Privacy Policy

Clueterra ("we", "us", "our") is a web-based geography game operated by Ivan Akulovich, an individual based in Ostrava, Czech Republic. For the personal data described in this Privacy Policy, Clueterra acts as the data controller.

Our electronic contact point for privacy requests, user support, authority communications, and content notices is [email protected]. We can receive communications in English and Czech.

Depending on how you use the Service, we process the following categories of data:

• Account and profile data: email address, password hash for email/password accounts, username, display name, avatar, OAuth provider identifiers, role, account status, and legal document versions accepted.
• OAuth data: if you use GitHub or Google sign-in, we receive limited profile data such as email address, name, avatar URL, and provider account ID. We do not request access to your repositories, contacts, or private files.
• Gameplay data: sessions, guesses, hints revealed, scores, XP, levels, streaks, shields, badges, challenge history, and profile or leaderboard statistics.
• Guest data: if you play without an account, we create a temporary guest profile linked to a random guest cookie so the Service can save guest gameplay progress, XP, streaks, shields, badges, legal acceptance versions, and guest session expiry.
• Technical and security data: request metadata, timestamps, authentication/session identifiers, security events, derived rate-limiting signals, and device or browser metadata where needed to operate, secure, debug, or protect the Service. IP address data may be processed as necessary for network delivery, abuse prevention, fraud prevention, and rate limiting.
• Local storage and cookies: authentication cookies, guest-session cookies/storage, OAuth state cookies, cookie notice state, and other strictly necessary storage used to provide requested features.

We do not intentionally collect payment card data, postal addresses, phone numbers, precise geolocation, or special-category personal data through the Service.

We process personal data for these purposes and legal bases:

• Providing accounts, authentication, guest sessions, and gameplay: performance of a contract or steps requested before entering a contract.
• Saving XP, streaks, shields, badges, statistics, and guest progress: performance of the Service and, where applicable, our legitimate interest in providing consistent game progression.
• Public profiles and leaderboards: our legitimate interest in operating expected social and competitive game features while limiting the displayed data to usernames, optional profile content, and gameplay information.
• Security, rate limiting, abuse prevention, bug investigation, and anti-cheat: our legitimate interests in protecting users, the Service, and game integrity.
• Legal acceptance records, legal claims, and compliance: legal obligation and legitimate interests in documenting acceptance or acknowledgement of current documents and defending rights.
• Service communications: performance of the Service, legal obligation, or legitimate interests, depending on the message.
• Optional marketing: consent, if we ever offer marketing emails. We do not send marketing emails unless you opt in.

Your username, display name, avatar, badges, rank, and gameplay statistics may be shown publicly on profile pages, result screens, and leaderboards. Do not put private, sensitive, or third-party personal information in public profile content.

Public profiles and rankings are normal features of a registered Clueterra account. You may object to processing based on legitimate interests by contacting us. We assess each objection and will restrict or stop the relevant processing where the GDPR requires it.

We disclose or make limited data available to the following recipients or categories:

• GitHub or Google only when you choose the corresponding third-party sign-in option.
• Cloudflare for DNS, traffic delivery, network security, email routing, and encrypted off-site backups stored in a private R2 bucket.
• Google consumer Gmail, used as the final mailbox for messages sent to our contact address after Cloudflare Email Routing.
• Public data or asset providers used for game content. When an asset is loaded directly from a third-party host, your browser contacts that host and may disclose your IP address, browser or device headers, and limited referrer information.
• Authorities, professional advisers, or affected parties where required by law or needed to protect rights and safety.

Some listed providers operate globally and may process data outside the EEA. Where Chapter V of the GDPR requires a transfer safeguard, we rely on an applicable adequacy decision, Data Privacy Framework participation, Standard Contractual Clauses in the provider's data processing terms, or another valid transfer mechanism, according to the provider's role and service.

We use public datasets, source registries, and AI-assisted tools to help create and review geography hints. This processing is focused on game content and public facts, not on your account email, password, or private profile information.

Game hints and image references can come from public or third-party sources and may be inaccurate, outdated, or unsuitable by mistake. We may filter, replace, disable, or remove content to protect users, minors, rights holders, and the integrity of the Service.

We use cookies and local storage that are necessary to provide the Service, including authentication, guest play, OAuth security, legal acceptance, and basic UI state. We do not use advertising cookies or third-party analytics tools such as Google Analytics.

Authentication cookies last for up to one day for access and seven days for refresh; guest cookies last for up to 30 days; and OAuth state cookies last for up to 10 minutes. Cookie-notice and interface preferences remain in browser storage until you clear them or the stored version is replaced. Cloudflare may set strictly necessary security cookies, such as a challenge-clearance cookie, according to the active security configuration.

Account, profile, legal-acceptance, and identifiable gameplay data are retained while your account is active. Guest profiles and guest progress normally expire after 30 days unless you convert the guest profile into a registered account before expiry.

Local application logs and centralized operational logs are normally retained for up to 30 days. Security records may be retained longer only where a documented incident, abuse investigation, or legal claim requires it. Ordinary support correspondence is kept until the request is resolved and then only while follow-up, security, or legal-claim needs remain.

Production backups are encrypted before upload to a private Cloudflare R2 bucket and expire after 30 days; no more than three encrypted copies are kept locally. The decryption key is stored separately from the hosting environment. Backups are used only for disaster recovery. If a backup is restored, completed deletion requests are reapplied before normal operation resumes.

If you request account deletion, we generally aim to delete or anonymize personal data associated with your account within 30 days, unless limited retention is needed for legal compliance, security, fraud prevention, dispute resolution, or legitimate record-keeping. Active database and avatar-storage records are covered by a documented deletion procedure; encrypted backup copies expire on the schedule above. Aggregated or anonymized statistics may be retained longer.

If you are in the EEA, UK, or another jurisdiction with similar rights, you may have the right to access, rectify, erase, restrict, export, or object to processing of your personal data, and to withdraw consent where processing is based on consent.

To exercise your rights, contact us at [email protected]. We normally respond within one month, subject to proportionate identity verification and lawful extensions. Requests are handled through a documented manual procedure covering access, correction, deletion, avatar storage, and verification of the result.

You may also lodge a complaint with a supervisory authority. In the Czech Republic, the supervisory authority is the Czech Office for Personal Data Protection (UOOU).

Clueterra is not directed to children under 15 in the Czech Republic. If you are under 15, do not create an account or use guest features that require legal acceptance unless your parent or guardian allows and supervises your use. We do not knowingly collect personal data from children who are not legally permitted to use the Service. If we learn that such data was provided, we will take reasonable steps to delete it.

We use technical and organizational measures designed to protect personal data, including password hashing, HTTPS, restricted database access, authentication controls, rate limiting, encrypted off-site backups, and separation of backup decryption keys from the hosting environment. No online service can guarantee absolute security.

We may update this Privacy Policy from time to time. Material changes will be reflected on this page with an updated effective date. Where appropriate, we may require users to review and accept updated legal documents before continuing certain account or guest features.

For privacy requests, account deletion, content notices, or questions about this Privacy Policy, contact us at [email protected].