YOUR DATA

Privacy Policy

LAST UPDATED · 3 SEPTEMBER 2026

The data controller is (MISSING), Sweden. Privacy contact: (MISSING).

1. Data we process

• Account data: username and email address.
• Authentication data: a securely hashed password, account identifiers, login status, failed login attempts and lockout information. We do not store your plain-text password.
• Game data: guesses, scores, challenge dates and a pseudonymous player identifier.
• Technical and security data: cookie identifiers, IP address used temporarily for rate limiting, request data, security events and server logs.
• Preferences stored on your device, such as theme and whether you dismissed the cookie notice.

2. Why and on what basis

We process account and game data to provide the service and perform our agreement with you. We process essential technical, fraud-prevention and security data for our legitimate interests in operating a safe, reliable game. We may process information to comply with legal obligations or establish, exercise or defend legal claims. GuessDuel currently performs no advertising profiling and uses no analytics or marketing tools.

3. Sharing and processors

We do not sell personal data. Data may be handled by providers that supply hosting, database, security and technical infrastructure, including Supabase as a database provider and (MISSING) as hosting provider. They may process data only under applicable agreements and instructions. We may also disclose data when required by law, to protect rights and safety, or as part of a business reorganisation subject to appropriate safeguards.

4. International transfers

Where a provider processes data outside the EEA, we use an available lawful transfer mechanism, such as an adequacy decision or the European Commission’s Standard Contractual Clauses, together with supplementary safeguards where required. Exact hosting and processing locations: (MISSING).

5. Retention

Account and associated game data are normally retained while your account is active and then deleted or anonymised following a valid deletion request, unless retention is legally required. Security and operational logs are retained for (MISSING). Backups may retain deleted data for up to (MISSING) before being overwritten.

6. Security

We use measures designed to protect data, including password hashing, encrypted HTTPS connections, secure and HTTP-only authentication cookies, access controls, rate limiting and database safeguards. No online system can guarantee absolute security.

7. Your GDPR rights

Depending on the circumstances, you may request access, correction, deletion, restriction, portability, or object to processing. You may withdraw consent where consent is the basis, although GuessDuel does not currently rely on consent for analytics or marketing. We may verify your identity before acting and normally respond within one month. Some rights have legal exceptions.

You may complain to the Swedish Authority for Privacy Protection (IMY) at imy.se. We encourage you to contact us first at (MISSING).

8. California and other local rights

Where applicable, residents may request access, correction or deletion and information about data practices without unlawful discrimination. GuessDuel does not sell personal information or share it for cross-context behavioural advertising. Submit requests to (MISSING).

9. Children

GuessDuel is not intended for children under 13. If we learn that we collected a child’s data contrary to applicable law, we will take appropriate steps to delete it. A parent or guardian may contact (MISSING).

10. Updates

We may update this policy as the service or legal requirements change. The date above shows the latest version. Material changes will be highlighted where reasonably possible.