Draft awaiting legal review, last updated October 20, 2026. The token store runs in Stripe test mode until this text is final.

Privacy policy

ndt.games is published by NDT LLC. This explains what we keep, why, and for how long. We don't sell personal information, show third-party ads, or use tracking or analytics cookies.

Playing without an account

The games run in your browser and keep nothing about you. Two things touch our server: the word of the day sends your guesses to be checked (nothing is stored), and the daily game sends your answers to be graded (nothing is stored unless you're signed in and the game is ranked). Like any website, our host (Vercel) briefly logs requests, including IP addresses, to run and protect the service.

If you make an account

• Your email address, to sign you in by emailed code and to identify your account.
• Sign-in codes and sessions. Codes are stored only as one-way hashes and deleted after a day. A signed-in browser holds one cookie (`ndtg_session`), which is required for sign-in; its value is stored only as a hash.
• Your ranked results: game, day, score, time and whether you solved it, for the leaderboard and your streak.
• Your leaderboard choice and name. You're not listed unless you choose to be. Other people see only the name you pick and your points — never your email.
• Tokens: a record of each purchase and unlock.

If you buy tokens

Payment is handled by Stripe. We never see or store your card number; we keep the Stripe session id, the amount, the pack and the date, for your token history, refunds and our tax records. Stripe's own privacy policy covers what it collects.

The daily email

If you sign up, we keep your address and when you confirmed it, and send one email a day with a link to that day's game. Every email has a one-click unsubscribe. Addresses that never confirm are deleted after 30 days; the log of which day was sent to whom is deleted after 90.

Anti-spam checks

Sign-in and email sign-up forms may use Cloudflare Turnstile to tell people from bots. It loads only when you start on one of those forms. Throttles keep a short-lived, hashed record of request counts, deleted after a day.

Who processes data for us

Supabase (database), Vercel (hosting), Resend (email delivery), Stripe (payments) and Cloudflare (anti-spam check). Each handles data only to provide its service to us.

Moved from TRACE

The games, their leaderboard and their daily email used to run on tracendt.com, also published by NDT LLC. In October 2026 we moved players' leaderboard names, results and streaks, and confirmed daily-email subscribers, to ndt.games under this policy. Addresses that had not confirmed were not moved.

Your choices

You can unsubscribe from the email in one click, hide yourself from the leaderboard at any time, or ask us to delete your account by emailing contact@ndt.llc from its address. We delete your account, results and email record within 30 days, keeping only purchase records we're required to keep.

Children

ndt.games is for working NDT professionals and students; it isn't directed at children under 13, and we don't knowingly collect their information.

Changes and contact

We'll post changes here with a new date. NDT LLC, 304 S. Jones Blvd # 6256, Las Vegas, NV 89107 · contact@ndt.llc