Privacy

Last updated 10 October 2026.

The short version

You can play Plottr without an account, and most people do. Signing in is only what puts you on the leaderboard. Whether or not you sign in, Plottr now keeps a short-lived record of the round you are playing on its own servers. That is new, and it is described below.

If you play without signing in

On your device: A random play identifier generated the first time you play, which clues you have answered today and what each scored, and whether you have muted the game. These are in your browser's local storage; clearing your site data erases them.
On Plottr's servers, for 48 hours: Each answered clue is recorded against your play identifier so that a question cannot be answered twice and so that a round survives a dropped connection or a cleared browser. The record holds the clue, your guess, the distance and the score. It is keyed to that random identifier and to nothing about you, and it is deleted automatically after 48 hours. Earlier versions of this page said Plottr held no record of you on its servers. That is no longer true, which is why this paragraph exists. If you are signed in, this same record is keyed to your account instead of the random identifier, which is what lets a round continue on a second device or after you clear your browser, and it still expires after 48 hours.

If you sign in

Your account: Signing in means typing an email address and entering a six-digit code Plottr emails you. There is no password and no third-party sign-in service. Sending that code is the only thing Resend, the mail provider Plottr uses, ever sees: your address and the code, for the few seconds the message is in flight. Plottr itself never stores your address. What it keeps is a one-way hash of it, which Plottr cannot turn back into an address (it can only be matched against an address somebody already has), so Plottr has no way to email you for any reason other than the code you just asked for, which is the point of storing it that way.
Limiting abuse of the sign-in form: Plottr counts how many codes have been asked for, and how many have been submitted, against a one-way hash of your IP address, for up to an hour each time, so that one computer cannot mail codes to hundreds of addresses or guess its way through a six-digit code. The address itself is never written down: the hash is what the counter is filed under, and it works just as well for counting while telling us nothing about who you are. Those counters are a number and nothing else: no record of which addresses were typed, and nothing that outlives the hour. Requests are counted against the hashed email address too, which is what sets the wait between codes and the limit of ten a day.
Staying signed in: Signing in sets two cookies. One holds your session for seven days, and renews for another seven every time you use Plottr, so a player who opens the game at least once a week never has to sign in again. The other only tells your browser whether it looks signed in; it carries no authority, Plottr's servers never read it, and setting it by hand gets you a page that looks signed in while every request to it still fails.
Your play history: For each counted round: the date and the score. Rounds older than 90 days are deleted automatically. Alongside it: a handle, your current run of consecutive rounds, your best round, and your rating.
Your display name: A handle like atlas-4821 is generated for you the first time Plottr looks up your own standing (opening your history or the leaderboard while signed in) or when you finish your first counted round, whichever happens first. Plottr never asks for your real name and has no field to put one in. You can change the handle on your history page.

What the leaderboard publishes

The leaderboard is public and anyone can read it without an account. For each ranked player it shows a handle, a rating and a position. Nothing else, and never an email address or an account identifier. You appear there only if you sign in and play at least ten rounds in 90 days. Deleting your account removes you from it.

What leaves your browser

Requests to Plottr: Playing sends your guess, a latitude and longitude, to Plottr so it can be scored, along with the play identifier above and, if you are signed in, your session cookie, attached automatically by your browser. Plottr's host, Vercel, keeps standard server logs of these requests, which include IP addresses, for a limited period. Plottr itself never writes your IP address down at all. The sign-in counters described above are filed under a one-way hash of it, and nothing else Plottr stores involves it.
Your approximate timezone: Vercel tells Plottr which timezone your IP address falls in, so that today's round is the one on your own calendar rather than somebody else's. The timezone is used for that and discarded; it is not stored against you.
Map imagery and borders: The globe is not served by Plottr. Your browser fetches satellite imagery directly from Esri and borders, place codes and fonts directly from OpenFreeMap. Those requests carry your IP address to them, and their own privacy terms apply. This happens on every map load, whether or not you guess.
Audience measurement: Plottr uses Vercel Analytics to count page views. It does not use cookies and does not build a profile of you. The code also supports PostHog for product analytics. It would record that a round was completed or a result shared, tied to the play identifier and never to an answer, a clue or a coordinate, but it only loads when a key is configured. If that changes, this page changes with it.

Who else holds any of this

Vercel: hosting and server logs, and the timezone lookup.
Resend: your address and the sign-in code, for the length of one email, and nothing else.
Upstash: the round records, play history, leaderboard and account records described above, plus the hour-long sign-in counters, stored as a Redis database. Nothing there is keyed to an IP address: the sign-in counters are filed under a one-way hash of one.

Nothing is sold, and nothing is shared for advertising.

Deleting everything

Delete your account removes your account, your handle, your play history and your leaderboard entry, immediately and permanently. Three things are left behind rather than deleted on the spot, all of them bare identifiers with nothing left attached to them:

A round still in progress, which expires within 48 hours.
The marker that records you have claimed one ranked round today. Deleting your account revokes every session immediately, so no credential survives it and there is nothing left to replay. The marker is not protecting against that. It is left alone only because finding it would mean scanning every dated marker to remove the one field that names you, and it expires on its own within 48 hours anyway.
Your account identifier alone, in an internal list used to decide whose rating needs recalculating on a given day. It carries no handle, no history and no rating of its own, and it ages out within 100 days.

If anything else cannot be removed automatically you will be told so rather than told it worked. For a copy of what is held, or anything else, write to makers@plottr.in.

What Plottr still does not do

No passwords, and no third-party sign-in service. Signing in is an emailed code, nothing else.
No payments, and nothing to buy.
No access to your real location. You tap a globe you control; the browser is never asked for GPS.
No tracking or advertising cookies, only the two described above that keep you signed in.
No profile built from your play, beyond the score history described above.

Children

Plottr is not directed at children under 13. Playing requires no account and no personal detail, and signing in requires only an email address capable of receiving a message.

Changes

This page is rewritten when the code changes, not afterwards. Every claim on it is checkable in the repository.

Contact

Questions about any of this, or a request to have something removed, go to makers@plottr.in.