Privacy

What is stored

• Which cases you have solved and how many questions you needed for them.
• Which packs are unlocked for you and since when.
• The history of a case you are playing, so you can stop and come back. It belongs to your account and is deleted with it.
• Your questions to the raven, to improve the game. Not linked to you, without a time of day, and email addresses, phone numbers and bank details are redacted beforehand.
• Your email address, but only if you secure your account.
• For a purchase, the payment provider's confirmation as it reaches us. It never contains card details; those never reach us at all.

Legal grounds

• We process your account, progress and unlocked packs to provide the game. The legal basis is Article 6(1)(b) GDPR.
• We analyse your questions to the narrator in order to improve the game. The legal basis is our legitimate interest under Article 6(1)(f) GDPR. The questions are separated from your person in the process.
• We record stopped input in order to prevent misuse and to protect our access to the services involved. This also rests on our legitimate interest.

For how long

• Account, progress and unlocked packs stay until you delete the account. After that they are gone.
• Blocked inputs are kept no longer than your account and are deleted with it.
• The questions separated from your person are kept without a time limit. With no link to a person there is nothing to limit.

Who else is involved

For accounts, the database, the raven's answers and serving the site we work with providers. They process the data only on our instructions and not for their own purposes.

• Supabase — account, sign-in and database. The data is held in Paris.
• Vercel — serving the site. Sees your IP address and which pages you open.
• Cloudflare — protection against automatically created accounts, plus name resolution for the domain. The protection evaluates your IP address and signals from your browser.
• OpenRouter — passes every question on to the language model.
• Google — answers your questions as the language model. By its own account Google keeps inputs and outputs for fifty-five days to detect misuse.
• Mistral — checks every input before it reaches the raven. Deliberately a different provider: what is meant not to reach someone must not be checked by that same someone.
• Google — only if you sign in with it. We then receive your email address and profile name, nothing else.
• A mail delivery service for sign-in links, once that route is open. It then receives your email address.

Part of this processing takes place outside the EU, above all with the language models. We base this on the European Commission's standard contractual clauses and choose providers processing in the EU wherever we can.

There is no analytics, no ad network and no fonts from other servers. That is why there is no consent banner either.

Stripe, and why it sits differently

When you buy a pack, Stripe is the seller and therefore itself responsible for the payment data, not our processor. What Stripe collects is set out in Stripe's own privacy policy.

From Stripe we only receive the confirmation that payment was made, plus amount, currency and a reference number. Your card details never reach us.

Automated, but without consequences for you

The narrator decides by machine whether an answer is yes or no and whether a case is solved. That only affects your game. There is no automated decision with legal effect under Article 22 GDPR.

Responsible for the content