What HNW stores
- Display names you type into a round, so other players and the result page can render them.
- Game configuration and round outcomes (digits, players, candidates, locked numbers, drand round, commit/reveal hashes) so the result page works and any participant can later verify the round.
- If you create an account: your email, a hashed password, connected sign-in identifiers, profile, accepted friends, private Circles, invitations, plans, restaurant follows and notification preferences. These records support sign-in and the connected features you choose. MCP connection records store hashed credentials, scopes and expiry, not a recoverable copy of your personal key.
- If you opt into push notifications: a browser-issued subscription endpoint linked to your account. Notification inbox and delivery-attempt records distinguish attempted delivery, provider acceptance and whether you opened an update. Restaurant follows create in-app updates; external push and email require separate preferences.
- If you claim a merchant page: the email address you verified the claim with, plus the slug it claims.
Private Circles and temporary sharing
Only you see your Circle lists. Temporary status sharing uses the friends you explicitly selected at publication and current permissions. New Circle members do not gain access to an earlier status; removal, unfriend, block, expiry or withdrawal revokes later access. Status defaults to two hours, never automatically renews and cannot exceed eight hours. HNW does not share your live position or movement history. A restaurant-search position is used for that search and is not reused as a social location. A plan RSVP records your response to its current details; a selection is not a booking or attendance confirmation.
Maps and places
Restaurant search, city and postcode lookup and place pages are answered from HNW's own directory, built from open data published by the Overture Maps Foundation and GeoNames. Your search area and any location you deliberately provide are used for that search and are not sent to a map or places provider. The map itself is drawn from tiles served by OpenFreeMap, so your browser asks that service for the part of the map you are looking at, as it would for any map. Only if you are signed in and choose to search wider, or look up a restaurant that is not in the directory, are your search words and area sent to Google Maps Platform; Google's Privacy Policy applies to that processing, and HNW keeps Google's place identifiers rather than copying Google's business details into permanent results. When you ask a restaurant to add its dishes, HNW counts the request once per person using your account, or a random identifier kept in your browser if you are not signed in. Demonstration collections are labeled and are not real places. If you add a restaurant's dishes through your own AI assistant, HNW keeps which account sent them and the page they came from, so an operator can review them.
Where it lives
- On the server: a Postgres database you (the operator) host. HNW ships no managed-database default — every deploy is self-hosted.
- On your device: local storage keeps your sound preference and quick-play drafts. Session storage keeps per-game player capabilities, a same-device roster and pending selection retry data. Cookies keep your sign-in session, language and consent choices. Signing into another review account clears review session data; private server access is checked against the current account.
Ads and cookies
HNW shows Google AdSense ads on casual pages only: the home page, blog posts, city guides, restaurant search, history, and casual game results. AdSense loads only after you accept advertising in the consent banner; Google then sets cookies to pick an ad, and that data goes to Google under their standard publisher terms, not to HNW. Each time an ad is actually requested we log an internal impression row (slot id, surface, provider, user id if you’re signed in) so revenue reports are auditable; raw impression rows are deleted after 90 days and we don’t correlate them with anything beyond the slot they fired on.
Pages that never show an ad or load AdSense: live games, lobbies and hand-offs, /fairness, audience games, creator game pages (/g/…), brand and restaurant-partner pages (/m/…, /r/…, partner place pages), and sign-in, checkout, billing, account and admin pages. Place pages, the blog index, the Live page, people, profiles and shared results carry no ads either. The ban is enforced server-side at the ad-provider boundary; the frontend never loads the AdSense script on those pages.
The Ad-free and Creator plans remove all ads across HNW until the end of the period you paid for, even if you cancel sooner (a restaurant’s Pro plan does not change its owner’s ads); the Ad-free plan is $9.99 a year (see /pricing). Declining advertising in the consent banner keeps AdSense off for this browser, and no advertising cookies are set.
Analytics and error tracking
HNW ships with two optional telemetry wrappers that are dormant by default on every deploy. Unless the operator running this instance explicitly flips both a feature flag and a provider key, no analytics script loads and no error reports leave the browser.
