Draft, pending legal review
This document is a plain-language draft. It has not been reviewed by a lawyer yet and may change before it takes effect.
Embedding Responsibilities
Version embedding-2026-10-23-draft.1 ·
What websites that embed our puzzles must do, in particular about their visitors' consent and privacy.
Who this applies to
These responsibilities apply to anyone who embeds a puzzle from the platform in a website or app (the "embedding site"), whether with our embed script, a plain iframe or embed tokens. They are part of the Terms of Service.
Consent on your site
You are responsible for your own site's privacy notice and consent banner, as the laws that apply to you and your visitors require.
The embedded player uses only essential storage (game progress and the offline cache), which doesn't need consent. It uses an analytics identifier only if your site passes the visitor's consent through the embed script's consent setting. Pass it only when the visitor has actually agreed, and update it when they withdraw.
Mention the embedded player in your privacy notice, for example by linking to our Privacy Policy and Cookie Policy.
Children and schools
If your site is aimed at children under 13, or you embed puzzles for students, don't pass analytics consent unless you hold valid parental or school authorization, and don't collect children's personal data through or around the embed.
Keeping embeds secure and honest
- List only domains you control as allowed embed domains.
- Keep API keys on your server; issue embed tokens from your backend, never from code that runs in the browser.
- Don't cover, alter or imitate the player to mislead players, for example by hiding its notices.
- Events the player sends to your page are informative only, not proof that a puzzle was solved. For prizes or competitions, rely on server-verified completions or webhooks.
Content you embed
Embed only puzzles you own or have permission to embed. Their owner may unpublish them and moderators may take them down; the embed then shows that the puzzle is unavailable. When a new version of a puzzle is saved, players are moved to it automatically.
No advertising or tracking in the player
The player itself never shows advertising and never tracks visitors. You must not inject advertising or tracking into the player, or use it to track visitors across websites.
Changes
Every version of these responsibilities has an identifier, shown at the top of this page. We tell publishers about important changes in advance.