Privacy
Last updated 23 October 2026.
Whodunnit is a free hobby game with no ads and nothing for sale. It keeps as little about you as it can.
If you play as a guest
Your progress is kept in your own browser (local storage): the cases you solved, your notebook marks and your light or dark theme. The server records each case you start and solve (time taken, hints, wrong guesses), with no name or account attached, so it can check answers and score them. Unfinished guest cases are deleted after 14 days.
If you make an account
- Email sign-in: your email address is not stored. The game keeps a one-way keyed hash of it, so it can find your account when you sign in, and your password only as a salted scrypt hash.
- Google sign-in: the game keeps only the account number Google gives it, not your name or email. Google's sign-in button is loaded from Google only when you open the sign-in box.
- Your detective name, XP, solved cases and daily streak, which appear on the public leaderboard by detective name.
- A sign-in token in your browser's local storage, valid for 30 days.
When you choose a password, the first five characters of its SHA-1 hash are sent to the free Have I Been Pwned service to check it hasn't appeared in a data breach. The password itself never leaves the game's server.
Everyone
- Analytics: Vercel Web Analytics and Speed Insights count page views and page speed. They use no cookies and don't identify you.
- Abuse limits: to slow down scripts, the server counts requests per connection. The IP address is stored only as a keyed hash and the counts are deleted within a day.
- Error reports: if the game hits an error, a short error message (never your email or password) goes to the server logs so it can be fixed.
- No cookies, no advertising and no selling of data.
Where it's kept
The game runs on Vercel and its database on Supabase.
Questions or deleting your account
Whodunnit is made by Ravi Agarwal. To ask a question or have your account and its data deleted, contact him through his GitHub profile. Signing out clears the sign-in token from your browser; clearing your browser's site data removes guest progress.