Privacy Policy

Who we are

GeoRugby is operated by Andrew Holding trading as GeoRugby, the data controller for this game. For anything about your data, contact us at georugbyinfo@gmail.com or via our contact page.

What we store

If you just play (no account)

• A random player ID created in your browser the first time you play. It isn't linked to your name or email.
• Your daily results: the date, your score for each question, how far each guess was from the answer (in miles), your total, how long the round took and your streak. We don't keep the map coordinates of your guesses; the server uses them only to calculate your score.
• Names you choose to show: a leaderboard name, a name on a challenge link, or a name in a private group. These appear to other players, so please don't use your full real name if you'd rather not.
• Groups and challenges: the groups you create or join (group name, invite code, members' chosen names and scores), and any challenge links you create (your chosen name, score, date and emoji grid).

If you create an account

• Your email address and password. Passwords are handled by our authentication provider and stored only in hashed form. We never see or store your password ourselves.
• Linking your devices: which player IDs belong to your account, so your history follows you. When two devices both played the same day, we keep the earlier result and store the other as archived. Scores are never added together.
• Account sign-in records kept by our authentication provider, such as when you signed up and last signed in.

On your device: your game progress, stats and a few preferences are saved in your browser. The Cookie Policy has the full list.

Our own usage counts: to see whether the game is working, we record simple events with the random game player ID already on your device (if you have one). If you haven't played yet, a temporary player ID exists only in memory for that page load. A separate temporary visit ID also exists only in memory for that page load; both disappear on refresh or when you close the tab. Measuring usage never stores anything new on your device. The events are: opening the site, starting a round, locking in each answer (only which question number, never where you guessed), viewing results, tapping share and opening a challenge link. We also record a broad device type (phone, tablet or desktop) and browser family (such as Chrome or Safari). We don't record your IP address, location, email or full browser details in these events. Only our admins see totals, and raw events are deleted after 90 days.

Error reports: if something crashes in your browser, we store a short, cleaned error message, the page path, and the broad device and browser type, so we can fix bugs. We strip out anything that looks like an email, ID or token. Error reports are deleted after 30 days.

Technical data: like any website, our hosting and database providers process your IP address and browser details to deliver pages and protect the service, and they keep short-term technical logs.

What we don't do

• We don't use third-party product analytics tools, and we don't fingerprint devices for our own usage counts. Google's advertising measurement, when enabled, is described below.
• We don't sell your game or account records. When advertising is enabled, Google's ad services may involve uses of data covered by regional rules on targeted advertising, sale or sharing; see "Advertising" and "Your rights" below.
• We don't send any player data to AI services. AI tools are used only by our own admins, to help draft quiz questions, and they only see question content.

Why we use it (and our lawful basis)

• Running the game you ask to play: scoring, streaks, leaderboards, groups, challenges and syncing your account. We rely on this being necessary to provide the service, or on our legitimate interest in running a fair, working game.
• Keeping it fair and secure: checking scores on the server, one result per player per day, and stopping abuse. We rely on legitimate interests.
• Accounts: sign-in, email confirmation and password resets. These are necessary to provide the account you asked for.
• Advertising, when enabled: delivering and measuring ads and preventing fraud, with non-essential ad storage and personalised advertising subject to the consent or other choices required where you live.

The lawful bases above are how UK and EU-style laws describe it. Other countries use different frameworks, but we use your data for the same purposes everywhere. This is our honest summary, not legal advice to you.

Who helps us run GeoRugby

• Lovable hosts the app. Its backend (built on Supabase) provides our database, sign-in and email delivery.
• Google Fonts supplies our typefaces, so your browser requests them from Google's servers. This shares your IP address with Google.
• Wikipedia is linked from some answer explanations. It only receives data if you tap a link.
• Google AdSense may provide advertising when enabled; see below.

GeoRugby is played around the world, and our providers run servers in several countries, including the United States and the EU. Your data may therefore be processed outside the country where you live. Where the law requires it (for example for transfers out of the UK, EEA or Switzerland), we rely on the safeguards our providers offer, such as standard contractual clauses or equivalent mechanisms.

Advertising

GeoRugby may display advertising using Google AdSense. When advertising is enabled, Google may process device and browser information and use cookies or similar technologies to deliver and measure ads and help prevent fraud. Where your choices permit, ads may be personalised. We do not receive your Google advertising profile.

Third-party vendors, including Google, may use cookies or similar identifiers to serve ads. Google's use of advertising cookies may enable Google and its partners to serve ads to you based on your visits to GeoRugby and/or other sites on the internet. Through AdSense, ads may also come from other certified ad vendors or networks working with Google; we don't choose them individually, and where consent is required they appear in Google's consent message, where you can review them. You can manage or opt out of personalised advertising through Google's Ads Settings, and learn more at how Google uses information from sites that use its services. Our privacy pages (Privacy, Cookies, Terms and Contact) don't load ad code.

Ad treatment varies by region and your choices. In the UK, EEA and Switzerland, non-essential advertising storage and personalised ads are subject to the choices presented through Google's certified consent tool. In applicable US states, Google's privacy messages provide choices to opt out of targeted advertising and the "sale" or "sharing" of personal information. Elsewhere, Google's regional privacy framework applies as configured. We don't determine or store your location ourselves for this purpose. You can revisit available choices through "Your privacy choices" at the bottom of every page. If advertising isn't enabled, there are no advertising choices to change yet.

How long we keep it

• Game results, groups and challenges: kept while GeoRugby runs, so leaderboards, weekly tables and history stay accurate. We don't yet delete them automatically after a set period.
• Account data: kept until you ask us to delete your account.
• Data on your device: stays until you clear your browser storage. Logging out also resets this device to a fresh guest.
• Technical logs: kept for a short period by our providers.

Security

Your data is stored with our backend provider and is encrypted when it travels over the internet. Access is restricted: players can only reach public-safe views, such as today's round, leaderboards and their own groups, and other players' identifiers and emails are never shown. No system is perfectly secure, but we take reasonable steps to protect your data.

Your rights

Your rights depend on where you live, and the law in your country may give you extra rights beyond those listed here. We apply these basics to everyone, wherever you are: you can ask to access, correct or delete your data, or get a copy of it. Where we rely on consent, you can withdraw it at any time. If you're in the UK, EEA or Switzerland, you can also object to or restrict how we use your data. If you're in a US state with a privacy law, you can also opt out of targeted advertising and the "sale" or "sharing" of personal information when advertising is enabled. We won't treat you differently for using your rights.

There's no self-service delete button yet. To delete your account or your results, email georugbyinfo@gmail.com. Guest results on our servers are tied only to a random ID, not to you. Clearing your browser storage cuts the link from your device. We'll respond to requests within one month.

You can also complain to your local data protection authority. For the UK, that's the Information Commissioner's Office (ico.org.uk). We'd appreciate the chance to help first.

Children

GeoRugby is a general-audience game, not aimed specifically at children. Guests don't need to give any personal details. If you're under 13, please ask a parent or guardian before creating an account.

Changes

We'll update this notice when GeoRugby changes. The "last updated" date at the top will change, and for significant changes we'll show a notice in the game.