Guess the Page (guessthepage.com and the Guess the Page apps) is an independent game. This policy explains what we collect when you play, why, and how to get it deleted.

Questions or requests: privacy@guessthepage.com.

Everyone gets a game profile, no sign-up needed: a random identifier kept on your device, a display name (random until you change it), your points, gems, streaks, badges, and the puzzles you played with their guesses and hints, plus marathon, blitz and duel results.

Your display name, badge and points appear on leaderboards, in puzzle and duel results, and to the players you follow or who follow you. Nothing else about you is shown to other players.

If you create an account, we also store your email address, a name (your display name at sign-up, or the name from Google or Apple), and for each active session the IP address and browser or device type, to keep accounts secure.

Passwords are never stored: only a salted scrypt hash, which cannot be turned back into the password.

We email you only about your account: a link to confirm your address, and a password reset link when you ask for one. No newsletters or marketing.

With Sign in with Google or Apple we receive your name, email address and an account identifier, nothing else (no contacts, files or other data). Apple may give us a private relay address instead of your email.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

In the apps, subscriptions are sold and billed by Apple or Google: we never see your payment details. RevenueCat, which manages subscriptions for us, receives your game profile’s public identifier, which plan you bought and when it renews or ends, your country and technical details about your device and app version.

We store whether you are a VIP and until when.

Your settings (language, theme, sounds, reminders) and your game profile identifier are saved on your device. In the apps, your sign-in is kept in the phone’s secure storage; on the website, in a cookie that only serves to keep you signed in.

Daily reminders are scheduled by your phone itself. If you turn notifications on in the apps, your phone’s push token is stored with your profile so we can tell you about friends and duels (a new follower, a challenge, a result); it is removed when you turn them off.

The website counts visits and game events (such as “puzzle solved”) with Umami and Rybbit, which we host ourselves. The apps count the same game events with Rybbit. Neither uses cookies, follows you across sites or apps, or stores your IP address.

Like any web server, ours briefly logs requests (IP address, time, address requested) to run the service and stop abuse.

To run the game you ask for: save your progress, sync it across your devices, show leaderboards and duels (performance of our agreement with you). To keep the service secure and understand, in aggregate, how the game is played so we can improve it (our legitimate interests).

We don’t sell your data, don’t show ads and don’t use your data to profile you.

Only the providers needed to run the game: our hosting server, Resend (which delivers our account emails, so it receives your email address and the email content), Google or Apple if you choose to sign in with them, Expo’s push service together with Apple or Google (which deliver notifications to your phone, so they receive your push token and the notification text), and RevenueCat with Apple or Google for subscriptions. In learn mode, the word you tap is sent to the MyMemory translation service, without anything identifying you. Wikipedia pages are fetched by our server, not by your device.

We keep your data while your profile or account exists. Profile → “Delete my account” erases your game data and your account at once; copies may remain in backups until they are replaced.

You can also ask us to access, correct, export or delete your data, or object to how we use it, at privacy@guessthepage.com. You may complain to your local data protection authority.

Connections are encrypted (HTTPS), passwords are hashed, and sign-in attempts are rate-limited. No system is perfectly secure, but we only keep what the game needs.

The game is not directed at children under 13, and we don’t knowingly collect their personal data. If you believe a child has created an account, write to privacy@guessthepage.com and we will delete it.

If this policy changes, we update it here and change the date below.