Privacy

Last updated 7 September 2026

Blotle is a game about seeing things in ink, and it tries hard not to see things in you. Here is everything it stores, everything it refuses to store, and how far erasing reaches. It sets one cookie for everyone, and signing in adds a second. No advertising cookies, no analytics cookies, no third parties.

What is stored about you

When the board opens, the server gives your browser a random identifier, in a signed, first-party cookie that page scripts cannot read. It is not linked to your name, IP address, device, or email, unless you sign in, when your account claims this browser. Attached to it:

• Your readings. Which answers you named on which day, and in what order.
• How you played. That the board was opened, each guess as it was made and what it matched, which way round the blot was turned, whether the game was finished and with what score, streak and time taken, whether and how the result was shared, when the archive or statistics sheet was opened, when the how to play sheet was opened and how many seconds it stayed on screen, whether you were offered an account, and whether you signed in, even if you never guessed.
• When the game breaks. If a page fails: what broke, which kind of page, and whether you were on a phone or a computer. Never the address you were at.
• Counting new browsers. One vote per browser, so Blotle keeps an hourly, self-deleting count of new browsers from your connection: not your address, but an irreversible scrambled fingerprint of it, holding nothing but the count. The same guard protects sign-in codes: asking for one briefly holds a scrambled fingerprint of your connection and one of your email address, never the address itself.
• Blots you went back and played from the archive.The day, your score, whether you named a leading reading, and which readings you named, in order. Kept apart from the day’s real result, and it follows you to another device when you sign in.

Blotle also records words that were typed but matched no reading, with the same identifier, as a per-day count of each word, so it learns which words it lacks. These outlive both erasers, belonging to no account, so the identifier can also moderate anything explicit, illegal or threatening.

Accounts

An account is optional and small: your email address, your record of play, and the bookkeeping any sign-in keeps, namely when it was made, when it last signed in, which browsers are yours, and a line for each email Blotle sent you saying which one and when. Signing out on a browser frees its place and deletes that row. No password, no name, no profile.

The record is which days you played and what you named on each, gaps included, saved when you finish a day signed in; a browser that played before you signed in has its days copied in. Daily scores are not stored but recomputed from the record and each day’s real numbers; an archive play is the exception, its score kept, since there is no daily result to rebuild from. Delete the account and the record goes with it.

Signing in lets your record follow you to any device. It sets the sign-in cookie: first-party, unreadable by scripts, at most ninety days, cleared when you sign out. Signed in, the readings you submit also carry your account.

There is no password; a code is emailed each time, so Blotle sends email. Resend delivers it and Amazon carry it the last mile. Resend keeps a copy of every message, including your address, subject and full text, which Blotle cannot delete, so deleting your account does not reach it; you can ask Resend to forget you directly, and we will pass the request on. Blotle sends two other emails, neither unless you ask. No newsletter, no marketing.

Emails you can turn on

Two, both off until you turn them on. Turning one on is a box you tick yourself.

• Your result, once the day has closed.On a day you played, after the day closes everywhere and the numbers are final, Blotle can email you the room’s result for that blot and where your reading stood, with a coarse look at the new blot drawn as coloured squares, since the message carries no images. A day you sat out, or one almost nobody played, sends nothing. Where nothing you named matched, it sends the room’s result instead.
• Somebody answered your challenge. The box above the challenge button and the switch in account settings are the same control. While on, each link you make carries a note to email you once about its first answer. A link made while off emails nobody, ever.

What is kept when you turn one on: which of the two, when you asked, the exact wording you were shown, and your timezone, read from your browser. The timezone only sends the email in your morning; it is the only geographic thing in any Blotle table, is never guessed from your IP, and goes when the account does.

Every email carries a one-tap off link needing no sign-in or code; the same switches sit in account settings, and your email client’s unsubscribe works too. Turning off is immediate and never touches sign-in codes.

Deleting your account deletes both choices, but two things outlive it. If your address hard-bounces or you mark a message as spam, Blotle keeps an unreadable fingerprint of the address, which cannot be reversed, so it never writes there again. The record of what was sent to that address, and when, is kept alongside it.

