1. Data controller
whodunlie.com. Contact: privacy@whodunlie.com.
2. Playing without an account
You can play without signing up. In that case no personal data reaches our servers. Your progress (cases solved, attempts, hints and time), the visual theme and whether you have seen the welcome message are kept in your browser alone, in localStorage. You can clear them at any time from your browser settings.
3. Data we process if you create an account
- Identification: your email address and, if you sign in with Google, the name and profile picture Google gives us.
- Play history: for each case solved, the date, whether you solved it, the attempts, the hints used and the time taken. When you create the account we import the history stored in your browser once.
- Notification preferences: whether you want the new-case alert, the streak reminder or the news emails.
- Technical session data: session identifier, creation and expiry dates, IP address and user agent, needed to keep you securely signed in.
4. Purpose and legal basis
- Providing the service (account, history, statistics, streak): performance of our relationship with you as a user (art. 6(1)(b) GDPR).
- Sending you alert, reminder or news emails: your consent (art. 6(1)(a) GDPR), which you can withdraw at any time from Your account or with the unsubscribe link in every email.
- Sending your sign-in link by email (magic link): performance of the service.
We do not profile you, make automated decisions or sell data.
5. Recipients and processors
We use these providers to run the service; they act as processors:
- Vercel (application hosting and execution of the server functions).
- Neon (the database holding accounts and history).
- Resend (sending emails).
- Google (signing in with your Google account, if you choose that option). Google processes your data under its own privacy policy.
Some of these providers may process data outside the European Economic Area (in particular, in the United States). Where that happens the transfer relies on the EU-US Data Privacy Framework or on standard contractual clauses approved by the European Commission.
6. Retention
We keep your account data for as long as you keep the account active. If you ask us to delete it, we remove the account, the history and the associated preferences. Sessions expire and are deleted automatically. Technical server logs are kept for a short period for security purposes.
7. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to privacy@whodunlie.com. To delete your account and all associated data, write to us from the address you signed up with. If you believe the processing does not comply with the law, you can complain to the Spanish Data Protection Agency (aepd.es).
8. Cookies and local storage
This site uses no analytics, advertising or third-party cookies, which is why it shows no cookie banner. It only uses:
- Session cookie (technical, strictly necessary): created only when you sign in, it keeps you identified and expires on its own or when you sign out.
- localStorage (technical): game progress, visual theme (light or dark) and the flag for having seen the welcome message. It never leaves your browser.
If you sign in with Google, Google may set its own cookies during authentication, on its domain and under its policy.
To know how many people visit the game we use Vercel Web Analytics, which measures visits in aggregate and anonymously: it uses no cookies or persistent identifiers, cannot recognise a person across visits, and is not shared with third parties for advertising.
9. Changes
If this policy changes we will update the date shown above. Significant changes will be communicated to registered users by email.