Last updated: 9 August 2026
The short version. WAN Show Bingo is a free fan-made bingo game. You can play all of it without an account. If you choose to sign in, we ask Discord for your username and picture — that’s it. We never receive your email address, we can’t read your messages, there are no adverts and no ad tracking, and we never write your IP address down.
This page describes what the site actually does today, in plain English. If something here doesn’t match what you find, tell us and we’ll fix the page or the site, whichever is wrong.
This is the part we care most about, so it goes first. None of the following exists anywhere in our systems:
The game works completely without signing in. There is no wall, no nag, and no reduced version.
When you play signed out, your card and the squares you’ve tapped are generated and kept
in your own browser, using the browser’s local storage (the entries are named
bingoCard and clickedTiles). They are never sent to us and we cannot read them.
Clearing your browser data clears them.
The only thing we know about a signed-out visitor is that one anonymous viewer was connected — see visitor numbers below.
↑ Back to topDiscord sign-in is the only way to get an account here, and it is entirely optional.
Exactly one permission, called identify. Nothing else — in particular never
email. Discord shows you the full list on its own screen before you agree to anything.
The identify permission hands back more than we want, so we take three fields and
drop the rest on the floor:
Signing in produces a temporary access token. We use it once, immediately, to read those three fields, and then we ask Discord to cancel it. It is never stored anywhere.
Separately from your sign-in, our own bot asks our own Discord server one question about you: are you a member, and if so, when did you join, what is your nickname there, and which roles do you have? That’s how the site can say “in the community since March 2023” and show staff badges. It only ever looks at our own server, and it asks at most once every six hours. If Discord is unreachable, nothing changes and your sign-in carries on regardless.
↑ Back to topThis is the complete list of what your account record holds. There is nothing else in it.
| What | Why it’s there |
|---|---|
| Discord user ID | The one thing that identifies your account to us. |
| Discord username | A display cache, overwritten every time you sign in. |
| Avatar reference code | So your browser can load your current picture from Discord. Not the image. |
| Display name you chose | Optional. Lets you appear on a leaderboard without showing your Discord handle. |
| Show my avatar (on/off) | Your choice about whether your picture appears on the site. |
| Hide the Discord invite (on/off) | Set when you dismiss the “join our Discord” card for good. |
| First seen / last signed in | How long you’ve been playing, and keeping the account list tidy. |
| Session version | A counter. Bumping it signs you out everywhere — used when you ask, or on a ban. |
| Banned (yes/no) | Whether an admin has blocked the account. |
| In our Discord, join date, nickname, roles, last checked | Community tenure and staff badges — our server only. |
Alongside that, playing signed in creates game records: the cards you were dealt (which squares, and when) and the lines you won (which line, when, and whether an admin later voided it). Wins are worked out by the server from squares an admin confirms live, which is what makes the leaderboard trustworthy.
We count how many people are playing along, because knowing whether twenty or two thousand people are on the site during a show is genuinely useful. This section is about our own counting, which runs on our own server and is deliberately built so it can’t identify anybody. (Cloudflare separately counts page views — that one is covered in section 7.)
Four sets of numbers are kept:
The visitor hash. It is made from your IP address and browser user-agent string, run through a keyed one-way hash. The key is derived fresh each day, so the same visitor gets a different hash tomorrow, and nothing can be traced from one day to the next or turned back into an address. Your raw IP address is never part of what gets saved.
↑ Back to topBrowsing the site signed out sets no cookies from us at all. These are the only ones we ever set, and every one of them exists to make a sign-in work:
| Name | What it’s for | Lifetime |
|---|---|---|
wsb_player |
Your sign-in on wanshow.bingo. A signed token containing only your Discord ID and a session counter — no name, no picture, nothing that leaks if it’s read. | 30 days, or until you sign out |
wsb_oauth |
Holds the one-time security values for the trip out to Discord and back. It is what stops somebody forging a sign-in. Deleted the moment you return. | 10 minutes, path /auth |
wsb_admin |
Staff only, and only on admin.wanshow.bingo. Signs an administrator into the staff panel.
Players never receive it. (A matching short-lived wsb_admin_oauth covers the
staff sign-in round trip.) |
12 hours |
All of them are HTTP-only (JavaScript on the page cannot read them), sent only over HTTPS, and marked so they aren’t sent along with requests from other sites.
