In short
- There are no accounts. We do not ask for your name, email or password.
- The answers you type, your scores, your streak and your settings are saved in your own browser. We never see them.
- When you finish a daily flight we may count your score (not your answers) in an anonymous tally so we can show “you beat N% of flights”.
- The game is free because of ads. You choose whether they are personalised (Accept) or non-personalised with no advertising cookies from us (Reject). Nothing ad-related loads until you choose.
- We host our own fonts, so loading a page does not send your address to a font service.
1. Who is responsible
Thin Air (playthinair.com) is operated by Thin Air, based in the United States (“we”, “us”). We decide how the personal data described here is used, which makes us the “controller” under data protection law such as the UK and EU GDPR. You can reach us at hello@playthinair.com or by post at PO Box 72819, Argyle, TX 76226, United States.
2. What we handle, and why
Most of what the game remembers never reaches us. This table covers everything, including the small amount that does.
| What | Where it goes | Why | Our legal basis | How long |
|---|---|---|---|---|
| Your game progress and settings: daily and Unlimited results (including the answers you typed), streak and stats, sound, extra time, reduced motion, plane livery, whether you have seen the how-to, and your cookie choice | Saved in your browser’s local storage. It does not leave your device and we cannot see it. | To run the game you asked to play: one flight per day, the Archive, your stats, your choices. | No personal data reaches us. Where the law treats this storage as needing a basis, it is strictly necessary for the service you requested. | Until you clear site data for playthinair.com. |
| Score summary: the date, your total, your seven per-prompt scores and whether More time was on (sent only when you finish a daily on its own date) | Our own server (a Cloudflare Worker and database). Only a count per score is stored, with no identifier. Not sent for the Archive. | To show “you beat N% of the flights on this date”. | Legitimate interests (running and improving the game). The data is not linked to you. | Kept as an anonymous tally. |
| Standard request data: your IP address, browser and device type, the page requested, the time | Our host, Cloudflare, in its normal logs | To deliver the site, keep it secure and fix faults | Legitimate interests (security and reliability) | Up to about 7 days for our Worker logs and traces (Cloudflare’s retention); we do not extract or keep it ourselves. |
| Advertising data, only after you make your choice. Personalised ads (Accept) may use advertising cookies and similar technologies; non-personalised ads (Reject) use the page, not your browsing history. | Our advertising partner, Google AdSense, and the partners it works with | To show ads, measure them, prevent fraud and limit repeats | Your consent for personalised ads and advertising cookies, which you can withdraw any time. See section 4. | As set by Google; see its policy. |
| Page views and finished flights (analytics), only if switched on | A privacy-friendly counter service (GoatCounter). No cookies, no stored identifier, no answers. | To know whether anyone is playing | Legitimate interests | Counts only, as set by the service. |
| Messages you email us | Our mailbox | To reply and to fix mistakes | Legitimate interests | Only as long as needed to deal with your message. |
3. Browser storage and cookies
We do not set cookies ourselves. The game uses your browser’s local storage, under keys that begin thinair:v1::
| Item | What it holds |
|---|---|
daily:<date> | The flight you played on that date: prompts, your answers, points and whether it was finished on its own date. |
unlimited:last, unlimited:best | Your last Unlimited round and your best Unlimited score. |
more, sound, reduce | Your settings: extra time, sound, reduced motion. |
livery, livery:seen | Which plane livery you chose and which unlock notices you have seen. |
how:seen | That you have seen the short how-to. |
consent | Your advertising choice and when you made it. |
These are strictly necessary for the game. Clearing your browser’s site data for playthinair.com erases them (and your streak and stats with them). If you choose personalised ads, our advertising partner may also set its own cookies; those are covered in section 4.
4. Advertising and your privacy choices
Thin Air is free and paid for by advertising, so the game always shows ads. What you choose is the kind:
- Accept (personalised ads): Google and its partners may use cookies and similar identifiers to serve ads tailored to your interests, based on your visit to this site and other sites across the internet, and to measure ads, limit repeats and prevent fraud.
- Reject (non-personalised ads): we do not request personalised ads. We ask for non-personalised ads only. In some regions these ads may still use basic cookies solely to limit how often an ad repeats, to produce aggregated reports and to prevent fraud.
- Manage: the same choice as a switch.
- Global Privacy Control: if your browser sends a Global Privacy Control signal, we treat it as Reject, and as an opt-out of targeted advertising and of the “sale” or “sharing” of personal information under US state privacy laws, until you choose otherwise.
Until you choose, no advertising code loads and no ads are shown. You can change your choice at any time with Your privacy choices (in the menu and in every page footer). Ads appear only on the home screen and the results screen, never while you are answering a prompt.
