Privacy policy
What we hold about you, why, who helps us with it, and how to make us change or delete it.
Last updated:
Who is responsible
The data controller is Aurum Imperium, S.L.U., tax ID B19947407, Carrer Consell de Cent 415, Principal 2n, 08009 Barcelona, Spain. For anything about your data, write to [email protected]. We have not appointed a data protection officer.
What we handle, why, on what basis, and for how long
| Purpose | Data | Legal basis | How long |
|---|---|---|---|
| Playing without an account | A random guest token, your rounds, answers, answer timing and whether the tab lost focus, XP and streak. No name, no email and no IP address stored with them | Providing the game you asked to play (GDPR art. 6.1.b) | Erased after 90 days if no account claims it, or when you ask (below) |
| Your account | Email, name, password hash, language, the marques you follow, the club you declare if any, your acceptance of the terms and your age confirmation, and sessions | The contract with you (art. 6.1.b) | Until you delete the account. Accounts never verified are erased after 30 days |
| Progress, leaderboards and clubs | A pseudonym, XP, level, streak, rating and results. Boards show pseudonyms only, and you can leave them in your settings | The contract with you (art. 6.1.b) | Until you delete the account |
| Service and security email | Email address and a record of what was sent. Bodies of emails holding a live link are not kept | The contract (art. 6.1.b) and our legitimate interest in keeping accounts safe (art. 6.1.f) | Until you delete the account |
| The newsletter | Email, language, marques, the date, source and IP address of your consent and confirmation, delivery records, and referral code and counts | Your consent, given by confirming the link we email you (art. 6.1.a) | Until you unsubscribe or ask for erasure. We then keep the address only on a suppression list, so that it is never mailed again (art. 6.1.f) |
| Paid plans, once on sale | Plan, subscription status, Stripe customer reference, purchase consent, and invoices. Card details go to Stripe and never reach us | The contract (art. 6.1.b) and our tax and commercial obligations (art. 6.1.c) | Six years after the purchase for commercial records (Código de Comercio art. 30), then deleted. Issued invoices stay at Stripe, which offers no way to delete them |
| Fair play | Answer timing on your rounds. A round with several answers faster than anyone can read is taken off the boards until a person clears it. Nothing else happens to the player | Our legitimate interest in fair boards (art. 6.1.f) | As long as the round is kept |
| Knowing whether the game works | Counts of events such as a game started or a challenge sent, holding a name, game, marque, channel and day and no identifier of any kind. Return rates are computed from account activity only | Our legitimate interest in improving the game (art. 6.1.f) | The counts are not personal data. Account activity is kept as above |
| Delivering the site safely | Technical data that any web request carries, such as your IP address, seen by our hosting provider and briefly by our rate limiter | Our legitimate interest in running and protecting the service (art. 6.1.f) | Standard technical logs at the provider; the rate limiter keeps counts in memory only |
What we do not do
- No advertising trackers and no analytics cookies. See the cookies and storage notice.
- We do not sell your data, and sponsors of the newsletter receive none.
- No automated decision with legal or similarly significant effects on you.
Who processes data for us
These providers act on our instructions, for the purposes above:
| Provider | What for | Data |
|---|---|---|
| DigitalOcean | Hosting of the site, the app, the API and the database, and photo storage, in the Amsterdam region | Everything above that we store, and web requests |
| SendGrid (Twilio) | Sending account, billing and newsletter email | Email address, the email itself and delivery events |
| Stripe | Payments, subscriptions, tax and invoices, once paid plans are on sale | Identification and payment data you give at checkout |
| Google Gemini | Drafting the newsletter from public news, which staff then edit and approve | News items only. We send it no data about you or any subscriber |
Transfers outside the EEA
Some of these providers are based in, or use companies in, the United States. Where personal data leaves the European Economic Area, it does so under the safeguards the GDPR allows, such as the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses. Write to us for details.
Minimum age
Accounts, paid plans and the newsletter are for people aged 16 or older, and signing up asks you to confirm it. Playing as a guest asks for nothing that identifies you, and the site carries no behavioural targeting.
Your rights
You can ask for access to your data, its rectification or erasure, restriction of its processing or a portable copy, and you can object to processing based on legitimate interest. Where the basis is consent, you can withdraw it at any time, without affecting what came before.
In the app you can export or delete your account yourself. Every newsletter email has a one-click unsubscribe and a link to your preferences, where you can also export or erase your subscription. A guest can erase their progress below. For anything else, write to [email protected].
You also have the right to complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid, www.aepd.es).
If you played as a guest
A guest has no account to ask through, so the token on this device is enough. Signing up instead moves your guest progress into your account, and the token then stops working.
Forget my guest progress
If you have played without an account, this erases what our server holds for this device and ends its guest token.
Changes
If this policy changes in a way that matters, we will say so on this page and, for account holders, by email.