Privacy Policy

This policy explains what personal data Same Five processes when you visit playsamefive.com, play the daily challenge or use an account, why, who helps us run the service, how long data is kept and what you can do about it. It describes how the service actually works today.

Who we are

Same Five is operated by Zilbehar Ajdari, who is the controller of your personal data. Contact: support@playsamefive.com. The service is hosted in the European Union.

What we collect

When you play — with or without an account

• Gameplay: the answers you give, when each was submitted (timed by our server), your score, completion time, rank and percentile, and streaks.
• Age confirmation: that you confirmed you are 16 or older, and when.
• Fair-play signals: automated checks on timing and answer patterns that can flag a result for review.
• Guest identifier: if you play without an account, a random identifier in a first-party cookie so your result and streak stay with your browser. We store only a keyed hash of it, never your name or email.

When you create an account

• Account details: email address, username, optional display name, and a password hash (Argon2id — we never store your password itself).
• Settings: language, time zone, whether you appear on public leaderboards and whether you opted in to email notifications (off unless you turn it on), with the date of that choice.
• Your activity: personal records, statistics by question category, practice sessions, friend requests and friends, share links you create and reports you submit about content or players.
• Weekly League and career: the league points each finished Daily Five, practice challenge and Daily Mission earned you (worked out by our server from your recorded answers), your weekly totals and final places, whether you take part in the league and since when, your career rank and points, the badges you unlocked and when, and the frames, backgrounds, title and featured badges you chose for your profile.
• Profile privacy: who may see your profile and each part of it, who may send you friend requests, and the players you have blocked.
• Subscription (only once Pro is on sale): plan, status and renewal dates, and invoice records (amount, tax, currency). Payment details are handled by our payment provider; we never receive or store card numbers. Pro is not available for purchase at the moment.

Technical and security data

• Sessions: a hashed session token with a keyed hash of your IP address and of your browser's user-agent, so you can review and end sessions and so we can detect abuse.
• Security log: security-relevant events — such as multi-factor authentication changes, signing out of all sessions, changing your email address, account deletion and every staff or administrator action — with a keyed hash of the IP address and the internal id of the account concerned. For some moderation actions it also records the reason a staff member entered and, when a username is changed by staff, the previous username.
• Server logs: our web servers record each request's time, page address (without query parameters), status, IP address and user-agent. These logs are used to keep the service running and secure, and are deleted automatically after a short period (they are rotated by size and cleared by age on a schedule). They are not included in backups. Our database stores IP addresses only as keyed hashes, never as raw addresses. Our application also logs each request's route and status and, for signed-in requests, the internal id of the account; those logs are deleted on the same schedule.
• Product analytics: first-party events such as “challenge viewed” or “result shared”, with the page address. They are linked to your account (through an internal id) if you are signed in. Events sent from your browser while you are not signed in carry a random identifier that exists only for the current page load. Events our server records about a guest's play carry a pseudonymous identifier derived from the guest cookie and a secret held by us, which changes every day, so they cannot be followed from one day to the next. Event details never include account, result or session identifiers. Nothing is stored on your device for analytics, and we use no third-party analytics, advertising or tracking scripts.
• Email: the address and content of the emails we send you (verification, password reset, security notices and, once Pro is on sale, subscription notices).
• Play reminders (only if you turn them on): the push address your browser creates for Same Five and the keys needed to encrypt messages to it (stored encrypted), when you turned reminders on and when we last sent one, and, for an account, which sign-in turned them on (so signing out of that browser stops them). We use the times of your games to decide whether a reminder is due.

Why we use it

• To provide the game and your account — running the daily challenge, scoring, leaderboards, streaks, sharing, friends and practice (necessary to provide the service you asked for).
• To keep it fair and secure — rate limiting, preventing cheating and abuse, protecting accounts and investigating incidents (our legitimate interest in a fair, secure service).
• To send service emails — email verification, password resets and security notices (necessary for the service). We do not send marketing email; if we ever do, only to people who turned email notifications on.
• To send play reminders you asked for — at most one a day when you have not played for 24 hours (your consent, given by turning them on; turn them off at any time in Settings, under today's result, or in your browser's site settings).
• To improve the product — understanding, in aggregate, how the game is used (our legitimate interest).
• To meet legal obligations — for example keeping invoice records once Pro is on sale.

Fair-play checks only flag a result for review: a person decides whether it is hidden or removed from leaderboards, and no score is changed automatically. If you think a decision about your result is wrong, contact us.

What other players can see

Public leaderboards show your display name (or username), score and completion time. You can hide yourself in Settings; you then appear as “Private player”. Friends you accept can see your daily results on their friend leaderboard (a Pro feature). A share link shows the result you chose to share to anyone who has the link; links expire after 30 days. To end a link sooner, contact us.

Weekly League: while you take part, the league table shows your display name, username, career rank and weekly points to signed-in players, and an ended week's final table keeps your place in it. You can leave the league at any time on theleague page. Accounts that had hidden themselves from public leaderboards before the league started were left out of it.

Your profile: your profile page shows your name and, depending on your settings, your career rank, badges and title, records, recent daily results and past league places. By default anyone can open it and see your rank, badges and league places, while records and recent results are shown only to friends; accounts that had hidden themselves from public leaderboards start with a private profile. You choose who sees each part (everyone, friends or only you), who may send you friend requests, and whom you block, in Settings. What a viewer may not see is never sent to their browser. A blocked player cannot see your profile or send you requests, and you cannot see theirs.

