Privacy

• You can play without an account, and without giving a name or an address.
• A ceph you load yourself never leaves your browser. There is no route on this service that accepts one.
• There are no ads, no trackers and no analytics of any kind.
• An email address is optional, is used only to sign you in, and is never shown to anyone or sold to anyone.
• You can delete everything from Profile, in one action.

The first time you place a point, Sella creates an anonymous identity and stores it in one cookie in this browser. The cookie is HttpOnly, is scoped to this site, and lasts thirty days from your last visit. It carries no name, no address and no advertising identifier — it is a key to a row, and the row is the reason your score is still there tomorrow.

Attached to that identity, Sella stores:

• Every placement: which ceph and which landmark, the coordinates you put the point at, how far off it was, the score, and the server’s own timestamps.
• A little about how the placement was made: the zoom at the moment you confirmed, and, once per block, a short description of the device (screen size, pixel ratio, pointer type, time zone). It is there because a placement made on a phone at arm’s length is not the same evidence as one made on a monitor.
• The totals built from those: your streak, your per-landmark record, and your Daily results.
• The settings you choose here — difficulty, sound, motion, and the rest.
• A keyed hash of your IP address, kept on the attempt so abuse can be rate limited. The key rotates every day, the hash cannot be turned back into an address, and the address itself is never written down.

Your session record also carries the browser’s user-agent string, which the sign-in library writes. It goes when the session does.

An account is one email address. You type it, Sella sends a sign-in link to it, and following that link attaches the history already in this browser to the address so it survives a new phone or a cleared cache. There is no password.

The address is stored to sign you in and for nothing else. There is no mailing list to be on: the sign-in link is the only email this product sends. A leaderboard never prints it — boards show a username you choose, or a generated handle if you would rather not be named at all.

Trace your own runs entirely inside your browser. The image is decoded on your own machine, kept in this browser’s own storage so you can pick the tracing up again, and never sent anywhere. No request from that page carries the image or a point placed on it.

This is a property of the code, not a promise about our intentions: there is no route on this service that accepts image bytes, and the page’s content policy gives the browser nowhere to send them. “Forget this ceph” deletes the stored copy; clearing the browser’s site data does too.

Sella is not a medical record system and must not be used as one. Do not use it for anything you would call patient care.

• No advertising, no ad networks, no cross-site identifiers.
• No analytics or product-usage trackers. There is no third-party script in the page at all.
• No error reporting today. The code to send a crash report to a reporting service exists, and no service is configured on the running deployment, so nothing is sent. If one is ever switched on, this page changes with it.
• No patient data. The cephs Sella deals you come from a public research set.

One cookie, for the session described above. It is strictly necessary: without it Sella cannot tell your run from somebody else’s, and there is nothing to consent to because there is nothing else in it. No cookie on this site is used for advertising or measurement.

Your preferences are kept in this browser’s own local storage rather than in a cookie, and never leave the device except as the settings on your account.

Three companies, each doing one job. None of them is given anything to use for their own purposes.

Sella does not sell data and has nothing to sell. Nothing is shared with anyone else except where the law requires it.

The first four are swept automatically by a job that runs on a schedule, not by hand.

Profile has a delete control. It removes the account, the email address, the handle, every attempt and every placement, in one transaction. It cannot be undone and there is no copy kept afterwards. You will be asked to have signed in within the last fifteen minutes first, which is the only thing standing between somebody else’s hands on your unlocked laptop and your whole record.

If you never added an email, clearing this browser’s data removes your only way back to the guest record, and the record ages out on the schedule above. If you would rather it went now, write to us and say so.

Sella is made for dental students, orthodontic residents and orthodontists, and is not directed at children. It does not knowingly collect anything from a child under 13. If you believe a child has given us an address, write to us and we will delete it.

Depending on where you live, you may have the right to ask what is held about you, to have it corrected, to have it deleted, or to have a copy of it. Deletion is built into the product; for anything else, ask and we will answer.

If this page changes in a way that matters, the date at the top changes with it. What is written here is the deployment as it stands, not a plan for one.

hello@playsella.com. It is the same mailbox the sign-in link comes from, and it is read.

Where the cephs come from and how a millimeter is defined is on About. What Sella can and cannot do for assistive technology is on Accessibility.