Privacy

Last updated 10 October 2026

Who we are

Stop the Bus (stopthebus.app) is run by Craig Bennett, in Scotland, UK, who is the data controller for the personal data on this page. You can reach us at [email protected].

What we collect

When you play as a guest

• The nickname you choose, or the one we make up for you.
• An account ID and a sign-in token, so you can come back to your game.

When you create an account

• Your email address and nickname.
• Your password, stored only as a secure hash. We can't read it, and we never see it.

When you play

• Your games: the letter, the categories, your answers and scores, who you played with, and when. Your Daily Letter results.
• Your game settings: categories, exclusions, difficulty, timer and any category sets you build.
• If you leave a game partway through, a record that you left it.

When you report an answer

• The report: the reason you picked and any note you write.
• A copy of that category's row from the game (each player's nickname and answer) so we can check the report.

Technical information

• Your IP address reaches our servers, and our hosting providers', with every request. We use it briefly to limit repeated sign-in attempts and don't store it ourselves; our providers may keep it in their logs for a short time.
• Our server logs record account IDs (never names, emails or passwords) when you sign in or create an account, to keep the service working and secure.

Usage statistics

• When you first play: where you came from (the name of the site that linked you, such as a search engine, but not what you searched for), the page you arrived on, any campaign tags in the link, and your country, which our web host works out from your connection. We never store your IP address.
• What happens in your games: games started and finished, the mode, your score and place, Daily Letter plays, rematches, leaving early, and the reasons you pick when reporting an answer. These are linked to your account ID, never your name, email, answers or notes.
• Visits to the website, counted without cookies or anything stored on your device. Our analytics provider recognises a returning visitor for one day only, using a code made from your connection that changes every day. If your browser asks sites not to track it, visits aren't counted at all.

Why we use it

• To run the game and your account.We need this to provide the service you've asked for.
• To keep it secure and fair, for example by limiting repeated sign-in attempts. This is in our legitimate interests, and yours.
• To fix and improve the word lists using the reports players send. This is in our legitimate interests.
• To understand how people find and play the game, so we can make it better. This is in our legitimate interests, and you can switch it off at any time (see your rights).

We don't use your data for advertising, we don't build a profile of you, and we don't sell or share it with anyone for marketing.

Cookies and storage on your device

No tracking or advertising cookies. The game keeps only what it needs to work, so none of this needs your consent:

• stb_refreshCookie (secure, not readable by page scripts)Keeps you signed in. It lasts up to 30 days and is renewed while you play.
• stb_has_sessionLocal storageRemembers that you're signed in, so the page opens straight into the game.
• stb_soundLocal storageYour sound on/off setting.
• stb_round_draft:…Session storageYour answers while a round is being played, so a reload doesn't lose them. Gone when you close the tab.
• stb_daily_finishingSession storageMarks a Daily Letter you've just finished while it's being scored.

Our usage statistics don't use cookies or store anything on your device. Our fonts are served from our own site, not from Google.

Who else sees it

Other players see your nickname and your answers in games you play together. Otherwise, we use a few providers to run the site, and they handle data only on our behalf:

• Railway runs the game server and database, in the EU (the Netherlands).
• Vercel serves the website.
• Cloudflare runs our domain name and our support email address.
• PostHog processes our usage statistics, in the EU.

Vercel and Cloudflare are US companies with servers around the world, so some data, like your IP address, may be handled outside the UK. When it is, it's protected by the safeguards UK law requires for international transfers. We'd only share data with anyone else if the law required it.

How long we keep it

• Guest accountsare deleted, with their games, 30 days after their last game or visit. The exception is a guest who played with someone who has an account: those games are kept so the other player's history stays correct.
• Accountsare kept until you ask us to delete them. We plan to remove accounts that haven't been used for two years, after emailing a warning first.
• Deleting an account deletes its games too, including games you played with other people, which also disappear from their history.
• Reports are kept to look after the word lists. If your account is deleted, the report no longer links to you, but the copy of the game row (with nicknames) stays with it.
• Sign-in tokens expire after 30 days.
• Usage statistics are kept by PostHog for up to a year. Where you came from is stored with your account and deleted with it.

Your rights

Under UK data protection law you can ask to see the data we hold about you, to correct it, to delete it, or to have a copy to take elsewhere, and you can object to how we use it. You can change your nickname and password yourself on the account screen, and switch off Share usage stats there to stop your usage statistics being collected from then on. For anything else, including deleting statistics already collected, email [email protected]and we'll reply within a month.

If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk. We'd appreciate the chance to put it right first.

Children

Stop the Bus is for players aged 13 and over. If you're under 13, please only play with a parent or guardian's permission, and don't create an account. If you think a child under 13 has given us their email address, contact us and we'll delete it.

Changes to this policy

If we change what we collect or how we use it, we'll update this page and the date at the top. Our terms cover the rules for using the game.