Technical & Privacy Overview for Publishers

CrossEights Daily is added to your page with a single iframe — no scripts on your site, no ads inside the game, and no access to your pages or your readers' data on your site. Here is exactly how it works, written for the editorial, IT and privacy teams who need to sign off.

Can it access my website's data?

No. The browser keeps it walled off. The puzzle runs inside an iframe served from crosseightsdaily.com (or your own puzzle subdomain). The browser's same-origin policy prevents code in the frame from reading your page content, cookies, local storage, form fields, logged-in sessions or anything else on your site.

No scripts run on your page. The embed is plain HTML — one iframe tag. There is no JavaScript tag, SDK or plugin to install, so none of our code ever executes in the context of your domain.

Exactly one message crosses the boundary. The frame sends its own content height to the parent page (a message of the form { type: "cross-eights-resize", height }) so the frame can size itself without scrollbars. That is the only thing it sends, and it never requests or listens for data from your page.

Does it track my readers?

Readers play anonymously. No sign-up, email or real name is needed. A reader gets an anonymous guest identity so their progress and streak can be kept; they may choose a display name for your leaderboard, and may optionally create a free account.

What we collect, and why. Game activity needed to run the puzzle and your leaderboard: scores, solve times, hints used and puzzle progress. To keep the game secure and produce your aggregate stats we also record basic technical information such as browser and device type, a coarse location and the IP address.

What we use for analytics. Google Analytics measures aggregate usage of the game so we can improve it. We use no advertising pixels, retargeting tags or data brokers, we do not track readers across other websites, and we never sell player information.

What you receive. Your private stats page shows aggregate figures only — visits, games, completions, players and return rate. Individual reader data is never shared with publishers; the only per-player information visible is the display name and score a reader chooses to show on your public leaderboard.

Retention. Data is kept only as long as reasonably needed to run the game, keep leaderboards and history, and protect against abuse, as described in our Privacy Policy. Readers can ask us to access or delete their information.

Does it display ads?

Never inside the puzzle. There are no banners, video, interstitials, sponsored units or affiliate links in the frame, and no third-party advertising technology.

Your page's advertising stays yours. You may run your own ads above, beside or below the frame and keep all of that revenue. We only ask that nothing is overlaid on the frame itself.

Does it send readers elsewhere?

Readers stay on your page. Play, hints, results and your leaderboard all happen inside the frame. The embed never redirects or replaces your page, and publisher editions carry no prompts to visit our own sites.

Only a small credit and the house documents. A one-line footer reads "Powered by CrossEights" with Privacy and Terms links; those documents open as pop-ups inside the frame so readers keep their place. When a reader shares a result, the shared message links back to your edition.

Is the integration restricted?

Locked to your domains. Each edition runs only on the website you registered and its subdomains (plus any extra domains you ask us to add). If someone copies your embed onto another site, it shows a "not available on this site" notice instead of the game.

HTTPS only. The game and all of its data connections are served over encrypted HTTPS.

Minimal permissions. The standard snippet asks for a single permission, clipboard-write, so readers can copy their result to share. It requests no camera, microphone, location, payment or pop-up permissions.

Content Security Policy friendly. If your site uses a Content Security Policy, add one frame-src entry for https://crosseightsdaily.com (or your puzzle subdomain). No script-src changes are needed.

Will it slow down my page?

Loads only when it's needed. The snippet uses loading="lazy", so the game loads as readers scroll toward it and stays out of your initial page load.

Runs separately from your page. The game's work happens inside its own frame rather than in your page's code, and the reserved height keeps your layout from jumping as it loads.

Failures stay contained. If our service were ever unreachable, the frame would simply show nothing or an error — your article and the rest of your page keep working normally.

Why offer a puzzle subdomain?

Better memory in Safari and Firefox. Those browsers limit storage for frames served from another domain, so some readers may have to re-enter their name or lose a streak. Pointing one DNS record (for example puzzle.yourdomain.com) at our host makes the puzzle first-party to your site. It is optional, adds no code to your pages, and doesn't change what data is collected.

What happens if I remove it?

Delete the iframe and you're done. Because nothing was installed on your site, removing the iframe tag removes the puzzle completely. No code, cookies or tags are left behind on your domain. You can also ask us to switch your edition off.

Player data. Readers' scores and history stay in their CrossEights records under our Privacy Policy, so they are not lost if you return later, and readers can still request deletion. Access to your stats page may end. To have your edition's records removed, email support@crosseights.com.

See also the Privacy Policy, publisher terms and setup guide.