Privacy policy
The short version
- You can play without an account. Then nothing about you leaves your device.
- An account stores your email address, a display name, a scrambled form of your password, and your game progress.
- No adverts, no analytics services, no trackers, no social-media buttons, and no fonts or scripts loaded from other companies.
- You can download everything we hold about you, or delete your account, from the game’s account screen.
What we store, and why
| Data | Why |
|---|---|
| Email address | To sign you in. |
| Display name | To show you on the leaderboard and in the game. It is public, so do not use your real name unless you want to. |
| Password | Only as a salted scrypt hash. We cannot read your password and cannot send it to you. |
| Game progress | Rank Points, deepest dive, dive count, statistics and the list of words you missed, so your progress follows you between devices. |
| Dive records | When each dive started and ended, the textbook and pace, and the points awarded. We use these to check scores are genuine and to build the weekly leaderboard. |
| Sign-in sessions | A hashed random token, and when it was created, last used and expires. This keeps you signed in for up to 30 days. |
| Agreement | Which version of these terms you accepted, and when. |
The legal bases are: performing the contract with you (running your account and game), our legitimate interest in keeping the service secure and free of cheating, and, where the law requires it, your consent, which you can withdraw by deleting your account.
What we do not store
- Our application does not write IP addresses, passwords or email addresses to its logs. It keeps IP addresses in memory for a short time only, to slow down password guessing, and never writes them to disk.
- The company that hosts the server, and any network service in front of it, may keep their own technical logs, which can include IP addresses. We do not control those logs.
- We do not record what you type into the game, only the points a dive earned.
Cookies and local storage
We set one cookie, which keeps you signed in. It is strictly necessary for signing in, so no consent banner is needed. The game also uses your browser’s local storage for your settings (volume, pace, display options), your guest progress, and a copy of the app for offline play. This stays on your device. Clearing your browser data removes it.
This site does not currently send email.
Who else sees your data
- Our hosting provider, which stores the database.
- Other players see your display name, rank and points on the leaderboard. You can switch the leaderboard off for your account at any time.
- If you choose to leave a tip, you do that on ko-fi.com, a separate service with its own privacy policy. The game sends it nothing about you. We never see your card details; the service may show us the name, message and amount you enter there.
- We do not sell your data and do not share it with advertisers. We may disclose data if the law requires it.
How long we keep it
Your account data is kept until you delete your account, or until we remove it for a breach of the terms. Sign-in sessions end after 30 days without use. Unused sign-in and reset links are deleted within a day of expiring. Backups of the database are made every 24 hours and the newest 7 are kept, so deleted data can remain in a backup for up to 7 days before it is overwritten.
Your rights
You can see, correct and delete your data from the account screen: download a copy of it, change your display name or password, turn the leaderboard off, or delete the account. To change your email address, or if you cannot use the account screen, write to us at alxchiarini@gmail.com.
Depending on where you live (for example under the GDPR or UK GDPR) you also have the right to restrict or object to processing, and to complain to your data protection authority. We answer requests within one month.
Children
Riddle Dive is meant for people aged 13 and over. In some countries you must be older (up to 16) before you can agree to the processing of your data yourself. If that is true where you live, please ask a parent or guardian before creating an account. If you believe a child has made an account without permission, write to us and we will delete it.
Security
The site is served over HTTPS only. Passwords are hashed with scrypt, sign-in tokens are stored hashed, and the sign-in cookie cannot be read by scripts on the page. No system is perfectly secure, so use a password you do not use anywhere else.
Changes
If we change this policy in a way that matters, we will update the version date above and let you know in the game or by email.