Privacy

SG Haze at haze.scottreule.com · last changed 28 October 2026

SG Haze keeps as little as it can. No ads, no analytics, no tracking, and nothing is sold or shared for marketing.

On your computer

The game saves your settings, progress, coins, upgrades and race ghosts in your browser's storage on this computer. It stays there until you clear this site's data in your browser (or sign out of an account, which removes the account's progress and ghosts but keeps your settings).

If you make an account (optional)

• What's kept: your username; your PIN as a salted, slow hash (PBKDF2, never the PIN itself); your save (settings, progress, coins, upgrades) and race ghosts; when the account was made and last saved; whether it's a tester account; a count of wrong PINs, so it can lock out guessing; and the device IDs (below) of the browsers you've signed in on, with when each was last seen.
• Where: a database run by Supabase, in Singapore. Only the game's server can read it.
• Deleting it: sign in, open the 👤 button on the menu, choose Delete my account… and enter your PIN. The account, its save and its ghosts are deleted from the database straight away, and can't be brought back.

Device IDs and bans

Each browser that opens the game gets a device ID: a random number in a cookie, made up for this site only. It says nothing about you or your computer (it isn't your hardware, your location or your internet address), and the game can keep a copy of it in the browser's storage. It's only stored on the server if you sign in, linked to your account as above.

If an account is banned for breaking the rules, the device IDs it was used on are listed as banned too, and those browsers can't play anymore. That list keeps just the device IDs, the banned account's name and when; it stays even if the account is deleted, until the ban is lifted.

Cookies

Only the game's own, none for advertising or tracking:

• captcha_verified: you've passed the human check (24 hours).
• sgr_account: you're signed in (1 year, or until you sign out).
• sgr_tester: you entered the tester PIN.
• sgr_device: this browser's device ID (400 days).
• captcha_arrived: plays the short arrival animation once, after the human check (30 seconds).

The human check

"Prove you're human" is a short chat on captcha.scottreule.com. What you type there goes to that service to decide whether you're a person; SG Haze only receives a yes or no.

The game's server

To stop PIN guessing and mass sign-ups, the server counts wrong PINs and new accounts per internet address for up to an hour, in memory only, not in the database. The site is hosted by Vercel, which keeps standard request logs (such as addresses and pages asked for) for a short time.

Services the game asks

• Open-Meteo for the weather, visibility and air quality at the place on screen (a track or an airport), never your own location. The game never asks where you are.
• Amazon S3 (public elevation tiles) for the ground's shape while flying.
• cdnjs (Cloudflare) for the 3D library the game is built on.

Like any website, these see your internet address when your browser asks them for something.