1. Introduction
Welcome to GeoWrecked ("we," "our," or "us"). GeoWrecked is operated by Povilas Konopackas. We are committed to protecting your privacy and ensuring transparency about how we collect, use, and safeguard your personal information. This Privacy Policy explains our practices regarding your data when you use our geography quiz game.
Data protection contact: [email protected]
2. Information We Collect
2.1 Account Information
When you create an account, we collect:
- Username
- Email address
- Password (encrypted)
- Country (selected during registration)
- Measurement unit preference (km or miles)
- Profile avatar selection
2.2 Game Data
During gameplay, we collect:
- Game scores, GeoScore, and statistics
- ELO rating and tier progression
- Badges and achievements earned
- Daily challenge participation and streaks
- Duel match history and outcomes
- Gameplay timestamps and time taken per question
2.3 Group/Party Mode Data
When you participate in Group Mode (Party) games, we collect:
- Room codes and session identifiers
- Player lists within your game room
- Real-time game actions transmitted via WebSocket connections
- Individual and group scores and rankings
Room codes are temporary and expire after the game session ends. Real-time communication data is not permanently stored beyond the session results.
2.4 Push Notifications
If you enable push notifications, we collect:
- Firebase Cloud Messaging (FCM) device token
- Notification preferences and opt-in status
FCM tokens are used solely to deliver game notifications (duel invites, daily challenge reminders, friend requests). You can disable notifications at any time through your device settings or in-app preferences.
2.5 Technical Data
We automatically collect:
- Device information (browser type, operating system, device model)
- IP address (used for abuse prevention and approximate country detection)
- Session data via secure HTTP-only cookies
- Usage patterns and feature interactions
- App version and platform identifier (for mobile apps)
- Device identifiers and anti-cheat signals used to detect unfair play (e.g., multiple accounts, automated tools)
- Crash reports and performance diagnostics
2.6 Payment Information
For Premium subscriptions, payment processing is handled by Stripe (web), Apple (iOS), or Google (Android). We collect:
- Subscription status and plan type
- Transaction dates and amounts
- Billing period and renewal dates
Important: We do not store or have access to your full payment card details. Your card information is provided directly to the payment processor (Stripe, Apple, or Google), which handles it under PCI-DSS security standards.
2.7 Referral and Invite Data
If you are referred by another user, use a referral code, or receive a game invite, we collect the referring user's identifier to attribute the referral. If you invite others via email, we collect the recipient's email address solely to send the invitation.
3. How We Use Your Information
We use your information to:
- Provide and maintain the game service
- Calculate and display your GeoScore, ELO rating, and tier
- Track and award badges and achievements
- Display global and friend leaderboards
- Match you with opponents in duel mode using automated matchmaking
- Send game-related notifications (with your consent)
- Analyze usage to improve game features and fix bugs
- Prevent cheating and ensure fair play
- Process payments and manage subscriptions
4. Cookies and Local Storage
We use cookies and local storage technologies on our website. These fall into the following categories:
Strictly Necessary (always active)
- Authentication token (JWT) to keep you logged in
- CSRF protection token
- Cookie consent preference
Security (strictly necessary)
- Google reCAPTCHA, used on our registration page to prevent automated abuse. reCAPTCHA collects hardware and software information and sends it to Google for analysis. This is classified as strictly necessary for security. See Google's Privacy Policy for details.
Analytics (requires your consent)
- Amplitude, usage analytics to understand how players use GeoWrecked and improve the experience. Analytics cookies are only activated after you consent via our cookie banner.
Error Reporting (requires your consent)
- Sentry, crash and error reporting to help us identify and fix bugs.
You can manage your cookie preferences at any time via the "Cookie Settings" link in our website footer. You can also control cookies through your browser settings, though this may affect some game functionality.
5. Data Sharing and Service Providers
We do not sell your personal data. We share data with the following service providers who process data on our behalf:
| Provider | Purpose | Data Shared | Location |
|---|---|---|---|
| Stripe | Payment processing (web) | Billing info, transaction data | US/EU |
| Apple | Payments (iOS), authentication | Purchase data, Apple ID | US |
| Payments (Android), authentication | Purchase data, Google ID | US | |
| Amplitude | Analytics | Usage events, device info | EU |
| Sentry | Crash reporting | Device info, error data | US |
| Mapbox | Map rendering | IP address, tile requests | US |
| Firebase (Google) | Push notifications | FCM device token | US |
| Google reCAPTCHA | Bot prevention | IP, browser data | US |
| Hetzner | Server hosting | All user data (encrypted) | EU (Germany) |
| Cloudflare | CDN and security | IP, request metadata | US/EU |
| Mailgun | Transactional email | Email address, content | US |
We may also share data with:
- Other players: Your username, GeoScore, ELO rating, and badges are visible on leaderboards and in multiplayer matches
- Legal requirements: When required by law or to protect our rights
6. Data Retention
We retain different types of data for different periods:
| Data Type | Retention Period |
|---|---|
| Account data (email, username, profile) | Until account deletion + 30 days |
| Game session history and scores | Duration of account |
| Payment and transaction records | 7 years (tax and legal requirements) |
| Server logs (IP addresses, requests) | 90 days |
| Analytics events (Amplitude) | 24 months |
| Push notification tokens | Until disabled or account deleted |
| Anonymized and aggregated data | Indefinite (not linked to you) |
If you delete your account, we will remove your personal information within 30 days. We will also request deletion from our third-party service providers. Some anonymized, aggregate data (e.g., total games played) may be retained as it cannot be linked back to you.
