Privacy notice

1. Who we are

SpotGuesser is run by John Doe, a sole trader in England and Wales, at 60 St Giles High St, London WC2H 8LQ, United Kingdom. We decide how the details below are used, which makes us their controller under UK data protection law. Questions, or a request about my data: hello@spotguesser.com.

2. Playing without an account

Playing needs no name and no email. To make results work, SpotGuesser keeps:

• a random player ID in the sg_pid cookie, so my answers and scores are mine;
• my answers, scores and the matches I played, with that ID;
• my match in progress, results and streak in this browser’s storage.

3. With an account

When I sign up, SpotGuesser also keeps:

• my email address, to log in and recover my account. It is never shown to other players;
• my password, held only in a scrambled (hashed) form by our sign-in provider; or, with Google, the email address Google confirms (nothing else from my Google account);
• my username, avatar and country (worked out from my connection when I sign up; I can change it or hide it);
• my XP, level, achievements, streak and match history;
• the leagues I’m in, and a league’s log of who was added, joined, removed or left (seen only by its owner);
• that I confirmed I’m 13 or older when I signed up;
• who invited me, if I signed up from a friend’s link, and the friends who signed up from mine, so we both get our XP;
• a message I send through Contact us, with my account, so it can be answered by email.

4. Why, and on what basis

Each use has a lawful basis under UK GDPR:

No marketing emails, no advertising, and nothing sold. The only email I get besides my account's is none.

5. Who sees what

• Other players see my username, avatar, country and scores where I play with them.
• Members of a league see each other's daily scores in the topics it compares, and a league's owner sees its log of members in and out.
• If I make a week's top ten on the leaderboard, everyone sees my username, avatar, country and points for that week. I can keep myself off it in Settings.
• A friend who invited me sees my username, when I joined, and whether I've played my first 3 daily matches.
• A result I share shows my score and five colored squares to anyone with the link, and nothing else.
• Nobody else sees my email address.

6. Who helps us

A few companies run parts of SpotGuesser for us, and may only use my details to do that:

• Vercel: hosting the site;
• Supabase: the database and sign-in;
• Google: sign-in with Google, if I use it, and Google Analytics, if I switch it on. And reCAPTCHA on sign-up, log-in, password reset, Contact us and league invitations, to tell people from bots: it looks at how the page is used, under Google's own privacy policy.

Some of them may keep data outside the UK. When they do, it is protected by [UK adequacy regulations or the UK International Data Transfer Agreement].

7. How long

• My account: until I delete it, in Settings. Then my profile, XP and achievements go at once; scores I played stay as anonymous numbers.
• The player ID cookie: 400 days from my last visit.
• A message sent through Contact us: 12 months after it is sent, or sooner if I delete my account.
• Names entered in a challenge, before challenges ended: deleted within 30 days of the challenge closing.
• Security logs: [30 days].
• Google Analytics: at most 14 months.

8. My rights

I can ask for a copy of my data, have it corrected, deleted or restricted, object to how it is used, or take it elsewhere. I can withdraw my consent to analytics at any time with Cookie settings. To ask, I write to hello@spotguesser.com; we answer within a month.

If I’m unhappy with how my data is handled, I can complain to the Information Commissioner’s Office (ico.org.uk).

9. Children

Accounts are for people aged 13 and over. Playing without an account asks for no name and no email.

10. Changes

If this notice changes in a way that matters, we will say so on the site, or by email if I have an account. The date at the top shows the latest version.