Crush all resistance on the gameboard 👊
Top 0 suggestions
Privacy Policy
Last updated: 2026-08-07
This page exists because my ex-wife, who is a lawyer, once told me "even your pathetic little hobby site has legal obligations. Is there any part of functioning in modern society that you actually understand? I am getting tired of trying to raise a grown man." So here it is.
1. What We Collect
Practically nothing. We don't collect your name, email, or phone number. We don't track your browsing history. We don't ask for or know your mother's maiden name. If we did, we'd care so little what it was we'd soon forget it anyway.
What does happen: when you submit a search, your input (a string of characters) is sent to our Rust solver via an AJAX POST request. It lives in RAM for approximately 5–20 milliseconds, produces a result, and then basically disappears. No data leaves our server except the results of your search to your browser.
2. Session Cookies
PHP runs session_start() so we can generate a CSRF token and keep things vaguely secure. This creates a session cookie that expires when you close your browser. It contains a random 64-character hex string — not your name, not your secrets, just proof that you're the same person who opened the page 30 seconds ago. When you close the tab, it's gone. Poof. Just like people's attention spans these days.
3. Preference Cookies
We set a handful of cookies (tilebot_dict, tilebot_game, tilebot_digraph, tilebot_superfast) so you don't have to re-select your dictionary and game every time you visit. They expire in one year. They contain things like "en", "scrabble", or "true". Truly uninteresting information. If your partner reads them over your shoulder, they'll learn nothing more scandalous than that you play Scrabble in English.
4. Server Logs
Like most web servers, ours generates access logs containing IP addresses (technically personal data in Europe, even if we couldn't care less who you are), timestamps, requested URLs, and status codes. They are overwritten after 14 days via logrotate. We process these briefly under our legitimate interest to defend against DDoS attacks and investigate errors. We don't sell them, analyze them, or even look at them unless something is actually wrong.
5. Third Parties
We don't use Google Analytics. We don't use Facebook Pixel. We don't use any JavaScript library that phones home to a server in some other location. The only thing leaving this page is your AJAX request to our solver and the occasional image loading from our own server. Tilebot has no third-party data sharing because we don't like to share, and that's probably why Tilebot has no friends. So we have no desire to share nor friends to share anything with. Consider our lack of friends a big win for your privacy.
6. Data Retention
My ex-wife taught me two things: never let your guard down, and never keep logs for too long because everything can and will be used against you. The solver dumps temporary traces to syslog—but the journal purges itself every three days. The Apache logs are deleted after 14 days via logrotate. We retain zero long-term evidence, and if subpoenaed, we will deny this website ever existed.
7. Your Rights
Under GDPR, CCPA, or whatever combination of capital letters your local bureaucrats came up with, you have the right to access, correct, delete, or port your data. Since we store essentially nothing, exercising these rights is like trying to divide my remaining assets in court—there is literally nothing there. If you email us to exercise these rights, we will reply within 30 days to confirm that we have zero data on you and that there was nothing to delete in the first place.
8. Children
If you're under 13 (or the equivalent in your country), you probably don't play Scrabble anyway. But if you're here: we still don't know who you are, so you're safe. We don't collect data from anyone, regardless of age or emotional maturity. Tell your parents to use this tool to beat you at Wordfeud. It will teach you a valuable lesson.
9. Security
We use HTTPS, HSTS, strict Content Security Policy headers, CSRF tokens, and HttpOnly cookies. This means your browser talks to us encrypted, random nonces prevent script injection, and no JavaScript can steal your session cookie. In other words: we tried. Harder than most sites do.
10. Jurisdiction
Tilebot is operated from Norway. Under GDPR, we process your non-existent data under the legal basis of 'legitimate interest'—specifically, the legitimate interest of ensuring no court or ex-partner ever has a valid reason to contact me ever again.
11. Changes to This Policy
If we update this policy, we'll change the date at the top. We'd email you a notification, but as established in Section 1, we don't have your email address. We have no idea who you are. So our advice is to just drop by every couple of days to check.
12. Contact
Reach us at [email protected] for privacy inquiries. If you're writing to complain about the dictionary, please don't. My ex-wife already took everything I own in the breakup, even though she had way more than I did to begin with.