The web version

One game, two builds

gridlockescape.com plays the same game as the apps, in any recent browser with WebGL, on a phone or a computer. This post describes how the site is built and what it does and does not do, as of 6 November 2026.

The game is one body of JavaScript modules, with three.js as the only runtime package. It is built twice. One build puts everything into a single file for the Android and iOS shells, which load it offline. The other is this website, with hashed asset files and three.js in a chunk of its own. The web-only layer, which holds the ads, the consent step, the statistics and the sign-in, lives in its own folders and reaches the game through three small hooks. The app build fails if any of that code ends up in it.

Static pages and a Worker

The site is served by a Cloudflare Worker in front of the static build. The game is the page at /. The pages you are reading, from the guide to the news, are plain HTML with a stylesheet and the statistics consent script, and nothing else: no game code and no ads.

The Worker sends www and plain http to https://gridlockescape.com, answers unknown addresses with a 404 page, adds security headers, and tells each page which consent rule applies in the visitor’s country.

Ads only when you ask

The web version has one kind of ad: a rewarded video offered when your hints run out. Watched to the end, it adds 3 hints. Nothing plays by itself, nothing plays between levels, and nothing loads on the content pages.

The video comes from Google’s H5 Games Ads, which needs Google’s approval of our ads account for this site. Until that comes through, the hint card says that no video is available right now, and every level can still be solved without a single hint.

Consent comes first

Where the law asks for consent before ads, in the EEA, the UK and Switzerland, Google’s own consent message appears, and no ad script loads until the visitor has answered. A browser that sends Global Privacy Control gets non-personalised ads.

Statistics follow the same split. We count page views with Google Analytics and Cloudflare Web Analytics. In the regions above nothing loads or is sent until the visitor presses Allow; elsewhere they start with the page, and a small bar says so. Decline stops them at once and deletes Google’s cookies. Besides page views the game reports a short, fixed list of events: a level opened or finished, with its number, tier and stars; a hint spent; a rewarded video ended; a challenge started or solved; a sign-in; an achievement. Anything outside that list is dropped, and none of it is free text or anything about the person.

On 5 November we checked the live site in a fresh headless Chrome as a visitor in an opt-in region. Before Allow nothing loaded. After it, Google’s tag loaded and its collect request was answered, and Cloudflare’s beacon posted.

Signing in without a script

Ranked challenges need a Google sign-in. Instead of loading Google’s script into the game, we send the visitor to Google’s own account chooser, and Google sends them back to a small page on our site that keeps the answer in the tab’s session storage and moves on to the game. We ask for the openid scope only, so Google’s page asks no more than to tell us which account it is.

Signing in also keeps your level progress with the account, so it follows you to another browser. Without it, progress lives in your browser’s local storage, and clearing the site’s data deletes it. The privacy policy lists every key the site keeps.