Privacy policy

The short version

• You can play DDxam without an account, and without agreeing to anything.
• One optional, first-party cookie remembers this browser, which is what lets your daily scores, streak and percentile be saved at all. Nothing is set until you choose to enable saving, either on the consent bar or with the Enable button on the Leaderboard, Archive or Performance tab.
• Your results are stored under a random ID. Not your name, not your email, unless you choose to sign in.
• Your display name and score appear on public leaderboards. Your own row carries a switch that takes you off them again, whenever you want.
• No ads, no third-party analytics, no cross-site tracking, no selling data. Ever.

Who we are

DDxam is a free daily diagnostic-reasoning game at ddxam.org, made and run by Imaad Virani and John Halphen Jr. Until September 2026 it was called DDxordle, and this policy covers everything saved under that name too. Questions about this policy, corrections to it, or a request to delete what we hold: email ddxam.admin@gmail.com.

The cookie (this is our cookie policy)

DDxam uses a single cookie, called ddx_id, and it is set only after you enable saving, either on the consent bar or with the Enable button on the Leaderboard, Archive or Performance tab. Decline and you get no cookie and the same complete game. Your results just aren't saved anywhere.

• It is first-party: it belongs to ddxam.org, is only ever sent to ddxam.org, and identifies you to no one else. It cannot follow you around the web.
• It contains a random token. No name, no email, nothing derived from you. What our database keeps is a scrambled fingerprint of it, not the token itself.
• It is HttpOnly, so scripts on the page cannot read it, and HTTPS-only. It lasts up to about 400 days, which is as long as browsers permit, so a long break does not cost you your record.

What we store on our servers

If you enabled saving, we keep, under that random ID:

• For each day you play: the date, your score, whether you solved the case, and which diagnosis it was.
• The most recent day you visited (used for counting daily players).
• A display name. Everyone is issued one, a generated pair of words with a number after it, like RestlessReticulocyte7412. You can change it to whatever you like from the game's menu.
• When you first opened the day's case and how long you took to solve it. These exist to spot forged scores, and they are not shown to anyone.
• If you join or create a league: the league's name, who is in it, and any invitations you send or receive.
• If you send a bug report: what you wrote, the email address if you gave one, and the page, case, version and device details the form attaches so we can reproduce the problem. Reports are also emailed to our team's inbox, which is a Google account, so Google holds that copy. A report is deleted on request like any other record.

Percentiles and average scores are computed across all players in aggregate. Your IP address is held in memory for a moment to rate-limit abuse, and it may turn up in our hosting provider's routine server logs. It is never stored alongside your game data.

Leaderboards, and how to stay off them

DDxam has public leaderboards: a daily board of today's scores and an all-time board. A row carries a display name and a score, and on the all-time board it also carries how many days that player has played. Nothing else about you reaches another player. Not your email, not your history day by day, and never a name you did not choose.

You can hide. Your own row on the leaderboard carries a Hide me control. Press it and your name leaves the public boards at once, while your scores go on counting and you go on seeing your own rank. The same control puts you back. Anyone whose account predates these boards starts hidden and sees a Show me control instead. They agreed to have their scores saved, which was never an agreement to have a name published, and we are not going to read it as one.

Leagues are private boards you join by invitation. The members of a league you are in can see your display name, your daily score, and whether you have played today's case yet. Invitations go by display name, so inviting someone tells them yours. Leaving a league takes your row off its board; hiding yourself from the public boards does not hide you inside a league you chose to join.

What stays on your device

Your browser's local storage holds your consent choice and your interface preferences, meaning the theme and which intros you have already seen. Once you enable saving it also holds a local copy of your results, your streak and the round you are in the middle of, so that a refresh does not wipe it. The consent choice and the preferences never leave your device. The local copy of your results is only a convenience, since those results are on our servers too once saving is on, as described above. Clearing the site's data in your browser removes everything held locally.

Signing in is optional

Signing in, either with Google or with an emailed link, exists for one reason: to keep the same record across your devices. Authentication is handled by Supabase, and sign-in emails are delivered by Lovable's email service from notify.ddxam.org; both act only on our instructions. When you sign in we receive your email address, and from Google your basic profile, which is a name and an email. We use it to connect your devices to one account and for nothing else. We send no marketing email. The only email you will ever get from us is a sign-in link, or a confirmation, that you asked for. Signing out touches that device alone; your account and your scores are untouched.

Who else is involved

The site and its database are hosted on Lovable Cloud, which runs on Supabase, and they process data solely to run the service. If you sign in with Google, Google processes that sign-in under its own privacy policy. Our servers are in the United States, so if you play from elsewhere your data is processed there. One more, on one page only: the About page loads a small script from Google that draws its "preferred source" button, so Google can see that you opened that page; the game itself loads nothing from anyone else. That is the entire list. No advertising third parties, no analytics third parties, and we never sell or share your data for marketing.

AI, and what it never sees

The cases are drafted with the help of an AI model and then checked and edited by us; the About page explains exactly how. Nothing you do reaches any AI service: not your differentials, your final diagnosis, your scores, your name, your email or your bug reports. The model writes teaching material. It does not process your data, and no personal data of yours is ever part of a prompt.

Your choices

• Play without saving: press Not now on the consent bar, or simply never press Enable anywhere in the game.
• Remove the cookie: clear this site's data in your browser settings.
• Delete everything: in the game's menu, under You, press Delete my data. It removes your scores, streak, display name, league memberships and account from our servers in one go, and clears this device. Or email ddxam.admin@gmail.com and we will do it for you. An anonymous record is tied to you by nothing we can look up, which cuts both ways: clear the cookie without deleting first and it is orphaned from you for good.

How long we keep it

Your scores, streak and display name are kept for as long as the game runs, or until you ask us to delete them, whichever comes first. If the game ever shuts down, the records go with it. A sign-in link expires within the hour and is not kept.

Your rights

Wherever you live, you can ask us what we hold about you, ask us to correct it, or ask us to delete it, by emailing the address above. If you are in the UK or the European Economic Area, those are your rights under the GDPR and you also have the right to complain to your local data protection authority; the lawful basis for keeping your saved results is your consent, which you give by enabling saving and withdraw by clearing the cookie or asking us to delete your record.

Children

DDxam is not directed to children under 13, and we do not knowingly collect information from them. If you believe a child under 13 has enabled saving or created an account, email us and we will delete the record.

Changes

If this policy changes, the new version appears here under a new date. We are not going to quietly weaken anything it promises; if that happens, it will say so on this page.