Privacy notice

Optional analytics

Optional analytics is off in this browser. You can play every mode either way.

If you allow it, we collect page visits, activity within a visit, and performance and error reports to improve the game. New browser activity is not linked to your account or email. This also enables Vercel Web Analytics and Speed Insights.

Your choice lasts six months in this browser. Changing it refreshes this page and applies to your other open tabs. Security logs, account actions and reports you submit are still processed to provide those services.

Information used

• Optional account: email address, account ID, username, verification/sign-in timestamps and authentication session data.
• Player data: XP, game and answer history, favourites, public username and leaderboard results. Ranked play also keeps a private server transcript of the session, questions, answers, scoring and hints so results can be verified.
• Game news: marketing is disabled for the initial launch. Historical preference records may remain with the account, but pending choices will not be converted into subscriptions. Any future marketing will require double opt-in.
• Optional usage and performance: Only after you choose to allow analytics, we collect page/route, event names, map or game context, referrer/campaign, coarse device/browser data and Web Vitals. Location-search analytics includes the search type, coarse resolved area/country, approximate coordinates rounded to roughly 11 km, and the playable map IDs shown; raw search text, postcodes, addresses and precise device coordinates are not stored. Product-session analytics can also include an ephemeral per-tab ID, game-attempt IDs, recorded gameplay actions, viewport, language, timezone and estimated active playing time. New browser activity is not linked to account IDs or emails. Older linked analytics remains subject to account export/deletion and the retention period below. Short-lived session IDs connect activity within a visit.
• Feedback and map requests: if you choose to submit feedback, a bug report or a map request, the category and exact text you enter are stored in a private review inbox. You can optionally include a contact email for follow-up and the map, mode, map version and approximate screen size. Each report has a reference. Report contents and contact email are not copied to product analytics. A signed-in submission can be associated with your account; a guest submission is not given a persistent player identity. Abuse protection uses a daily-rotating keyed hash of the network address and short-lived counters and duplicate references; raw addresses are not stored in these application tables.
• Reliability: controlled error category, affected application area, release, recovery state and a short sanitized technical summary or application stack frame. Email addresses, tokens, passwords, query strings, form values, page contents and raw request bodies are removed or not collected.
• Requests and security: hosting/provider logs may contain IP address, user agent, path, time and status. Account export/deletion audit records contain the action, result, time and coarse context. A failed deletion also creates a private retry record with the account ID, attempt count, bounded failure code and retry times—not passwords or exported contents.
• Local browser data: welcome dismissal, practice streaks, your optional analytics choice for six months, and a per-tab analytics ID only when analytics is allowed. Development-only local accounts are disabled in production unless explicitly configured.

Why it is used

Information is used to provide requested account and game features, secure the service, remember progress, publish verified leaderboard results, handle privacy requests, prevent abuse, and understand aggregate use and reliability. Where applicable law requires a lawful basis, account/game processing is used to provide the service you request, security processing protects the service, optional analytics relies on your browser choice, and any future marketing will rely on your separately confirmed consent.

Public information

Only your username, XP/level and verified leaderboard result are public. Account timestamps, email, Auth ID, authentication metadata, history, ranked transcript, answers, favourites, marketing choice, analytics rows and security records are private. Deleting the account removes the public username, leaderboard entries and ranked transcripts through database cascades.

Services and sharing

Vercel hosts the application and supplies Web Analytics and Speed Insights when you allow optional analytics. Supabase provides authentication, transactional authentication email and database storage. Map display uses CARTO and OpenStreetMap data; place context can request Wikipedia/Wikimedia content. Place-name search uses our published map catalogue; application code does not attach your account ID to those upstream queries. Providers and subprocessors may process technical data in other countries under their own safeguards. Data is not sold.

Storage and retention

Feedback reports are retained for up to 90 days. Signed-in reports are included in account exports and removed when the account is deleted. For an anonymous report, contact us with its reference to request removal. Verified active-account history and completed ranked transcripts remain for the account lifetime. Unverified accounts expire after 7 days; incomplete, abandoned, expired or invalidated ranked sessions expire after 30 days. Raw Supabase product events, per-tab sessions and sanitized error occurrences expire after 90 days, while minimal account-action audits expire after 180 days. A failed account deletion is not reported as complete: its private retry record remains only until deletion succeeds and is retried every 15 minutes. Account-free aggregate metrics may remain longer: hourly metrics for 90 days and daily metrics for 13 months. Linkable analytics become unlinked when an account is deleted. Vercel analytics, hosting logs and backups follow the configured provider plan; deletion from active data may not remove an item from an immutable backup until that backup expires.

Your choices and rights

You can play without an account, sign out, download account data, and immediately and permanently delete an account from Account settings. Optional analytics starts off. Use the controls above to allow or withdraw it at any time; withdrawing stops future optional collection. It does not remove previously collected data immediately. Contact us about existing data, or use account export/deletion for older account-linked records. Depending on where you live, you may also have rights to access, correct, restrict, object, port, withdraw consent where used, or complain to a regulator. Contact the privacy address above if self-service does not resolve a privacy request.

Children

You must be at least 16 to create an account. The game does not ask for or store date of birth, and anonymous play remains available. If you believe someone under 16 has created an account, contact the privacy address above so it can be reviewed and removed where appropriate.

Security and changes

Reasonable technical controls include provider-managed password hashing, verified server identity checks, row-level database rules and server-only privileged credentials. No service is completely secure. Material notice changes will receive a new version/date and a plain-language summary here. This notice describes the product’s current decisions and configuration; it does not claim independent professional legal review.