Privacy notice

Template for the MVP: have it reviewed for your country (for example the UAE PDPL, India's DPDP Act or the GDPR) before launch.

If you're a customer playing a game

• The shop records your name, the purchase amount and the receipt number so you can play one game for that purchase. Giving a phone number is optional.
• If you give a phone number we don't store it: we keep a one-way code made from it (so the shop can recognise you next time and never give you the same puzzle twice) and its last four digits.
• We record the game you played, your answers, your score and any reward, so rewards can be checked and used once. You don't need an account and we don't use cookies for tracking; one cookie keeps your game going if the page reloads.
• Each shop sees only its own customers. Your details are removed automatically after the shop's retention period (365 days without a purchase by default), or earlier if you ask the shop.

If you run a business

• We keep your business details, your email and the ID of the Google account you sign in with (we never see your Google password), and a log of important actions in your account.
• You are responsible for telling customers how their details are used before you register them (the dashboard asks you to confirm this every time).
• You can delete a customer's details, or your whole business and all its data, from the dashboard.

Security

Data is sent over HTTPS only. PINs, phone numbers and session tokens are stored as one-way hashes. Businesses are isolated from each other in the database.

Questions: contact the shop you played at, or blueregan.