and date. AI agents that play (for example Claude, operated by the author) appear in the same ranking and are marked AI.

Technical logs

Your IP address is used in memory to limit abuse and is not stored in the game database (it is stored only in the account activity log, contact messages and audit log described above). The web server keeps standard access logs (IP address, time, requested address) for up to 14 days for security and troubleshooting, then deletes them.

Why and for how long

We process this data to provide the online features you ask for (leaderboards, daily board) and, on the basis of our legitimate interest, to keep rankings fair and the server secure. Data is kept until you delete your online account or website account, except where a shorter period is stated above.

Coins and items

Coins are a virtual in-game currency that you earn by playing (achievements, daily board). They cannot be bought for money, paid out or transferred, and have no cash value. Cards, looks, avatars and themes can be unlocked or bought with coins only.

Your rights

You can see everything held about you (in the game: Online screen → Export), correct your nickname, and delete your online account and all its data (Online screen → Delete). Deleting your website account from the account page removes the account data described above. You can also email [email protected]. You may complain to your data protection authority; in Serbia that is the Commissioner for Information of Public Importance and Personal Data Protection.

Age

Online features are meant for players aged 16 and over. If you are younger, please keep playing offline.

Changes

If this policy changes in a way that matters, the game will tell you before online features keep working.