- Plausible (analytics, when enabled). Privacy-respecting by design — no cookies, no cross-site tracking, no personal identifiers. Records aggregate event counts (e.g., “someone started a settle game”) plus anonymous metadata like browser family and country. Nothing that identifies you personally.
- Google Analytics (when enabled, and only if you accept analytics). Counts visits and which pages are used. It sets cookies and sends your IP address and device details to Google, which shortens the IP address before storing it. We do not use it for advertising. It never loads until you opt in, and you can change your choice at any time in cookie preferences.
- Sentry (error tracking, when enabled). Fires only when something actually throws on the page. Payload is a stack trace plus breadcrumb context for that error — we strip URL query strings and any user-typed text before the report leaves your browser. Nothing fires on successful page loads.
You can check your browser’s network panel. Until you accept analytics, you will see zero requests to plausible.io, googletagmanager.com, google-analytics.com or sentry.io on any page.
Payments
Paid plans are processed by Paddle.com, our online reseller and Merchant of Record. Checkout runs in Paddle’s secure checkout — your card number never reaches HNW’s servers. Paddle receives the buyer email, the billing details required for tax, and the plan you are purchasing; HNW receives a notification back with the subscription state and Paddle’s reference IDs. We store those reference IDs and the resulting subscription state so your plan works, and nothing else about your payment method. Paddle’s own privacy notice governs the data it holds as the seller.
To update the card on file, change billing details, or download an invoice, you use Paddle’s customer portal, which opens from /account/billing. To cancel a plan, use HNW’s cancel button — that cancels the subscription with Paddle and stops further charges.
Refunds are issued by Paddle to the original payment method; HNW records the resulting state. See /refunds for the policy.
Transactional email
Account email — sign-in links, claim approvals/denials, dispute notifications, refund confirmations, subscription changes — is delivered through Emailit as the SMTP relay. Emailit receives the recipient address, the rendered subject and body, and standard delivery metadata. HNW logs the send (recipient, template ID, timestamp, delivery status) so admins can re-send a failed message; we do not retain a copy of the rendered body in that log.
If a send permanently fails — Emailit outage or rejected recipient — the row moves to a failed_emails queue an admin can manually retry from /admin/email-log. Bounce and complaint events from Emailit are recorded against the same row so a hard-bouncing address stops being retried automatically.
What HNW doesn’t do
- HNW does not use fingerprinting or session recording. The restaurant map loads its map tiles from OpenFreeMap. Optional AdSense, Plausible, Google Analytics and Sentry integrations follow the preferences described above. Hosted checkout opens the configured payment provider's own page; email delivery uses the configured server-side mail relay.
- HNW does not sell your private friends, Circles, status or location data to restaurants. Service providers receive the information needed for the feature you use, as described here. A restaurant sees aggregate follower and interaction reporting rather than your private social graph or activity status.
- Ordinary anonymous play stays available. Signed-in hosts and participants can be linked to their own game identities; entering a friend's display name does not create an account relationship or friendship.
- HNW records restaurant menu and dish views, direct and random choices, offer views and ordering handoffs for aggregate owner reporting. A random win is not a preference, a handoff is not a purchase, and no redemption or meetup is counted as confirmed without separate evidence.
How long it’s kept
Resolved games and immutable verification records are retained for later checks. Circles, plans, follows, inbox and connection records support continuing account features. Temporary statuses disappear from active views at expiry or withdrawal; expired or withdrawn status notes and location references are purged from active storage within 24 hours. Revoking an MCP connection stops later account access. Browser push subscriptions are removed when a provider reports expiry or you unsubscribe in HNW.
Your rights
You can delete your account from /profile/settings — this removes your email, password, and OAuth links. Game records you participated in remain (under the display name you used) so the fairness receipts stay verifiable for everyone else who played.
Cookie preferences
You can change which categories you’ve consented to at any time. The choices live in a single hnw.consent cookie on this device; clearing your browser cookies resets them and the banner reappears.
Contact
Borialas Enterprises operates Highest Number Wins. For questions or removal requests, email [email protected].
▸ This document is best-effort, not legal advice. Operators deploying HNW into a regulated context (GDPR, CCPA, etc.) should replace it with a lawyer-reviewed policy that reflects their specific deployment.