GeoGame
Privacy Policy
Last updated: 29 September 2026
GeoGame (geo-game.io) is a free daily geography game operated from Switzerland. This policy explains what personal data we process, why, and what rights you have. We collect as little as possible: you can play the game without creating an account at all.
1. Playing without an account
If you just play, your progress, statistics and preferences (theme, difficulty, units) are stored in your browser (local storage) and are deleted when you clear your browser data. Our hosting provider processes your IP address technically to deliver the site (see section 7).
Two things do reach our servers even without an account:
- Your finished daily round. When you solve — or give up on — the daily round, we record the result (date, difficulty, number of guesses, solve time) under an anonymous guest number such as "guest37738" so that the day's leaderboard shows how much is being played. Your browser keeps a random identifier for this in local storage; we do not store your name, email address or IP address with it. We keep an approximate country (country code only, derived from your IP address on the fly) for the flag next to the guest number. If you later create an account, the guest result is replaced by the one on your account.
- 1v1 duels. A duel is played on our server: the name you type, the countries you guess and the round results are stored for that match and deleted automatically after 7 days of inactivity. Your duels also count toward the Party Elo leaderboard: as a guest you are listed under the same anonymous guest number as your daily results (the name you type is never shown on the board), with a rating and win/draw/loss counts that we keep under that random identifier — no name, email address or IP address.
- Parties. A party is a group game played through one invite link. The name you type, the countries you guess and the points of each round are stored for that party under a random token, and deleted automatically after 3 days of inactivity. Parties have no rating and appear on no leaderboard; the other players in the party see your name, your number of guesses and how close your best guess is, never the countries you guessed.
2. Data we store when you sign in
An account is only needed for the public leaderboards and private leagues. Depending on how you sign in, we store:
- Sign-in with Google, GitHub, Facebook or Reddit: your account identifier at that provider, your display name and — where the provider shares it — your email address. We never receive your password, and we get no access to your contacts, posts or other provider data.
- Email & password account: your email address and a cryptographically hashed version of your password (bcrypt). We cannot read your password in clear text.
- Game data: your daily results (date, number of guesses, difficulty, solve time, and whether you solved the round or gave up), an optional public display name you choose, league memberships, and an approximate country derived once from your IP address (country code only, used for the flag next to your name — you can override or remove it in your profile).
- 1v1 duels: if you play a duel while signed in, your rounds are rated against your opponent's: we keep a rating (Elo-style), your win/draw/loss counts and a history of rating changes so the Party Elo leaderboard works. The match itself (guesses, names) is deleted after 7 days of inactivity; the rating and its history stay while your account exists.
Your display name, country flag and results appear on the public leaderboards; your email address is never shown publicly.
3. What we use the data for
We use this data solely to run the game: keeping you signed in, ranking the leaderboards (daily, all-time and Party Elo), running leagues, running duels, and preventing duplicate daily submissions. We do not sell personal data, we do not show ads, and we do not use your data for profiling.
4. Cookies and local storage
We use a small number of strictly necessary cookies: a session cookie that keeps you signed in and a security (CSRF) cookie during sign-in. One advertising-measurement cookie may be set by the Reddit Pixel (see section 6) — you can turn it off at any time. Game preferences live in local storage as described above.
5. Analytics
We use Vercel Analytics and Vercel Speed Insights to understand aggregate usage (page views, performance). These are privacy-friendly: they set no cross-site tracking cookies and store no personal profiles; visitors are counted via short-lived anonymised identifiers. We also keep our own aggregate counters (visits per day by device type, country and traffic source, and how often game events happen — rounds started, solved or given up, duels played, whether a sign-up prompt was seen or clicked, how often the main buttons are pressed) — plain tallies with no cookies and no identifiers, so they cannot be traced to any person. Only the two site operators can see them, in a private dashboard.
Page loads, people and bots. For every page that is loaded — also by search-engine, AI and other crawlers — we count, per day, what kind of visitor asked (a browser or a named bot, judged from the browser identification string your browser sends anyway), its device class, operating system, browser, preferred language, country (from a header added by our host; never your address) and which page. Only the counter is stored. We do not store the IP address, the identification string itself, cookies or any identifier, so the tallies cannot be linked to a person.
Anonymous game records. To improve the game we keep, for each finished round, a record of which country was hidden, which countries were guessed in which order and after how many seconds, how the round ended, the difficulty, and — for solo rounds — your device class and country, and whether you were signed in. Times are rounded (whole seconds per guess, 10 seconds for the round). The record contains no account, guest number, name or e-mail address, we do not link it to any of them, and only the two site operators can see it. Duel and party rounds are copied the same way when the round ends.
6. Advertising measurement (Reddit Pixel)
To understand whether our advertising on Reddit works, we use the Reddit Pixel (Reddit, Inc.), which sets a cookie and reports your visit to Reddit. It records only the page visit — no account data, no game data. You can turn it off at any time via the "Cookie settings" link in the page footer; once turned off, no advertising script loads and no data is shared with Reddit. Details on Reddit's processing are in Reddit's privacy policy. The game itself remains free of ads.
7. Hosting and where your data lives
The site is hosted by Vercel Inc. (USA/EU edge network); account and game data are stored in a PostgreSQL database operated by Neon Inc. Both act as our processors and may process data outside Switzerland and the EU/EEA; transfers are safeguarded by standard contractual clauses and equivalent mechanisms.
8. Third-party sign-in providers
When you use a social sign-in, the provider (Google, GitHub, Meta /Facebook, Reddit) processes data under its own privacy policy. We only receive the basic profile fields described in section 2.
9. How long we keep data
Account and game data are kept while your account exists so the leaderboards and your history keep working. Anonymous guest results are kept with the day's leaderboard history. Duel matches are deleted after 7 days of inactivity and parties after 3 days. The anonymous counters and game records (section 5) are kept for about 13 months. If you want your account and all associated data deleted, contact us (section 11) and we will remove them; the anonymous records are not linked to you and stay.
10. Your rights
Under the Swiss Federal Act on Data Protection (FADP) — and, where it applies, the EU GDPR — you have the right to access the data we hold about you, have it corrected or deleted, object to its processing, and receive a copy in a portable format. Contact us and we will respond within 30 days. You may also complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or your local supervisory authority.
11. Contact
For any privacy request or question, contact the site operator at: privacy@geo-game.io
12. Changes
We may update this policy when the game changes. The current version is always available at this address, with the date above.