trioGuess privacy policy

1. Who looks after your data

The people responsible for your data (the “controllers”, LGPD art. 5, VI) are João Lázaro Coré and Luiz Renato Morandi Borges, the individuals who created and run trioGuess.

Contact for any privacy matter: luizrmb@icloud.com.

As small-scale data processing agents, we are not required to appoint a data protection officer (Resolution CD/ANPD No. 2/2022, art. 11). This email is our channel for you and for Brazil's National Data Protection Authority (ANPD).

2. What data we use

• Player identifier: when you open the game, we create a random code, with no name or email, to store your guesses. It stays in your browser or device and in our database.
• Name: the name you enter the first time you open the game. It appears on the daily summary you can share and, if you have an account, on the leaderboard. It can be a nickname.
• Country: inferred from the language set on your device or browser. It appears as a flag next to your name on the leaderboard.
• Guesses and results: your guesses, the date and time of each one, your average error for each day, your history and your streak of days played.
• Account (optional): email and password. Our account provider stores the password only as an irreversible code (a “hash”); nobody, including us, can see it. If you sign in with Google or Apple, we receive your email and an account identifier from them (and your name, when the service sends it); we never receive your password for those services.
• Leagues: the names of the leagues you create or join, and who is a member of each.
• Preferences: language, measurement system (metric or imperial) and your session data, stored only in your browser or device.
• Technical data: IP address, date and time of access and browser or device type, recorded automatically by the providers that host the game, so that it works and stays secure.

We don't ask for documents, phone numbers, addresses, precise location or sensitive data (art. 5, II). We don't use tracking cookies, audience analytics or advertising, and we don't sell data.

3. What we use it for and on which legal basis

• Running the game: storing your guesses, showing results, history, streak and stats, and creating and keeping your account. Legal basis: providing the service you chose to use (art. 7, V).
• Leaderboard and leagues: account holders appear on the world leaderboard with their name, flag, average error, days played and streak; in leagues, members see the same information about each other. Appearing on the leaderboard is part of having an account: you can't have an account without appearing. If you don't want to appear, play without an account, or use a nickname. Legal basis: providing the service (art. 7, V).
• Security, abuse prevention and backups: only as needed. Legal basis: legitimate interest (art. 7, IX).

4. What is public and what isn't

Other players can only see the name, flag, average error, days played and streak of account holders, on the world leaderboard and, for members, in leagues.

We never show other players your guesses, your email or your identifier. The daily summary image is created on your device and only leaves it if you decide to share it.

5. Who we share it with

We use these providers (“processors”), which handle data on our behalf and only to run the game:

• Supabase (Supabase Inc.): database, accounts and storage of game images, on servers in Canada.
• Vercel (Vercel Inc.): website hosting, with servers in the United States and other countries.
• Google (Google LLC) and Apple (Apple Inc.): only if you choose to sign in with an account from them.

We don't share your data with anyone else, unless the law or a competent authority requires it.

6. Transfers to other countries

Because these providers are outside Brazil (in Canada and the United States), your data is transferred to other countries. The transfer is necessary to provide the service you chose to use (art. 33, IX, together with art. 7, V) and is made to providers that commit, by contract, to protect the data.

7. How long we keep it

• Without an account: while you use the game. You can delete everything whenever you want (see section 8).
• With an account: while the account exists. When you delete it, the account and all the data linked to it leave our database right away. Leagues you created go to another member.
• Backup: we keep a daily copy of the database on a computer of one of the controllers, with restricted access. It is replaced every day, so deleted data leaves it with the next copy, usually within a day.
• Technical data: kept by the providers for their own periods, usually a few days.

We will only keep data longer if the law requires it (art. 16).

8. Your rights and how to use them

Under the LGPD (art. 18), you can, at any time and free of charge:

• confirm whether we process your data and access it;
• correct incomplete, wrong or outdated data;
• ask for anonymization, blocking or deletion of unnecessary or excessive data, or data processed against the law;
• ask for portability of your data;
• ask for deletion of your data;
• know who we share your data with;
• object to processing that breaks the LGPD.

How:

• Delete: in the game, under Settings › Privacy › “Delete my account” (or “Delete my data” if you play without an account). It takes effect immediately.
• Correct your name: under Settings › Your name.
• Other requests: email luizrmb@icloud.com. To confirm the request is yours, we may ask you to write from your account's email. We can't identify players without an account; in that case, the safest way to delete your data is in the game itself.

We reply in a simplified form right away or in full within 15 days (art. 19). If you aren't satisfied, you can file a complaint with the ANPD at gov.br/anpd.

9. Security

We use encrypted connections (HTTPS), store passwords only as hashes and have database rules that stop players from seeing each other's data. Running the game requires a login and is restricted to the controllers, and the backup has restricted access (art. 46). If a security incident happens that could bring you relevant risk or harm, we will notify the ANPD and the people affected (art. 48).

10. Children and teenagers

trioGuess is not made for children under 12. If you are responsible for a child who used the game, email luizrmb@icloud.com and we will delete the data. Teenagers can play, and we always process their data in their best interest (art. 14).

11. Changes to this policy

If this policy changes, we will update the date at the top. If the change is important, we will let you know in the game.