Privacy at GeoTalez

What the game stores

GeoTalez stores game state in your browser using local storage. This lets the puzzle resume after a refresh. The current app uses these entries:

• geotalez:progress:v2: puzzle boards, swaps, ignition attempts, revealed hints, completed scores, dates played, and local streak/statistics.
• geotalez:new-games:v1: Missing Link guesses, Population Target selections, True Scale slider estimates and submitted guesses, and daily results.
• geotalez:tutorial:v1 and geotalez:first-play:*:v1: whether you have dismissed the game introductions.

You can play without an account. When you first submit a daily result or open the leaderboard, GeoTalez issues a random guest identity and a signed, HttpOnly, SameSite cookie. The cookie lets the server recognize this browser without exposing the credential to page JavaScript. Its random nickname is included in public rankings by default; you can hide it or reset it from the leaderboard page. Clearing site data, private browsing, or another device may create a new identity. A guest identity is a browser credential, not a verified unique human.

When public rankings are enabled, an official daily result stores the game, UTC challenge date, puzzle version, server-calculated score and compact performance details. With community counters enabled without rankings, only the completion count is stored. Practice, archive runs, page views and old local-only history do not create ranked results. The server accepts at most one result per identity, game and challenge date. Public leaderboards show only a nickname, score and result count. They do not show guest IDs, cookie credentials, account IDs, emails, IP addresses or browser-local data. Public puzzles and client-observable gameplay mean these safeguards cannot prove a person played honestly.

Community totals count completed official games separately from public rankings. They include aggregate play counts and approximate distinct browser identities; those identities are not verified people. Hiding or resetting a guest ranking removes that guest’s public ranking record (a cached public list may take up to two minutes to refresh), while already counted anonymous community totals remain.

If you sign in, your guest results may be linked to your account so the same game/date is not counted twice. Account results use the visibility preference in your profile. Local history you import remains private and does not become eligible for public rankings.

Optional accounts

Accounts use Supabase Auth with Google OAuth or email sign-in links. Supabase processes the email address and authentication session needed to sign you in. GeoTalez stores your unique player name, join date, optional country code, leaderboard visibility setting, and completed daily game, score, puzzle date/version, and a small set of performance details. The optional country code is private and is not shown on leaderboards. GeoTalez does not request a password.

Public leaderboards show only a guest nickname or the player name selected for an account, plus score and result count. Email addresses, account identifiers, country, and personal statistics are not exposed. Account results are private unless the account visibility setting is enabled. Your account result history is otherwise visible only to you.

Cookies and sharing

The app does not set advertising cookies or load advertising scripts. Ad placements are disabled, with no publisher account or consent platform configured. Local puzzle state uses browser storage. The guest leaderboard cookie is HttpOnly, SameSite=Lax and used to maintain anonymous result identity; it lasts up to two years or until you reset it or clear site data. Signed-in sessions use Supabase Auth cookies. If you choose Share or Copy, your browser uses its native sharing or clipboard interface only after you choose those actions.

Technical request data

The service provider hosting GeoTalez may process technical request information, such as the requested page, connection time and browser/network details, to serve the site and protect it from abuse. The provider's own privacy information describes its processing and retention.

Analytics

On production deployments hosted by Vercel, GeoTalez uses Vercel Web Analytics for page views and gameplay events: starting or completing a game, replaying an archived challenge, choosing the next-game link, completing all four daily games, sharing the daily summary, and returning after a previous official result. Lifecycle events include the game identifier; the other events include no game, score, account, or answer details. A return event is sent only when this browser already has an earlier official result, and events are limited to once per browser session where appropriate. Development and preview deployments do not send these analytics events. Vercel describes its analytics data handling in its privacy and compliance documentation.

Retention and deletion

Browser game data remains until you clear GeoTalez site data or the application replaces it during a future data migration. Hiding a guest removes its name and results from public lists but retains the private result for your history. Resetting a guest deletes that guest identity and its guest-ranked results, clears queued submissions and challenge tokens, and creates a new identity when needed; local game history and anonymous community totals remain. If results were linked to an account, deleting the guest identity does not delete account results; manage those in Profile. Account deletion removes the profile, saved account results and authentication account. Provider backups may remain for a limited period under that provider's retention practices.

Your choices and rights

You can play without creating an account, clear local game data, and decline to use the share or clipboard actions. You can review or delete account data from your Profile page.

Third parties and changes

Supabase provides database storage for anonymous guest results, community aggregates and optional accounts. It processes authentication data if you sign in. The current application code does not embed advertising networks, external font services or third-party map tiles. If those services change, this page will be updated before they are enabled.