Privacy

Bypass has no accounts, no ads and no cookies, and doesn't sell or share anything about you.

On your device

Your progress, streak, stats and settings are kept in your browser's local storage. They never leave your device unless you use one of the online features below. Clearing this site's data in your browser removes them.

When you finish a daily or made board

So the game can show how everyone did, and so we can see how Bypass is doing, it sends your finished tests to the server, which checks them and stores:

• a random ID your browser made up (it isn't linked to your name, email or any account),
• the board, your best cost, how many tests you took, how many hints you used, and your time,
• roughly where you are: the country, state or region, and city that our host, Vercel, reports for your connection. Vercel works this out from your internet address; the address itself isn't stored,
• the hour of the day it was where you are, and whether you played on a phone, tablet or computer and which system (like iOS or Windows),
• the name of the site that first linked you to Bypass (like reddit.com), if your browser shared it on your first visit.

Sync, only if you turn it on

Sync keeps your progress on all your devices without an account, an email or a password. When you turn it on, the server stores a random ID for your progress, a copy of your saved boards and a few settings (colorblind mode, the clock, the name for challenges), and for each linked device a label like "iPhone · Safari" and when it last synced. Each device holds its own secret key; the server keeps only a scrambled form of it, and of your recovery code. Turn Sync off on a device, or delete everything it keeps, from the Sync window; your devices keep their own copies. Synced progress unused for 2 years is deleted.

Challenge links and made boards

If you make a challenge link or share a board you made, the server stores that board or your result, plus the name you typed, if any. Anyone with the link can see them.

Limits and analytics

• To stop abuse, the server keeps a scrambled, keyed hash of your internet address for about a day. It can't be turned back into your address.
• Page visits are counted with Vercel Web Analytics, which doesn't use cookies and reports only totals.
• Only the person who runs Bypass sees the stored details, as totals on a private dashboard (how many players per country, per day, and so on).
• Fonts are served from this site, not from a third party.

Who runs the servers

The site is hosted on Vercel and the online features use a Supabase database.

Last updated October 9, 2026.