Privacy Policy

Who we are

Fourth and Miles is run by Cruz Labs LLC (“we”, “us”). Questions about this policy go to hello@fourthandmiles.com. This policy is effective October 22, 2026.

What is stored in your browser

The game saves a few entries in your browser’s localStorage, on your device. We cannot read them from our servers; the only values that ever leave your device are the ones the game sends when you finish the daily game, described under “What our server receives”. Every entry’s name starts with fourthandmiles:. Here is the full list:

• fourthandmiles:session:<date>: that day’s game. It holds your answers and points for each round, how far you got, the school and rival on your matchup card, and the chirp you were shown, so you can come back to your score and share card.
• fourthandmiles:session:<date>:p<number>: the same thing for each practice set you play that day (p1, p2 and so on).
• fourthandmiles:school: the school you saved, if you picked one, so the rivalry card can talk to your side.
• fourthandmiles:result-token:<date>: a random code your browser makes, one per day, the first time you finish that day’s daily game. It is used only so your score is counted once in the daily totals, and it is not linked to your name, email, any account or anything else on your device.
• fourthandmiles:sound: whether sound is on or off.
• fourthandmiles:motion: whether you chose full or reduced motion.
• fourthandmiles:audio-rotation: which announcer lines and crowd sounds you heard recently, so the game can rotate through them instead of repeating. It holds only sound file names.
• fourthandmiles:anon: reserved for a random anonymous id. The current game does not create it. If a future version does, it will be made on your device, it will not be linked to your name, email or any account, and it will not go in share links.

Spicy mode is not saved: it starts off every time you reach the finale. If your browser blocks storage (for example in some private modes), the game keeps these entries in memory for the visit and forgets them when you close the tab.

What our server receives

The game talks to our server in three ways, and only these three:

• Loading a challenge. Your browser asks for the day’s questions. The request can carry the challenge date and, if you are playing a practice set, the practice-set number. The server sends back the questions without the answers.
• Revealing a map answer. Each time you drop a pin, your browser sends the challenge date, the question id, the map coordinates of the spot you tapped, the seconds you took and the practice-set number (0 for the daily game). The server uses them to score your guess and send the answer back, and it does not save them.
• Finishing the daily game. When you reach the final score of the daily game, your browser sends the challenge date, your total score, the school you picked (if you picked one) and the day’s result token from your browser. The server adds your score to anonymous daily totals (how many players landed in each score band, and each school’s running sum and number of plays) in our database provider, Supabase (US region), and sends back today’s standings. To count each browser once, it keeps a small record holding a one-way hash of the token (never the token itself), that day’s score and the first school you picked, so a school chosen after your score was sent is still added to that school’s total, once. No IP address, name or other lasting identifier is stored, and the token changes every day, so days cannot be linked. Changing your school later does not move your score to another school or count you twice. Practice sets are never sent. Everything is deleted after 35 days. To stop one connection flooding the totals, the server also keeps, for two days, a count of results per keyed one-way hash of your network address. The address itself is never stored, and the hash changes every day.

The coordinates are a point you choose on a map, not your location. We do not ask for, read or collect your device’s location. Apart from the daily-game submission above, the server never receives your saved school, your results or anything else from localStorage.

Because nothing in the daily totals is linked to you, we cannot find, show or remove one person’s part of them. The totals and the token hashes are deleted after 35 days.

Our host, Vercel, keeps standard request logs for every request to the site, including the game files, audio and these requests. A log line includes your IP address, your browser’s user agent, the time and the address requested. Vercel keeps them for a limited period under its own policy, and we use them only to run, secure and fix the site. Apart from those logs and the anonymous daily totals and token hashes described above, we keep nothing about you on our servers.

Share links carry a ref tag that is either share (the link inside the share text) or link (the copy-link button). It does not contain an id or anything that identifies you.

When you email us

If you write to us, we receive your email address and whatever you put in the message. We use it only to answer you and fix what you reported.

Third parties

• OpenFreeMap serves the map tiles (built from OpenMapTiles and OpenStreetMap data). When the map loads, your browser requests tiles directly from OpenFreeMap, which receives the usual request details such as your IP address and the map area being shown. Attribution appears on the map.
• Vercel hosts the site, delivers every page and file, and keeps the request logs described above.
• Supabase is our database provider (US region). It stores the anonymous daily totals and token hashes described above, on our behalf, and nothing else about you.
• Google AdSense shows the ads. No ads are shown today; the ad spaces are empty. When ads are shown, the Advertising section below applies.

We do not use Google Analytics or any other analytics service. Fonts are served from our own host, not from a font service. If we add a vendor, we will update this policy before it goes live.

Advertising

When ads are shown on Fourth and Miles:

• Third-party vendors, including Google, use cookies to serve ads based on a user’s prior visits to this website or other websites.
• Google’s use of advertising cookies enables it and its partners to serve ads to users based on their visit to this site and/or other sites on the Internet.
• You may opt out of personalised advertising by visiting Google’s Ads Settings. You can also opt out of some third-party vendors’ use of cookies for personalised advertising at aboutads.info or, in Europe, youronlinechoices.eu.
• To learn more, read How Google uses information from sites or apps that use our services.
• Visitors from the EEA, the UK and Switzerland, and residents of US states with privacy laws, see Google’s consent tool (AdSense Privacy & messaging) first. You can reopen it at any time with Privacy choices at the bottom of every page.

