Privacy Policy

Who we are

PictoRiddle (pictoriddle.com) is a daily picture-riddle game run by an independent developer based in Denmark. For anything privacy-related, contact privacy@pictoriddle.com.

What we collect

You can play without an account. If you do, your progress is stored only in your own browser, and your guesses are recorded anonymously (not linked to you) so we can see which riddles are too hard or too easy.

If you create an account, we store:

• Email address and password — for signing in. The password is stored only as a secure hash; we never see it. If you sign in with Google instead, we receive your name and email address from Google — the email becomes your account email, there is no password, and we use nothing else from your Google account.
• Username — shown on leaderboards and in groups you join.
• Game results — which riddles you solved, hints used, points, and your guesses, so your progress and leaderboard scores work across devices.
• Group membership — which groups you have created or joined.

We do not store your IP address (it is used transiently for rate limiting only), and we use no advertising or third-party analytics trackers. Our hosting providers keep standard, short-lived server logs.

Why we collect it

We use this data solely to run the game: keeping you signed in, saving your progress, and showing leaderboards (performance of our contract with you), plus anonymous gameplay statistics and abuse prevention (our legitimate interest). We never sell data or use it for advertising.

Cookies

We use only strictly necessary storage: a session token that keeps you signed in, and local browser storage for your progress when you play without an account. No tracking or advertising cookies — which is why there is no cookie banner.

Who processes it

Your data is stored and processed by these service providers on our behalf, under their GDPR data-processing agreements:

• Supabase — database and authentication (accounts, game results)
• Vercel — website hosting
• Cloudflare — serving the riddle images
• Resend — transactional email

Where these providers process data outside the EU, transfers are covered by the EU–US Data Privacy Framework or standard contractual clauses.

How long we keep it

Account data and game results are kept until you delete your account. Anonymous gameplay statistics (guesses not linked to any account) are kept indefinitely to improve the riddles.

Your rights

Under the GDPR you can ask for access to, correction of, a copy of, or deletion of your personal data. To delete your account and everything tied to it, email privacy@pictoriddle.com from the address you signed up with — we will delete it within 30 days. Deleting your account removes your profile, group memberships, and game results; your past guesses remain only as anonymous statistics.

You can also complain to the Danish Data Protection Agency (Datatilsynet, datatilsynet.dk).

Changes

If this policy changes in a way that matters, we will update this page and the date at the top.