Privacy policy

Data controller

The data controller is Michel Moccand-Jacquet, reachable at michel@impulselab.ai. This document covers the whole BK Guessr site and game.

Data collected

BK Guessr collects the minimum the game needs to run:

• Account: email address, display name, hashed password, and where applicable second-factor or passkey data.
• Player profile: nickname, declared country, avatar, distance unit, language, volume, reduced motion and colour-vision mode.
• Games: mode played, rounds, pin coordinates, distance, score, answer time and the outcome of each round.
• Progression: aggregate statistics, daily streak, Elo rating, achievements and titles earned.
• Multiplayer: lobby membership and the messages you send in a lobby.
• Moderation: the photo reports you file.
• Technical logging: the IP address supplied by your browser, used only for rate limiting and never stored in the database.

Playing without an account

Solo mode is playable without an account. In that case a guest session identifier is stored in a strictly necessary cookie so your rounds can be attached to a game. If you later create an account, those games are reconciled with it; the guest profile is then merged and no longer lives on its own.

Legal bases

Processing account and game data rests on performance of the contract that using the service constitutes. Rate limiting and cheat detection rest on the legitimate interest in protecting the game and its rankings.

Cookies and analytics

BK Guessr sets no advertising cookie and no third-party tracker. The only cookies used are strictly necessary: the authentication session cookie, the guest session cookie and the language cookie. They do not require prior consent.

Analytics are handled by Umami, self-hosted, cookieless and without a persistent identifier. It is loaded only on the production deployment; locally and on preview deployments no analytics script is served at all.

Processors

Data is processed by the following providers: Vercel (application hosting), Neon (database), Cloudflare R2 (image storage), Railway (real-time server), Resend (transactional email). No data is sold or handed over for advertising purposes.

Retention

Account and game data is kept for as long as the account exists. Deleting the account immediately erases the profile, games, rounds, statistics, achievements and lobby membership. Moderation sanctions may be kept for the duration of their enforcement.

Your rights

You have rights of access, rectification, erasure, restriction and portability. Two of them can be exercised directly from the player settings page:

• Export my data: downloads all your data as readable JSON.
• Delete my account: permanently erases the account and the data attached to it, with no cooling-off period.
• For anything else, or to lodge a complaint, write to michel@impulselab.ai. You may also contact your national data protection authority.