EEA, UK and Switzerland. Google requires a Google-certified consent management platform for visitors in these regions. Until we have installed one, we do not serve Google ads to visitors in the EEA, the UK or Switzerland at all.
Our advertising partner is Google AdSense (applied for; no ads from Google are served until it approves the site). Third-party vendors, including Google, use cookies to serve ads based on a user’s prior visits to this website or other websites. Google’s use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the internet. You can opt out of personalised advertising by visiting Google Ads Settings, or opt out of some third-party vendors’ use of cookies for personalised advertising at aboutads.info. To learn how Google uses information from sites that use its services, see How Google uses information from sites or apps that use our services and policies.google.com/technologies/ads. If we add or change an advertising partner we will list it here first.
5. Score percentiles
When you finish the daily flight on its own date, the game sends your total score, your seven per-prompt scores, the date and whether More time was on to our own server, so it can tell you what share of that day’s flights you beat. It does not send your answers, a name, an account, a device identifier or a cookie. The server uses your IP address only briefly, in memory, to apply a coarse limit against spam, and never writes it to our database. It then adds one to a count for that score, keyed only by the date and the score, and keeps nothing that identifies you. Those counts hold no personal identifiers and are kept as anonymous statistics. As with any request, the host sees your IP address in its normal logs (section 2). Archive flights and Unlimited rounds are never sent. If the service is unavailable the game simply does not show the line.
6. Analytics
If switched on, we count page views and finished flights (daily or Unlimited) so we know whether anyone is playing. There are no cookies and nothing is stored on your device for this, no answer text or player identifier is sent, and nothing is sent at all if your browser signals Do Not Track or Global Privacy Control. The counter is GoatCounter, a privacy-friendly service that sees the page address and, like any server, your IP address, which it does not keep as a profile. At the date above analytics is not yet switched on; if that changes this section stays accurate.
7. Who we share data with
- Cloudflare, our host and network provider, processes request data on our behalf to serve the site and our score tally.
- Google (AdSense), for advertising as described in section 4. For advertising data Google acts under its own policies.
- GoatCounter, only if analytics is switched on.
- Professional advisers and authorities where the law requires it.
We do not sell your personal information for money, and we do not share the answers you type with anyone. We load our fonts from our own server, so no font provider receives your IP address.
8. Transfers outside your country
Cloudflare and Google operate worldwide, so data about your visit may be processed outside the UK or EEA, including in the United States. Where the law requires it, these transfers rely on recognised safeguards such as adequacy decisions, the EU Standard Contractual Clauses or the UK International Data Transfer Addendum.
9. Your rights
If you are in the UK or EEA you may have the right to ask for access to your personal data, to correct it, to have it erased, to restrict or object to its use, to receive it in a portable form, and to withdraw consent at any time (for ads, use Your privacy choices). You can also complain to your data protection authority (in the UK, the Information Commissioner’s Office, ico.org.uk). Because we keep no personal data about you on our servers apart from ordinary host logs, there is usually nothing for us to look up; your local data is yours to clear in your browser.
If you are in California you may have the right to know what personal information we collect and why, to delete or correct it, to opt out of the “sale” or “sharing” of personal information, and not to be treated worse for using these rights. We do not sell personal information for money. Personalised advertising through Google may count as “sharing” for cross-context behavioural advertising under California law; choosing Reject in Your privacy choices (or sending a Global Privacy Control signal) switches to non-personalised ads. The categories involved are identifiers (such as an IP address or cookie id, handled by our host and advertising partner) and internet activity (how you interact with the page and ads).
If you are in Texas, Virginia, Colorado, Connecticut or another US state with a privacy law you may have similar rights to access, correct, delete and opt out of targeted advertising and the sale of personal data. We do not sell personal data for money, and honouring a Global Privacy Control signal and the Reject choice is how you opt out of targeted advertising.
To use any right, email hello@playthinair.com. We may need to confirm it is you before acting and will reply within the time the law allows.
10. Children
Thin Air is intended for a general audience aged 13 and older (16 and older where local data protection law sets a higher age for consent to advertising) and is not directed at children. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it. Ads are not treated as child-directed; parents who want to limit advertising can use the Reject choice and the controls in Google’s Ads Settings.
11. Security
The site is served over HTTPS. Because we hold almost no personal data, there is very little to protect, and the data that is held in your browser is as secure as your device. No system is perfectly secure, and we cannot guarantee that it is.
12. No automated decisions
We do not make decisions about you by automated means that have legal or similarly significant effects. Scores are calculated from fixed lists, not from profiles of you.
13. Changes
If this policy changes in a way that matters (for example when ads go live, a new partner is added, or analytics is switched on), we will update this page and its date. Older versions are available on request.
14. Contact
Questions or requests: hello@playthinair.com, or write to Thin Air, PO Box 72819, Argyle, TX 76226, United States.