Privacy policy

Data controller

The data controller is the publisher of QuelWord, established in France. For any question, or to exercise your rights: contact@vynse.dev.

Playing without an account

You can play without creating an account. When you do, a random identifier is stored in a technical cookie so the server can hold your game in progress — that's what lets you reload the page without losing the board.

This identifier is not linked to any personal information, is never shared, and games played without an account do not appear on the leaderboard.

Data collected with an account

• ·Email address — required to sign in, which happens by magic link only.
• ·Username — chosen by you, shown publicly on the leaderboard.
• ·Preferred language.
• ·Game history — for each game: the word, mode, language, date, whether you solved it, number of attempts, duration and score.
• ·Aggregate statistics — current streak, best streak, games played, wins, total score.
• ·Referral code, and the person who referred you if applicable.

Why we hold it, and on what basis

Your email address and username are processed to deliver the service you asked for: having an account and appearing on the leaderboard (GDPR art. 6.1.b).

Game history and statistics power your profile, your streak and the leaderboard — they are the service itself.

Usage analytics rests solely on your consent (art. 6.1.a), collected through the banner and withdrawable at any time.

Usage analytics

We use two measurement tools. Neither runs without your agreement.

PostHog, hosted in the European Union, is there to understand the journey through the game: pages viewed, games started and finished, shares, upgrades. Nothing is sent to PostHog until you accept. If you decline, or until you answer, that measurement is switched off entirely — not merely anonymised. You can change your mind at any time through the "Cookies" link in the footer.

DataFast counts visits, where they came from, and ties a purchase back to the visit that brought it — which is how we know which sources keep the project alive. Tying the two together means recognising you between arriving on the site and paying, so it stores an identifier on your device: it needs your consent exactly as PostHog does, and nothing loads until you accept. Withdraw your agreement and the identifiers already stored are deleted.

Cookies we set

qw_guest

Game identifier for signed-out players. Strictly necessary, 1 year, not readable by scripts.

qw_consent

Remembers your analytics choice. Strictly necessary, 6 months.

qw_ref

Set only if you arrive through an invite link, to credit your signup to whoever invited you. First-party, 30 days, no profiling and never shared with third parties.

Supabase cookies

Keep you signed in. Strictly necessary.

PostHog cookies

Set only after you accept, to distinguish visits. Removed if you withdraw consent.

DataFast cookies

Two identifiers (visitor and session) stored only after you accept, to count visits and attribute a purchase to its source. Deleted if you withdraw your consent.

Opt-out flag

A technical flag kept by your browser records that analytics is disabled. It holds no identifier and exists precisely to prevent collection.

Processors

• ·Supabase — database and authentication, data hosted in the European Union.
• ·Vercel — site hosting.
• ·Resend — delivery of sign-in emails. Only your email address is passed to them, and only when you request a link. The provider is established in the United States: that transfer is covered by the European Commission's standard contractual clauses.
• ·Stripe — payment processing. Your card details are entered with Stripe and never pass through our servers: we keep only a transaction identifier, an amount and a currency.
• ·PostHog — detailed usage analytics, in the European Union, only with your consent.
• ·DataFast — visit counting and attributing sales to their source, only with your agreement.

How long we keep it

• ·Account and game history: kept for as long as the account exists. On deletion everything is erased immediately and permanently, including results and leaderboard entries.
• ·Games played without an account: automatically deleted after 30 days.
• ·Payment records: kept for 10 years, as French accounting rules require.

Your rights

You have the right to access, correct, erase, object to, restrict and port your data. Write to contact@vynse.dev and you will get a reply within 30 days.

You may also lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).

Children

The service is not intended for children under 15. No data is knowingly collected about them; if such a case is reported to us, the account is deleted.

Changes

Any change to this policy will be published on this page with a new update date. If a change materially affects your rights, account holders will be notified by email.