Account deletion lives at blotle.io/account, from any signed-in browser, and needs a fresh emailed code, so a stolen session cannot do it alone. It destroys outright your email address, the record of which emails were sent to you, the account itself, the sign-in bookkeeping under it, your record of play, your email choices and the timezone taken with them, and the record of which browsers are yours. It detaches, leaving the row but taking your name off, your readings, the first reading of yours that each day was counted from, your archive plays, and any challenge links you made; a published result cannot change after people have seen it, so those stay. Detached means only your account comes off: the rows still carry this browser’s identifier, which the deletion does not clear. To reach that too, use the device eraser in Statistics, below.

Challenging a friend

If you send a challenge link, Blotle keeps the link’s code, which blot it was for, the identifier of the browser that sent it, and what you saw in that blot, shown to your friend only after they answer. If they answer, it keeps what they answered and the identifier of their browser, so you can be told what they saw. If you were signed in when you made the link, it records your account too, so you are told on any device. The email is a separate choice; a link made with it off emails nobody.

Blotle never learns who you sent the link to: no address book, no friend list, no contact detail for whoever answers, and neither of you can be looked up from the other.

Erasing a browser forgets the challenges it sent and answered but does not reach your account: a link made while signed in still knows it was yours until you delete the account, which also cancels the email. To delete these rows outright, write to the address below and a person does it by hand.

What is never stored

• Your name, or any contact detail beyond the email address an account is. Signed out, not even that.
• Your password. There is not one.
• Your IP address, by Blotle: read once to rate-limit a connection, immediately made unreadable, and stored in no Blotle table. The companies underneath see it to route a request: Vercel at the edge, and the sign-in system, which keeps each live session’s address and browser name until it ends.
• Your exact location, or anything else about who you are. The visitor counts below do include your country and the kind of device you are on.

Analytics

Blotle uses Vercel Web Analytics and Vercel Speed Insights, which count page views and page load speed. Served from this domain, they set no cookies and never receive your identifier, answers or score. They record the visit: the page, the country, the kind of device, and which site linked you here. No advertising trackers, no session recording.

Erasing it

Two erasers, for two kinds of thing.

This device.In Statistics, erase every game and statistic on this device. That clears this browser’s games, statistics, archive record and identity, signs you out, and clears the identifier’s cookie, so the next visit begins as a stranger; a few non-personal settings, like your theme, survive. Clearing your browser’s site data does the same. Neither reaches the database: rows already written stay, under the old identifier your browser no longer holds.

Your account. You delete it at blotle.io/account. What that removes, and what it leaves behind with no name on it, is set out above.

Where it is kept, and for how long

Data lives in a Postgres database run by Supabase, the site is served by Vercel, and email is delivered by Resend, who hand it to Amazon to carry, so both see the address and message. Two more see a request without your record: Vercel count sign-in attempts by IP at the edge, and Supabase sit behind Cloudflare. Vercel also run an invisible bot check when you submit a reading, make a challenge link, or ask for a sign-in code, judging by how the page behaves, not who you are; today it only watches. Nothing is sold, and nothing is shared beyond what running the service requires.

Records of how the game was played are kept as long as the game runs, with no automatic deletion after a fixed period. An account exists until you delete it, with no deletion for inactivity. The daily results are anonymous once a day has closed, and kept as part of the game’s history.

Children

Blotle is not directed at children under 13. Signed out, it collects no name or contact detail about a player of any age, only the random browser identifier and the play above. An account requires an email address, and Blotle does not knowingly create accounts for children under 13; if you believe a child has, write to the address below and it will be deleted.

Who runs Blotle

Blotle is made and run by Bark and Olive, the name behind the support address below. It is a small operation, not a company with a department for this: the person who writes the game is the one who reads the mail.

If something here is unclear, or you want your data removed, write to support@barkandolive.com. A real person reads it and deletes by hand what Blotle holds, including the rows a deletion leaves behind with your name already taken off. Anything the companies that deliver the email still hold is outside Blotle’s reach, so we pass your request on to them.