We set no advertising cookies and no cross-site tracking cookies. There is no cookie banner here because there is nothing to ask you to consent to.
Separately, the game keeps your card and tapped squares in your browser’s local storage
(bingoCard, clickedTiles). That is not a cookie, is never sent to us,
and clearing your browser data removes it.
A browser cannot fetch a file from another company without revealing your IP address and browser details to whoever serves it. That is true even when the company involved has no interest in tracking you. So we have removed almost all of them.
The fonts, icons and JavaScript libraries this site uses were, until recently, loaded from Google, Cloudflare’s cdnjs, jsDelivr and unpkg. They are now served from our own server instead, so visiting these pages no longer tells any of those companies that you were here. That is the whole reason we did it.
What genuinely remains:
| Who | What it serves | Where |
|---|---|---|
| Cloudflare | Sits in front of the whole domain, handling HTTPS and blocking attacks. All traffic passes through it, so it necessarily sees your IP address. | Everywhere |
| Cloudflare Web Analytics (static.cloudflareinsights.com) | A small page-view and page-speed counter that Cloudflare adds to our pages automatically. It tells us how many people visited and how fast pages loaded. It sets no cookies, and we get only totals from it — never a list of people. | Every page |
| Discord (cdn.discordapp.com, media.discordapp.net) | Profile pictures — your own if you’ve chosen to show it, and contributors’ pictures on the credits pages. Discord hosts these; we never copy them. | Wherever an avatar appears |
| Floatplane (pbs.floatplane.com) | A still from the show, used as the background of the main game page. | The main game page |
Each of those handles the request under its own privacy policy, which we don’t control — Cloudflare’s is here. The Floatplane background is the last easily-removable one, and we intend to serve it ourselves too.
Two clarifications: cdn.wanshow.bingo and
socket.wanshow.bingo are ours — the same server, not a third
party. And the WAN Show countdown is fetched by our server and cached, so your browser
never contacts whenplane.com.
| What | Kept for |
|---|---|
| Your account record and game history | Until you ask us to delete it (see below). We don’t expire accounts. |
| Per-visitor daily hashes | 90 days, then deleted automatically. |
| Minute-by-minute viewer samples | 400 days, then deleted automatically. Counts only. |
| Daily and per-episode totals | Kept indefinitely. These are aggregate numbers with no person in them. |
| Your sign-in cookie | 30 days, or until you sign out. |
The 90 and 400 day figures are the values the service is actually running with. If we change them, we’ll change this page.
↑ Back to topThe player list lives in a staff panel on a separate address, behind its own sign-in. Being an admin is not enough on its own: viewing player records requires a specific permission that an owner has to grant, and most staff don’t have it.
Someone who does hold it sees: your display name, your Discord username and nickname, your roles in our Discord, whether you’re banned, how many cards and wins you have, and your first-seen and last-sign-in dates. They can ban an account or delete it.
The visitor numbers in section 5 are behind that same permission — an ordinary admin loading the staff dashboard gets the service health and square counts, and the viewer statistics are simply withheld. In practice that data stays with the site owner.
We do not sell your information, and we do not share it with anyone for marketing. Nothing about you is passed to another company except the unavoidable technical requests described in section 7.
↑ Back to topThis site isn’t aimed at young children, and accounts require a Discord account, which Discord itself requires you to be at least 13 to hold (older in some countries). We don’t knowingly keep information about children. If you believe a child’s account exists here, email us and we’ll delete it.
↑ Back to topThe site is actively being built, so this page will change. When it does, the date at the top changes with it. If something significant changes — a new kind of data, or a new company in section 7 — we’ll say so in our Discord rather than quietly editing the page.
↑ Back to topPrivacy questions, deletion requests, or a correction to this page: admin@wanshow.bingo
WAN Show Bingo is a hobby project run by fans, not a company with a legal department. This page is a plain description of what the site does; it isn’t legal advice, and we’re not going to claim certification under any particular privacy law. What we can tell you is what we actually do: collect as little as possible, never collect the sensitive things at all, delete on request, and answer honestly when asked.
↑ Back to top