7. Your Rights
Depending on your location, you may have the right to:
- Access: Request a copy of your personal data
- Correction: Request correction of inaccurate data
- Deletion: Request deletion of your account and data
- Portability: Request your data in a portable format (JSON)
- Objection: Object to certain processing of your data
To exercise these rights, please visit our support page and select "Privacy Request" as the category, or email us at [email protected]. We will respond to your request within 30 days (or sooner if required by applicable law).
8. Information for EEA and UK Users (GDPR)
If you are located in the European Economic Area (EEA) or United Kingdom, the General Data Protection Regulation (GDPR) provides you with additional rights regarding your personal data.
8.1 Legal Basis for Processing
We process your personal data based on the following legal grounds:
| Processing Activity | Lawful Basis |
|---|---|
| Account creation and authentication | Contract performance (Art. 6(1)(b)) |
| Gameplay, scoring, and leaderboards | Contract performance |
| Payment and subscription management | Contract performance |
| Email verification and password reset | Contract performance |
| Push notifications (game events) | Consent (Art. 6(1)(a)) |
| Analytics (Amplitude) | Consent |
| Marketing emails | Consent |
| Crash reporting (Sentry) | Legitimate interest (Art. 6(1)(f)) |
| Fraud and cheat prevention | Legitimate interest |
| Security (rate limiting, abuse prevention) | Legitimate interest |
| Tax and legal record keeping | Legal obligation (Art. 6(1)(c)) |
8.2 Your GDPR Rights
In addition to the general rights above, you have the right to:
- Withdraw consent: Where processing is based on consent, withdraw it at any time
- Restriction: Request restriction of processing in certain circumstances
- Lodge a complaint: File a complaint with your local data protection authority
8.3 International Data Transfers
Your data is primarily hosted on servers in Germany (EU) via Hetzner. Some data may be transferred to the United States through our service providers (Stripe, Sentry, Mapbox, Firebase, Cloudflare, Mailgun). When we transfer data internationally, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission or reliance on adequacy decisions where applicable.
9. Information for California Users (CCPA/CPRA)
If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide you with specific rights regarding your personal information.
9.1 Categories of Information We Collect
In the past 12 months, we have collected the following categories of personal information:
- Identifiers: Username, email address, IP address
- Commercial information: Subscription and transaction records
- Internet activity: Gameplay data, browsing history within our service
- Geolocation data: General location derived from IP address
- Inferences: Skill level, gameplay preferences based on activity
9.2 Your California Privacy Rights
As a California resident, you have the right to:
- Know: Request disclosure of what personal information we collect, use, and share
- Delete: Request deletion of your personal information (subject to certain exceptions)
- Correct: Request correction of inaccurate personal information
- Opt-out: Opt out of the "sale" or "sharing" of personal information
- Non-discrimination: Not be discriminated against for exercising your privacy rights
9.3 Sale and Sharing of Personal Information
We do not sell your personal information for monetary consideration. We do not share your personal information for cross-context behavioral advertising purposes. If our practices change, we will update this policy and provide an opt-out mechanism.
9.4 Exercising Your Rights
To exercise your California privacy rights, visit our support page and select "Privacy Request" as the category, or email [email protected]. We will verify your identity before processing your request. You may designate an authorized agent to make requests on your behalf.
10. Children's Privacy (COPPA)
GeoWrecked is intended for users aged 13 and older. We do not knowingly collect personal information from children under 13. If you believe we have collected data from a child under 13, please contact us immediately at [email protected].
Users between 13 and 16 years of age (or the applicable age in their jurisdiction) should have parental or guardian consent before creating an account. We comply with the Children's Online Privacy Protection Act (COPPA) and similar laws globally.
11. Automated Decision-Making
We use an automated ELO rating system to match you with opponents of similar skill levels in duel mode. This system calculates your rating based on match outcomes and opponent ratings. No decisions with legal or similarly significant effects are made solely through automated processing. You can request human review of any rating adjustment through our support page.
12. Security
We implement industry-standard security measures to protect your data, including:
- Encrypted password storage using industry-standard hashing algorithms
- Secure HTTPS/TLS connections for all data transmission
- JWT-based authentication with secure token handling
- Regular security audits and vulnerability assessments
- Secure cloud infrastructure with encryption at rest (EU-hosted)
However, no system is completely secure, and we cannot guarantee absolute security. We encourage you to use a strong, unique password and keep your login credentials safe.
13. Data Breach Notification
In the event of a data breach that affects your personal information, we will:
- Notify affected users as soon as reasonably possible
- Notify relevant data protection authorities as required by law (within 72 hours for GDPR)
- Provide information about the nature of the breach and steps you can take
- Take immediate steps to mitigate the impact and prevent future incidents
14. Do Not Track and Global Privacy Control
We honor the Global Privacy Control (GPC) signal as a valid opt-out request under CCPA/CPRA. If your browser sends a GPC signal, we will treat it as a request to opt out of any data sharing that qualifies as a "sale" or "sharing" under California law.
For the Do Not Track (DNT) browser signal, there is currently no universally accepted standard for how to respond. You can control tracking through our cookie preferences and your browser settings.
15. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will:
- Update the "Last updated" date at the top of this page
- Post a notice on the game or website
- Send an email to registered users for significant changes
Your continued use of the Service after changes become effective constitutes acceptance of the updated policy. We recommend reviewing this policy periodically.
16. Contact Us
If you have questions about this Privacy Policy, our data practices, or wish to exercise your privacy rights, please contact us:
- Email: [email protected]
- Support page: geowrecked.com/support (select "Privacy Request" for data access, deletion, or correction requests)
We aim to respond to all inquiries within 30 days. For EEA/UK users, you also have the right to lodge a complaint with your local data protection supervisory authority.