Privacy Policy

The short version

• You can play without an account. Anonymous rolls are not saved.
• If you sign in with Google, we keep your account, your username and your game history.
• We don't sell your data, show ads, or use analytics or tracking cookies.
• You can ask us to delete your account and all your data at any time.

What we collect

• Account data (signed-in players only). When you sign in with Google, our authentication provider (Supabase) receives your email address and the basic profile information Google shares (such as your name and profile picture). GeoRNG itself only uses your email to identify your account; it is never shown to other players.
• Username. The public name you choose. It appears on the leaderboard and on results you share.
• Country (optional). A country you pick on your profile. It is shown as a flag next to your username and puts you on that country's leaderboard. We never work it out from your IP address or anything else.
• Friends. The players you send friend requests to or accept requests from.
• Game data (signed-in players only): the place you rolled each day, when you revealed it, its score and rarity, and the badges you earned.
• Anonymous identifier. A random id stored in a cookie, so that the same browser gets the same place for the day. It is not linked to who you are.
• IP address. We use your IP address to limit how many requests can be made, to protect the game from abuse. This applies to all players, signed in or not, and the address is kept for up to 30 days.
• Technical data. Our hosting provider keeps standard request logs. If an error occurs, an error report (browser, page and technical details of the error) may be sent to our error monitoring service.
• Moderation records. If an account is banned, we record when and why.

Why we use it

• To run the game (your account, daily rolls, collection, streaks and leaderboards). Legal basis: performance of our agreement with you (the Terms of Service).
• To keep the game fair and secure (rate limits, moderation, error monitoring). Legal basis: our legitimate interest in running a reliable and fair game.

We don't use your data for advertising, profiling or automated decisions.

What is public

• Your username, country (if you picked one), scores and number of games appear on the leaderboards.
• Your friend list is private. A player you send a request to sees your username, and your friends see you on their friends leaderboard.
• A result you share is visible to anyone with its link. It shows your username, the date, the place rolled, its score and badges. Rolled places are random, not your location.
• Your email address and account id are never public.

Cookies

GeoRNG only uses cookies that are needed for the game to work:

• georng_anon: the anonymous identifier described above (kept up to 400 days).
• sb-…-auth-token: keeps you signed in (set by Supabase, only if you sign in).

There are no analytics, advertising or third-party tracking cookies.

Who processes your data

We use these providers to run GeoRNG. They process data only on our behalf:

• Supabase: database and sign-in.
• Vercel: website hosting.
• Google: sign-in with your Google account.
• Sentry: error monitoring.
• OpenFreeMap: map tiles. Your browser loads them directly, so OpenFreeMap sees your IP address.
• Amazon Web Services: terrain elevation tiles (AWS Open Data). Your browser loads them directly, so Amazon sees your IP address.

Some of these providers may process data outside the European Economic Area. When they do, they rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework.

How long we keep it

• Account, username, game history and badges: until you delete your account.
• IP addresses used for rate limits: up to 30 days.
• Anonymous identifier cookie: up to 400 days, or until you clear your cookies.
• Error reports and hosting logs: for the limited period set by those providers.
• Moderation records: as long as needed to prevent repeated abuse.

Your rights

Under the GDPR you can ask to access, correct, delete or export your data, to restrict or object to its use. To exercise any of these rights, including deleting your account, email adsdslandicas@gmail.com from the address linked to your account. We will reply within one month.

You can also complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (cnpd.pt), or the authority in your country.

Children

You must be at least 13 to create an account. If you believe a younger child has created one, contact us and we will delete it.

Changes

If this policy changes, we will update the date at the top of this page. Significant changes will be announced in the game.