Privacy Policy

Information we use

• Your chosen username and a securely hashed password for account access. The game does not ask for an email address when you register. If you generate recovery codes, only their hashes are stored; each code works once.
• Your rating, level, XP, season stats, game results, scores, and active game state so that gameplay, rematches, My Games, and leaderboards work.
• A login session cookie and, if you choose “Remember me,” a longer-lived session. Website guests who play the Daily Challenge receive a session cookie so they can resume their attempt in the same browser. Your device may also remember the code of a game in progress so you can rejoin it.
• For website guests, a random session identifier and daily quiz progress (answers completed and score), without a username or account. Guest scores are not placed on public leaderboards unless you create an account in the same browser, when retained guest attempts and eligible scores are transferred to that account.
• If you send a support request, the reply email address and message you provide, any username you enter, and whether you were signed in. The reply email is used to answer your request, not added to your account.
• Technical request information, such as IP address and error logs, processed by our hosting provider to deliver and protect the service.
• In the Android app, Google AdMob may process IP address, device and advertising identifiers, app interactions, and diagnostic information to show ads, measure performance, and prevent fraud. The website currently does not show ads.

How and why we use it

We use account and game information to provide the service you request: sign-in, matchmaking, gameplay, saved results, ranking, and recovery of active games. We use limited technical information to keep the service reliable and protect it from abuse. Where UK data protection law applies, these purposes rely on performance of the service agreement and our legitimate interests in security and reliability, respectively.

Other players can see your username, score, and game outcome when playing with you. Usernames and ranking information may appear on public leaderboards. Computer-controlled opponents do not have real user accounts.

Hosting and sharing

Our website, game server, and PostgreSQL database are hosted by Render. Render processes service data for us. In the Android app, we use Google AdMob and Google’s User Messaging Platform for advertising and privacy choices. Google may collect and receive the advertising information described above; Google’s privacy policy explains its handling of that data. We do not sell player data ourselves. If we add other advertising or analytics services, we will update this policy and the Google Play Data safety declaration.

Advertising choices

For players in the UK, European Economic Area and Switzerland, the Android app asks for advertising privacy choices where required. You can change these choices from My Profile using “Advertising privacy choices” when that option is shown. Ad availability may depend on your choices and device settings. Google’s own retention rules apply to information it processes for ads.

How long we keep it

We keep your account, statistics, and completed game results while your account exists. Active custom games are normally kept for up to 30 days without activity; temporary matchmaking and finished games are removed sooner. Support requests are removed after about 90 days. Guest Daily Challenge attempts are removed from the live database after about 35 days; the guest session cookie lasts up to 30 days. Sessions for registered players expire according to the sign-in choice and the server's session settings. Hosting logs and backup copies follow Render's retention schedule.

When you delete your account, its profile, password hash, session records, season statistics, and own game results are removed from the live database. Your name is removed from other players' saved opponent labels. Their own scores and results may remain. Any active game involving your account ends. Backup copies may remain until the hosting provider's normal backup cycle expires.

Your choices and rights

You can delete your account here or from My Profile in the app. Deletion requires your username and password. For other privacy requests, including access or correction where applicable, contact hadzibelmin101@gmail.com. If UK data protection law applies, you can also complain to the Information Commissioner's Office.