Cookies

The game itself does not set cookies; it uses localStorage as described above. When ads are shown, Google and its partners set or read cookies and similar identifiers on your device for ad delivery, frequency capping, fraud prevention, measurement and, where you allow it, personalisation. See the Cookie and Ads Notice for a short summary.

Do Not Track and Global Privacy Control

Browsers can send a “Do Not Track” signal. There is no agreed standard for it, so the game does not change what it does when it sees one. We do honour Global Privacy Control (GPC): once ads run, if your browser sends GPC we treat it as a request to opt out of the sale or sharing of your personal information, and you get non-personalised ads wherever the ad platform supports that. When ads are shown, third parties, including Google, may collect information about your activity over time and across different websites, as described under Advertising.

If you live in a US state with a privacy law

This covers California and the other states with consumer privacy laws. We do not sell your personal information for money. When personalised ads are shown, Google and its partners use cookies and similar identifiers, and some state laws call that “selling” or “sharing” personal information, or “targeted advertising”.

• Do Not Sell or Share My Personal Information. Opt out at any time with Privacy choices at the bottom of every page, or by turning on Global Privacy Control in your browser. After you opt out, the ads you see here will not be based on your browsing elsewhere.
• Your rights. Depending on where you live, you can ask what personal information we hold about you, ask us to correct it or delete it, ask for a copy, opt out of targeted advertising, and appeal if we turn you down. Email hello@fourthandmiles.com with “privacy request” in the subject and the state you live in. We hold almost nothing on our servers, so the answer will usually be short, and we will answer within 45 days.
• No discrimination. Using any of these rights will not change how the game treats you. You still get the same game, for free.

Children

Fourth and Miles is a general-audience game and is not directed at children under 13. We do not knowingly collect personal information from children under 13. If we learn that a child under 13 is using the game, we will stop any personalised advertising to that browser where we can and delete anything they sent us. If you believe a child has given us personal information, contact us and we will help.

If you are in the EU, UK or Switzerland

Cruz Labs LLC is responsible for your information on Fourth and Miles. Here is why each piece is handled:

• Game data in your browser: stored because you asked to play and to keep your results and settings. It stays on your device, apart from the daily-game submission described above.
• Map guesses and host request logs: our legitimate interest in running, scoring, securing and fixing the game.
• Daily totals and token hashes: our legitimate interest in showing every player how the day went, counting each browser once.
• Emails you send: our legitimate interest in answering you.
• Advertising cookies: your consent. Before any ad cookies are used, Google’s consent tool asks you, and you can change your answer at any time with Privacy choices.

You can ask to access, correct or delete your data, to restrict or object to how it is used, or to get a copy, and you can withdraw consent at any time. Write to hello@fourthandmiles.com. You can also complain to your local data protection authority.

Our vendors may process data in the United States. We rely on their own terms for those transfers (for example their standard contractual clauses or Data Privacy Framework certification) and have no further safeguards of our own.

How long things are kept

• localStorage: until you reset the game or clear this site’s data in your browser.
• Map guesses: not kept; the server answers and forgets them.
• Daily totals and token hashes: deleted after 35 days.
• Network-hash counts (anti-flooding): deleted after 2 days.
• Host request logs: for the limited period set by Vercel’s policy.
• Emails: as long as we need to deal with what you wrote, then deleted.
• Advertising cookies: for the periods Google and its partners set.

Security

There are no accounts or passwords to steal. The site is served only over HTTPS, the daily totals can only be written and read by our server, and our host, database provider and map provider run their own security programmes. No system is perfectly secure, but there is very little about you on our side to protect in the first place.

Your choices

• Clear what the game saved: use “Reset today’s game” in the menu, or clear site data for Fourth and Miles in your browser settings. Either removes every fourthandmiles: entry.
• Browser controls: you can block or delete cookies and site data, use private browsing, block third-party cookies or turn on Global Privacy Control in your browser’s settings.
• Ads: use Privacy choices, or opt out of personalised ads at Google’s Ads Settings.

Changes to this policy

If what the game stores or who we work with changes, we will update this page and the date at the top before the change goes live, and add a line to the change log below.

Change log

• October 22, 2026: Added daily standings: finishing the daily game now sends your total and (if you picked one) your school to anonymous daily totals kept with Supabase for 35 days, with a one-way hash of a one-day browser token so each browser counts once. Added Supabase to our service providers and the result-token entry to the localStorage list.
• October 22, 2026: Listed exactly what our server receives and every localStorage entry; added host request logs, Do Not Track and Global Privacy Control, US state rights, EU/UK/Swiss visitors, retention, security and this change log; made the advertising section definite.
• October 21, 2026: First published.

Contact

Email hello@fourthandmiles.com.