In short

• You can play every game without an account and without giving us your name or email.
• We keep your rounds and drawings, because the games and the maps are built from them. Your drawings are shown on the maps without any name. Your handle appears on leaderboards only if you sign in.
• We do not store your IP address, do not use advertising or tracking cookies, and do not sell or share your data.
• If you have an account, write to enquiries@habibicode.org to get a copy of your data or have it deleted. If you play without one, nothing we keep is tied to you: see your rights.

Who we are

Habibi Code, Geneva, Switzerland. Contact: enquiries@habibicode.org. We handle your data under the Swiss Federal Act on Data Protection, and the EU’s GDPR where it applies to you.

When you play

Signed in or not, your browser gets a random id, stored on your device. With it, we keep:

• your rounds: the puzzle, your answers, guesses and drawings, your score and how long you took;
• if you choose to tell us, the country you are from and the one you live in (kept in a cookie for two years, and with your drawings and rounds);
• any name you type yourself: on the Letter Pairs board or in a city game party. That name is shown to other players.

If you play without an account, none of this is tied to you: we do not have your name or email.

When you sign in

You can sign in with Google or X. On top of what any player’s rounds keep, we keep:

• an id from Google or X, so we know it is you next time;
• your handle: your @username on X, or the nickname you pick;
• a link to your profile picture;
• with X, your display name.

We never store your email address from Google or X. Your handle and picture appear on leaderboards and your profile. Rounds you played on this browser before signing in are moved to your account.

Signing in sets a session cookie that keeps you signed in. It is needed for the site to work and is used for nothing else.

When you buy a game pack

Packs are sold by Dodo Payments on our behalf. When you open the checkout, we send Dodo your name and the email address your Google or X sign-in gives, so the form is filled in for you, and your account id, so the pack goes to the right account. You can change the name and email in the form. Dodo takes your payment, your billing address and your country, and sends your receipt; we never see your card.

We keep which packs your account owns, when, and Dodo’s reference for the payment. We do not keep your email address, your billing address or anything about your card. A refund removes the pack, and its record, from your account. See the terms for what a pack is and how refunds work.

The Daily Digest email

If you subscribe, we keep your email address, whether you confirmed it, and, if you subscribed while signed in, which Habibi Code account it belongs to, so the email can show your own results. Each email has a link to unsubscribe in one click. When you unsubscribe, we stop sending at once and delete your address and everything stored with it.

Your address is stored encrypted. Anyone looking at our database, or at a copy of it, sees scrambled text; it is decrypted only at the moment the email is sent to you.

The emails are sent by Resend, from their servers in Ireland.

Cookies and storage on your device

• Session cookie: keeps you signed in. Only set when you sign in.
• Home country cookie: the countries you chose, for two years. Clear it from the game’s menu.
• Your browser’s own storage: your progress, streaks, results and settings, so the games remember them. It stays on your device; clearing your browser’s data removes it.

No advertising or tracking cookies.

Counting visits

We count visits with Umami and Vercel Web Analytics. Both work without cookies and without identifying you: they tell us how many people visited a page and which site sent them.

Who else handles data

• Vercel hosts the site.
• Neon hosts the database.
• Google and X, when you sign in with them.
• Resend sends the Daily Digest email.
• Dodo Payments sells our apps and our games’ packs and handles tips. We never see your card; we learn that a sale happened, and for a pack, which account bought it.
• Google Fonts, OpenFreeMap and Amazon Web Services serve fonts and map pictures that your browser loads directly. Like any website, they see your connection when they do.

How long we keep it

Rounds and drawings are kept, without your name, as part of the games’ history and maps. Account details, and the packs your account owns, are kept while your account exists. Your email address is kept while you are subscribed, and deleted the moment you unsubscribe. An address that is never confirmed is deleted after a week.

Your rights

If you have an account or subscribe to the Daily Digest, you can ask for a copy of what we hold about you, for it to be corrected, or for it to be deleted: write to enquiries@habibicode.org from the email or account concerned.

If you play without an account, nothing we keep is tied to you, so we cannot pick out your rounds to send or delete them. Clearing your browser’s data removes the only link between you and them.

You can also complain to the Swiss Federal Data Protection and Information Commissioner, or to your own country’s authority.