MorphMove

Privacy

Last updated 24 October 2026

Leaderboard

Your assigned or chosen player name, rating and rank are public on the leaderboard. A random device credential keeps your player profile separate from other players. We store a hash of that credential, your rating progress, submitted game records and name-change time to synchronize results and prevent abuse. Offline results stay on your device until it reconnects. We also keep hourly submission counts and validation outcomes to monitor abuse, with routine cleanup of records older than 30 days. These checks do not collect additional IP addresses or device fingerprints and do not automatically ban players.

Custom names are sent to OpenAI for automated moderation. This is separate from optional usage analytics. Clearing this device’s data may create a new profile; it does not delete the old public entry. To request correction or deletion, contact admin@morphmove.com and include your player name.

Gameplay analytics

The web and installable web versions of MorphMove record first-party product events to understand how the game is used and improve it. These events can include app sessions and returns, page and instruction opens, game starts, moves, blocked or abandoned move attempts, bounded AI reliability outcomes, results, ratings, restarts, review actions, control changes, sharing and multiplayer actions, notification-prompt outcomes, and interactions with the physical-edition prompt.

What the event stream contains

Events use random browser-installation, session, game, and event identifiers. They may include bounded details such as move method, move count, outcome, duration, difficulty tier, runtime category, fixed failure reason or latency bucket, selected setting, anonymous invitation or share identifiers, campaign labels, and the hostname of an external referring site. A coarse country, device type, operating-system family, and browser family may be derived when events are uploaded. Country may reflect a VPN, Private Relay, or the place where offline events were later uploaded.

Names, email addresses, room access tokens, full user-agent strings, full referring URLs, and free-form text are not saved in the gameplay event stream. Hosting providers may still process ordinary connection data, including IP addresses, as needed to deliver the service securely and prevent abuse.

Local history

Up to the most recent 50,000 detailed analytics events may be kept in this browser’s IndexedDB so MorphMove can retain local statistics. Compact lifetime totals may remain available even as older detailed events rotate out. Pending events are also held locally while offline. Clearing MorphMove’s browser data removes that local analytics history and creates a new anonymous installation identifier.

Multiplayer rooms

Multiplayer games use an eight-character room code, random participant credentials, game state, scores, presence timestamps, and anonymous room and match identifiers so the game can synchronize between players. Participant credentials are sent only to the relevant player; server-side credentials are stored in hashed form. Rooms are temporary and expire after about 24 hours unless renewed by activity.

Daily Puzzle progress

Detailed Daily Puzzle attempts, moves, solved dates, and streaks are stored only in this browser. They are not linked to your rating or synchronized across devices. Clearing MorphMove’s browser data removes that progress.

Weekly workout progress also stays in this browser. It records local practice dates and completion identifiers to count each day once, independently of analytics. It is not synchronized across devices. Clearing MorphMove’s browser data removes this progress too.

Notifications

If you enable notifications from the weekly workout, Daily or multiplayer, the browser creates a push subscription containing a provider endpoint and encryption keys. MorphMove uses it for recurring 12:00 local-time daily practice reminders when no completed practice has been recorded for that local day and, in a Friend room, to tell you when the other player joins or makes a move while you are away, including when the game ends. The reminder registration also stores an anonymous management token, your current IANA time zone, the next reminder time, and the latest practice or reminder day handled on this installation. A completed CPU or Friend game, or a finished Daily attempt, can skip that day’s reminder. Your selected language is stored with each registration so alerts can use that language; room alerts are separately linked to an anonymous player token. Room registrations expire after 30 days without refresh. Registrations are removed when the push provider reports that they are no longer valid. You can stop all alerts at any time in your browser settings; this stops delivery on that device but does not necessarily delete the daily reminder registration from MorphMove’s server.

Optional advertising measurement

Advertising cookies and Google or Meta advertising tags stay off until you give permission. We show a small consent banner when you arrive at the game with the ad=1 campaign marker, or visit our shop, and our hosting network identifies an EU location. The banner is shown only when advertising measurement is enabled and you have not already chosen. Visits outside the EU or with an unknown location do not open an automatic banner. You can opt in using the advertising preferences control below. Regional detection uses only the country provided by our hosting network; we do not save it. Your choice is remembered for up to 180 days and shared between morphmove.com and shop.morphmove.com in the same browser. Separate browsers or in-app browser sessions may ask again. Declining keeps the game and shopping available. You can change your choice using the advertising preferences control on this page or in the shop footer. This advertising choice does not enable unrelated Shopify analytics or preference cookies.

If you accept, campaign labels and advertising click identifiers can be remembered for up to 90 days and carried to the shop and checkout. A confirmed paid order containing the physical MorphMove game can be reported to the configured advertising providers, with its order identifier, currency and discounted physical-product value. Meta purchase reporting also includes the buyer's browser user agent from the consented checkout. Playing the game or opening the shop does not count as a purchase. Purchase measurement records are retained for up to 90 days. A hashed consent receipt is retained for up to 180 days so pending purchases can be excluded after a recorded revocation. Our purchase receiver does not store customer names, email addresses or delivery addresses. Google and Meta may process their own cookie identifiers and connection information under their respective privacy policies.

Security and abuse prevention

MorphMove applies rate limits and other request protections to reduce spam and abuse. Hosting and infrastructure providers may process short-lived technical identifiers derived from connection data for those purposes and for ordinary service security.

Purpose, retention, and providers

Gameplay data is used to operate, secure, understand, and improve MorphMove, and provide multiplayer and notifications. It is not sold and is not used to create advertising profiles. Optional advertising measurement is separate and depends on your permission, as described above. Web analytics retention maintenance removes live events older than 360 days; provider recovery systems may retain deleted records for up to 30 additional days. Temporary multiplayer rooms and join-notification registrations expire as described above. Daily reminder registrations have a rolling ten-year expiry, renewed when the registration is refreshed or a reminder is successfully sent; invalid registrations are removed sooner. You can request deletion at admin@morphmove.com. Hosting, database, and push notification providers may process the minimum data needed to provide their respective services.

Your choices and rights

You can decline notification permission and clear locally stored web data. For access, correction, deletion, objection, or other privacy questions, email admin@morphmove.com. Because web analytics identifiers are random and contain no account identity, you may need to provide the relevant identifier when asking about a specific analytics history. You may also lodge a complaint with your applicable data-protection authority, including Portugal’s CNPD.