Privacy
Last updated 14 October 2026.
Beamzag keeps your puzzle progress in your browser and does not send it to me or anyone else. Here is what it stores on your device and why, what changes if you turn on the daily reminder, and what changes if you buy the Supporter pack.
What is stored on your device
Everything goes in your browser's localStorage, under these keys:
bz.stats: games played and solved, current and best streak, flawless solves, hints used, total time and taps, and how many archive and practice boards you have solved.bz.settings: the choices you made on the Settings screen.bz.day.*: one entry per daily or archive puzzle you start, with your mirrors, taps, hints and time, so you can close the tab and pick up where you left off. The past boards page reads these entries to mark the boards you have solved.bz.seen: whether you have seen the tutorial.bz.practice: today's date and how many free practice boards you have started, so the three-a-day limit can be counted.bz.nudge: how many different days you have played, and the dates the reminder offer and the Supporter pack line last showed or were turned down, so neither comes up too often.bz.push: only if you turned on the daily reminder. Whether it is on, the hour you picked, your offset from UTC and your browser's push address, so the page can tell my server when your clock changes.bz.supporter: only if you bought the Supporter pack. A short code signed by my server that says this browser has the pack. It holds no name, email or payment detail.
Clearing site data for beamzag.app erases all of it. Delete all in Settings erases everything except bz.supporter, which you can get back with Restore on the Supporter pack page, and bz.push, so the reminder switch in Stats still works. I have no copy of your progress, so that cannot be restored.
For offline play, a service worker keeps the game files and the puzzles you have opened (plus tomorrow's, fetched ahead of time) on this device. Clearing site data removes that cache too.
What Beamzag does not do
There are no accounts and no sign-up form, and Beamzag sets no cookies. Apart from Cloudflare's page-view counter, described under Hosting, there are no analytics or tracking scripts. Unless you buy the Supporter pack, I do not collect personal data.
Hosting
The site is served by Cloudflare Pages. Like any web host, Cloudflare may briefly log IP addresses and request details for security and abuse prevention. See Cloudflare's privacy policy.
Cloudflare also loads its Web Analytics script on each page, because I want to know roughly how many people play. It sets no cookies and stores no IP address or other identifier, so what I see is totals: page views and visits, broken down by page, country, browser and referring site. Your progress never goes through it. That stays in your browser's local storage, and the game sends nothing else anywhere, apart from the daily reminder and the Supporter pack steps below, and only if you use them.
The daily reminder
The reminder is off until you press Remind me after a solve, or Turn on under Stats, and your browser then asks whether Beamzag may show notifications. If you allow it, your browser hands Beamzag a push subscription: an address at your browser's own push service (Google's for Chrome, Mozilla's for Firefox, Apple's for Safari, Microsoft's for Edge) and two keys that let my server encrypt each message so only your browser can read it.
A small server of mine, a Cloudflare Worker at beamzag.app/api/push, stores that address and the two keys, your time zone as an offset from UTC (minus four hours for Toronto in summer, for example) and the hour you picked. There is no account, and no name or email address is involved. Once a day, at that hour, it sends one short notification about that day's board. It also keeps short-lived counters that slow down abuse, keyed by a one-way hash of your IP address, which delete themselves within two hours.
Turn the reminder off in Stats and the Worker deletes the subscription straight away. If your browser's push service tells the Worker three days in a row that the subscription no longer exists (because you cleared site data or blocked notifications, say), the Worker deletes it then. The push service can see that a message came from this site, but not what it says.
Buying the Supporter pack
The Supporter pack is optional and costs C$4 once. Checkout happens on Stripe's own pages, and when Managed Payments is on, Stripe's Link service is the seller of record. Stripe collects your email address and payment details there. Your card number goes to Stripe and never to me. In my Stripe dashboard I can see your email address, the amount, the date, your country and the card brand and last four digits, which is what any small shop sees. Stripe's use of that data is covered by Stripe's privacy policy and Link's.
After you pay, Stripe sends you back to beamzag.app/thanks with a checkout id in the address. That page sends the id to a small server of mine (a Cloudflare Worker at beamzag.app/api/store), which asks Stripe whether the checkout was paid and replies with the signed code that goes in bz.supporter. Restore on another device sends the email address and the card digits or receipt number you type to the same Worker, which looks for a matching paid checkout in Stripe and then forgets them.
The Worker keeps two things. One is short-lived counters that slow down guessing, keyed by a one-way hash of your IP address or of the email you typed, which delete themselves within a day. The other, for each purchase, is a hash of the checkout id with a count of how many codes it has handed out, so one purchase cannot be shared endlessly. It keeps no names, email addresses or IP addresses.
Advertising
Beamzag shows no ads right now. The page reserves two ad slots, but they are empty and load nothing.
If I turn ads on later, they will come from Google AdSense, Google's H5 Games Ads, or both. Google and its partners may then use cookies or device identifiers to show ads based on your visits to this and other sites. You can opt out of personalised advertising at Google Ads Settings, and read how Google uses data at policies.google.com/technologies/partner-sites. Visitors in the EU and UK will see a consent prompt before any personalised ad loads. I will update this page on the day ads go live.
Sharing your result
The Share button opens your device's share sheet, and Copy puts a short text card on your clipboard. Nothing is posted anywhere unless you post it yourself.
Children
Beamzag collects no personal data from anyone, children included. The one exception is the optional Supporter pack, whose checkout asks for an email address and a payment method. The daily reminder stores no name or email address.
Contact
Email me at hello@beamzag.app with any question about this policy.