Privacy Policy
Last updated: 15 October 2026
Who is responsible
The controller for the purposes of the GDPR is GeoPursuit, Sildgasse 1, 1210 Wien, Austria (see the Legal Notice). Contact: support@geopursuit.com.
No Data Protection Officer has been appointed — the nature and scale of the processing does not require one.
What we store, and why
This list is generated from what the application actually writes. If the game starts storing something new, this table is wrong until it is updated.
| Data | Why | Legal basis |
|---|---|---|
| Email address | To sign you in and to send the one-time sign-in link | Art. 6(1)(b) — performance of a contract |
| Provider account identifier (Google, Discord) | Only if you choose to sign in that way, to recognise you next time | Art. 6(1)(b) |
| Display name, country, avatar choices | To show you on the leaderboard | Art. 6(1)(b) |
| Daily results: score, per-round scores, date | Streaks, statistics and the weekly leaderboard | Art. 6(1)(b) |
| Server logs, including IP address | Kept by our hosting providers to operate and secure the service | Art. 6(1)(f) — legitimate interest |
| Visitor counts: page, day, country (from your browser's time zone), referring website, device type (phone/tablet/desktop) | To know how many people visit and from where. Your IP address is not stored; a one-way code made from it, which changes every day, lets us count each visitor once per day without being able to recognise you again | Art. 6(1)(f) — legitimate interest |
| Error reports: when the game hits a technical error, the error message, the page, and your browser type | To find and fix bugs. No account, cookie or IP address is stored with it, and identical errors are only counted | Art. 6(1)(f) — legitimate interest |
Playing as a guest stores nothing on our servers. Your progress in that case lives only in your own browser and disappears when you clear it.
Where it is stored
Our database and authentication run on Supabase, in a data centre in Frankfurt, Germany. The site itself is served by Netlify, a US company whose content-delivery network may serve requests from outside the EU; this transfer relies on the European Commission's Standard Contractual Clauses. Stripe, our payment processor, is also a US company and relies on the same safeguard — see Stripe's own privacy notice.
How long we keep it
- Account data (email, display name, country, avatar, results, streaks) is kept for as long as your account exists. When you delete your account it is removed from live systems immediately; any copies in encrypted backups are overwritten within the normal backup cycle, at most 30 days.
- Server and access logs (including IP address) are deleted after at most 14 days.
- Visitor counts are deleted after 400 days. They contain no IP address and nothing that links one day's visit to another.
- Error reports are deleted after 30 days.
- The age you enter at sign-up is used only to check the minimum age and is not stored.
- Purchase and invoice records for Premium are kept as German commercial and tax law requires (§ 147 AO, § 257 HGB): invoices and accounting records for 8 years, business correspondence for 6 years, counted from the end of the calendar year of the purchase. Deleting your account does not remove these.
Your rights
Under the GDPR you may:
- ask what we hold about you, and get a copy (Art. 15, Art. 20)
- have inaccurate data corrected (Art. 16)
- have your data deleted (Art. 17)
- object to processing based on legitimate interest (Art. 21)
- complain to a supervisory authority (Art. 77)
You can delete your account and export your data yourself from your profile page. You can also write to support@geopursuit.com and we will act within one month.
Cookies and similar technologies
We store a sign-in token in your browser so you stay signed in, along with your language and consent choices. These are strictly necessary for the service to work and are not used to track you.
Visitor counts use no cookies and store nothing in your browser. See the table above for what is counted.
Advertising (Google AdSense). For guests and free accounts we may show ads from Google AdSense, which can set cookies and send data (including your IP address and device/usage information) to Google, where it may be processed in the US. This happens only after you consent. Until then, ad cookies and personalisation are off by default via Google's Consent Mode v2, and consent is collected through Google's certified consent message. You can withdraw consent at any time by changing your choice in that message. Legal basis: your consent (Art. 6(1)(a) GDPR). Premium accounts load no ads and set no advertising cookies.
The authoritative version of our privacy information is the German Datenschutzerklärung.
Children
You must be at least 16 years old to hold an account. Below that age, the consent of a parent or guardian is required in most EU countries. The Daily can be played without an account, as a guest.
Changes
If this policy changes we will update the date at the top and, where the change is significant, tell you in the game.