Privacy Policy

How optional accounts, leaderboards, recent activity and cookies work on Solitaire-Online.com.

About this policy

This policy covers Solitaire-Online.com, its games, guides, optional accounts and leaderboards. Contact the site operator with privacy questions.

Optional player accounts

You can play without an account. If you register, we store your email address, public display name, selected avatar, creation time and email-verification status. Email passwords are stored as salted scrypt hashes, not readable passwords. Google sign-in stores your Google account identifier and verified email; we do not receive your Google password. Google sign-in and email registration are available only when enabled.

We use this information to sign you in, maintain your leaderboard identity, deliver verification and password-reset emails, and protect accounts. Your email is not shown on the leaderboard. Email delivery uses Resend, which receives the destination email address and message content to send verification and password-reset links; Google processes requests when you use its sign-in service.

Game saves in your browser

Multiplayer tables

Match summaries are retained separately after rooms expire: game and variant, start and finish times, scores, outcomes, and whether computers participated. If you are signed in before joining, we associate your seat with your account to provide private match history and public per-game win/loss leaderboards under your current display name. Unfinished games are tracked separately. Deleting your account removes this association and its leaderboard entries; anonymous match summaries remain. Guest summaries are not linked by display name. Tracking applies to new matches from 17 September 2026 onward.

Online and computer multiplayer games are processed on our server. We store room codes, display names, game positions, results, last connection times and a hashed browser identifier to reconnect players and validate moves. Rooms are deleted after 24 hours without activity. Display names and available seats appear publicly for public tables; private tables require an invite. Only participants receive a game view, and hidden cards are not sent to opponents. Multiplayer does not use your account email.

The essential __Host-sol_multiplayer and __Host-sol_cardroom cookies last up to seven days and are Secure, HttpOnly and same-site. Your display name, character and last room are also saved in localStorage under mp-name, mp-room and cr-* keys. Clearing these does not immediately remove room records; the inactivity limit still applies. Contact us with your room code for deletion requests.

Single-player saves

Game positions, statistics, preferences, daily challenge results and achievements are saved in localStorage. These saves remain on the same browser and device, even when you have an account. Accounts do not currently synchronize game boards or achievements. Clearing site data removes local saves.

The guest leaderboard uses sol_lb_token and sol_lb_name in localStorage. The token is sent when you fetch, submit or remove your guest entries. A submitted result includes its game, difficulty, challenge date, time, moves and score. Game saves are not uploaded automatically.

Public submitted results

When you press Save in the daily challenge panel, your display name and result are stored on our server and shown publicly. Signed-in submissions belong to your account; guest submissions belong to your browser token. We keep the best result per player, game, difficulty and challenge day until removed.

The daily panel's Remove my entry action removes all results for the current account or guest identity. Deleting your account removes its scores, but not earlier guest entries or local saves. Guest identities cannot be recovered after their browser token is lost.

Player counts

While a supported page is visible and you have been active recently, the browser sends an activity heartbeat about every 30 seconds. We keep a hashed random visitor identifier, the current game-page identifier, a timestamp and, when signed in, your account ID. Public counts show recent activity, not a list of visitors. Signed-in devices are grouped as one account. Hidden or idle pages stop sending heartbeats.

Activity contributes to the player count for 24 hours after the latest heartbeat. Expired activity rows are removed by a cleanup task that runs every minute.

Cookies and consent

Essential first-party cookies support optional sign-in and the live activity feature: __Host-sol_session (up to 30 days), __Host-sol_visitor (up to one day), and __Host-sol_google_nonce (up to ten minutes during Google sign-in). They are secure, HttpOnly, same-site cookies. Signing out clears the current session.

Analytics

This site uses Google Analytics and has a cookie banner with Accept and Reject choices. Analytics and advertising storage consent defaults to denied unless you accept. Your choice is saved as sol_consent. Essential account and activity functions operate independently of analytics consent.

Advertising

The site may display advertising. Advertising storage consent is controlled through the same cookie banner. Third-party services also process network information under their own policies. See Google's Privacy Policy.

Game pages also offer embedded YouTube tutorials. Sidebar videos connect to YouTube after you accept optional content or press Play video, and start muted. These embeds use youtube-nocookie.com; when loaded, YouTube receives connection information such as your IP address and the referring site. YouTube playback is governed by Google's privacy policy.

Optional support payments

If you choose to support this site when donations are enabled, the coffee button opens a Stripe-hosted checkout page. Stripe processes the payment information entered there; our game servers do not receive your card number. The support buttons do not contact Stripe until you click through.

Hosting and security

Our hosting service and Cloudflare process network requests, including IP addresses and request metadata, to deliver and protect the site. The API uses an address-based rate limiter; IP addresses are not stored in leaderboard or account rows. Public results are checked for plausible values, not verified by replaying a game.

Retention and deletion

Accounts and submitted results remain until deleted. Unverified registrations are removed after seven days. Verification links expire after 24 hours; password-reset links after one hour. Used tokens are removed, and expired tokens and sessions are cleaned up periodically. Resetting a password revokes existing account sessions.

Your choices

You can play without signing in, remove submitted results, sign out, or delete your account and its scores from your account page. Browser settings let you clear local data and cookies. For access, correction or deletion requests you cannot complete yourself, contact us.

Children

Accounts are optional. Please do not publish your real name or other personal information as a display name. A parent or guardian can contact us about an account or submitted information that should be removed.

Account security

We use password hashing, expiring one-use email links, server-side sessions, origin checks and rate limits. Keep your password and verification links private. No online service can promise absolute security.

Policy updates

Updated September 14, 2026 to identify Resend as the account email delivery provider.

Contact

Send privacy questions through our contact page.

Game ratings and private feedback

When you submit a game rating, we store your star rating, name or nickname, optional comment and submission time. Names and comments are private feedback for our team and are not published or included in search-engine review markup. Only the average rating and number of ratings are public.

A secure, HttpOnly cookie (__Host-sol_rating, up to 400 days) identifies your browser so one browser has one rating per game. We store a hash of that random identifier, not your IP address, with the rating. Ratings are separate from accounts and remain until removed. Clearing cookies does not delete server records. For access, correction or deletion, contact us and retain your rating cookie so we can identify your submission.