Service providers

We do not sell personal data or share it for advertising. We use these providers to run Same Five:

• AlphaVPS — the server that runs Same Five and its database, in Bulgaria (EU).
• Cloudflare — domain, encrypted connections and protection against attacks for every request to playsamefive.com (it processes your IP address and request details to do so), and storage of our encrypted database backups. It also provides the security check (Turnstile) we show only when sign-in or sign-up looks suspicious: your browser then loads a script from Cloudflare, and we send Cloudflare the check's result token and your IP address to verify it.
• Resend — delivery of the emails we send you (the address, subject and text of each message, including the one-time links in them).
• Your browser's push service — only if you turn play reminders on: the service your browser maker runs to deliver notifications (Google for Chrome, Mozilla for Firefox, Apple for Safari, Microsoft for Edge). It receives the push address and each reminder encrypted end to end, which it cannot read.
• Lemon Squeezy — only once Pro is on sale: merchant of record for subscriptions, processing payment details under its own privacy policy. When you start a checkout we send it your email address and your account's internal id so the subscription can be matched to your account.

Some of these providers are based in, or process data in, countries outside the European Union and North Macedonia, including the United States. We rely on the transfer safeguards they offer in their data processing terms. We may also disclose data where the law requires it.

How long we keep data

Deleting your account

You can delete your account at any time in Settings (it asks for your password and a typed confirmation). Deletion takes effect immediately:

• Your email address, password, username, display name, multi-factor settings and recovery codes are removed.
• You are signed out everywhere (sessions are deleted), your share links stop working, and friendships, practice history, streaks, personal records, skill statistics by category, league points and places, career, badges, profile choices, blocks, consent records, pending emails and support notes are deleted. A week you won keeps its result without your name. The guest record your account absorbed is deleted too.
• Analytics events are unlinked from you: the account, browser and session identifiers on them are cleared.
• Your past daily results (score, time, answers, rank) stay in the day's results as “Deleted player”, so other players' ranks and statistics stay correct. They no longer carry your name, email, username, address fingerprint or guest identifier, but they remain tied to an internal id.
• The security log (keyed IP hashes and internal ids) is kept for its 24-month period, and reports you submitted are kept for moderation. Subscription and invoice records are kept as accounting records, tied to the internal id; our payment provider also keeps its own records under its own policy. A record of the deleted account's internal id is kept briefly so the deletion can be applied again if a backup is ever restored. Copies in encrypted backups are deleted as the backups expire, within 35 days.

If you cannot sign in, email support@playsamefive.com from the address on the account and we will help.

Your rights

Data protection law — including North Macedonia's Law on Personal Data Protection and, for people in the European Union, the GDPR — gives you rights over your personal data:

• Access and portability: download a copy of your data at any time in Settings → Your data (after confirming your password). It does not include notes staff wrote about your account or internal fair-play flags; write to us if you want to ask about those.
• Correction: change your display name, language, time zone and email address in Settings (a new email address is confirmed by a link sent to it). Usernames cannot be changed in Settings; write to us if yours needs to change.
• Deletion: delete your account in Settings, as described above.
• Objection and restriction: object to processing based on our legitimate interests, or ask us to restrict processing, by writing to us; we handle these requests by hand.
• Complaints: you can complain to the Personal Data Protection Agency of North Macedonia, or to the data protection authority where you live.

To exercise a right, email support@playsamefive.com. We reply within one month.

Cookies and storage

Same Five only uses storage that is strictly necessary for the service you request:

• SF_SESSION — keeps you signed in (up to 30 days; HttpOnly, Secure).
• XSRF-TOKEN — protects forms against cross-site request forgery (until you close the browser).
• SF_GUEST — keeps a guest's result and streak with the browser (up to 400 days).
• Local storage (sf-reminders:not-now) — only if you answer “Not now” to the reminder offer: remembers that for 30 days so the offer does not come back after every game.
• Service worker — only if you turn play reminders on: a small script your browser keeps to show the reminder. It does not store or intercept anything else.
• Session storage — remembers an in-progress game in the current tab so a reload does not lose your answers; cleared when the tab closes.

The security check (Turnstile), shown only when sign-in or sign-up looks suspicious, is provided by Cloudflare and runs a script from Cloudflare in your browser; Cloudflare's privacy policy describes what that script stores.

There are no advertising, analytics or third-party cookies, so we do not show a cookie consent banner.

Advertising

Same Five does not show ads today, and no advertising code runs in your browser. Our pages carry a non-executing tag that identifies the site to Google AdSense, and the site publishes an ads.txt file naming Google as an authorised seller. Neither stores or reads anything on your device.

We may show ads from Google AdSense in the future to help keep the daily challenge free. Before any ad is shown, we will update this policy and the date at the top of the page. When ads are shown:

• Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to this website or other websites.
• Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the internet. Third parties may place and read cookies on your browser, or use web beacons or IP addresses, to collect information as a result of ad serving on this site.
• You can opt out of personalised advertising by visiting Google's Ads Settings, or opt out of some third-party vendors' use of cookies for personalised advertising at aboutads.info. Google explains how it uses data from sites that use its services.
• In the European Economic Area, the United Kingdom and Switzerland, we will ask for your consent through a Google-certified consent management platform before advertising cookies are used, and you will be able to change your choice at any time.
• Ads will not appear inside the game itself: not on question screens, and never over the timer or answer controls.

Security

Connections are encrypted, passwords are hashed with Argon2id, our database stores IP addresses only as keyed hashes, backups are encrypted, staff accounts require multi-factor authentication and access to production systems is restricted. No service can be perfectly secure; if a breach affected your personal data, we would notify you and the authorities as the law requires.

Minimum age

Same Five is for people aged 16 and older, and asks players to confirm their age before playing. We do not knowingly process data about anyone younger; if you believe we have, contact us and we will delete it.

Changes and contact

When we change this policy we update the date at the top of this page. If a change materially affects how we use your data, we will also tell account holders by email or on the site before it takes effect. Questions or requests: support@playsamefive.com.