Privacy Policy

Archived snapshot: this is the previous published text labelled 7 October 2026, preserved on 9 October 2026. It is no longer current. Read the current privacy page.

Effective date: 7 October 2026

You can play without an account. Account features save progress and may make your chosen player identity and results public. Optional Google advertising measurement is off until you accept it. Feedback and contact messages are used to handle your request; permission to reply is separate from permission to advertise.

Data controller

World Clue is operated by Emil Edvardsson, an individual based in Sweden, who is responsible for the personal data described here. For privacy, data-rights or legal requests, email [email protected] or use the contact form. You do not need an account to contact us. Account help is available at [email protected]; general and business enquiries can be sent to [email protected].

Purposes and legal bases

Account signup means agreement to the Terms of Use and acknowledgement of this policy; it is not blanket consent to every processing activity. We use the following legal bases for the stated purposes:

• Performance of a contract (Art. 6(1)(b) GDPR) for login, account, saved results, profile, leaderboard, and season features requested under the Terms.
• Legitimate interests (Art. 6(1)(f)) for service security, abuse prevention, maintaining fair competitive results, limited first-party service analytics, investigating suspected cheating, and receiving and handling feedback, support requests and appeals. Collection is limited to those purposes; you can object to processing based on legitimate interests.
• Consent (Art. 6(1)(a)) for optional Google Ads conversion measurement. Google Ads personalisation is disabled. Refusing or withdrawing consent does not require account deletion.
• Legal obligation (Art. 6(1)(c)) when necessary to answer or document a legally required data-protection request.

A support or legal request may also be handled to provide an account service you requested or to comply with a legal obligation. The form's optional reply checkbox records your preference about follow-up on that message; it is not marketing consent or a condition for sending feedback or exercising your rights. We may send a response required to handle a legal request even if optional follow-up is disabled.

Account data

When you create a World Clue account we store the following personal data:

• Display name — shown publicly on leaderboards, public profiles, and related game features. If you sign in with Google and do not change your display name, it will be abbreviated (e.g. "FirstName L.") on public surfaces to limit exposure of your full name.
• Email address — used for login and, if you permit a reply, for replying to messages you submit while signed in; not displayed publicly.
• Password hash — your password is hashed with PBKDF2 and never stored in plain text.
• Avatar URL — imported from Google if you sign in with Google; otherwise none.

We also store your competitive-mode request, public-profile setting, any scheduled season and date for competitive re-entry, the timestamps used to enforce each setting's 24-hour cooldown, and season ranges excluded after a voluntary opt-out. For the versioned fair-play announcement, we store the notice version and the time your account acknowledged it. These records implement account features and do not expand the gameplay results or fair-play telemetry collected during a daily game.

Google sign-in

If you choose "Continue with Google", World Clue receives limited profile information from Google (name, email and profile picture) to authenticate you, create or recognise your account, and display its identity. A Google photo may appear in your own account button; public player identity uses World Clue flairs. A matching email alone does not automatically link Google sign-in to an existing password account. We do not request your Google contacts, calendar or other Google services.

Google's own privacy policy governs how Google processes your data: policies.google.com/privacy.

Gameplay results

Where private games with friends are available, match settings, player names, revealed clues, guesses and other game actions are saved in participants' browsers. Signed-in participants also receive a private account history, visible only to them even when their profile is public. These games do not affect competitive leaderboards or rewards. Lobby chat is not included in saved match history. Rooms and chat expire after 24 hours without connected players. Account deletion removes your ownership of saved histories and anonymises your display name in shared histories retained for other participants; matches with no remaining account owner are deleted. Participants may retain independently downloaded copies.

World Clue stores submitted gameplay results for features such as score distributions, game history, public profiles, leaderboards, seasons, and progress restoration. Submitted data includes the game date, score and ranking data, completion status, and related result details. If you are logged in, results are linked to your account.

For anonymous players, separate result-integrity controls may derive non-public hashed identifiers from request metadata. Hash-based identifiers are pseudonymous personal data, not anonymous or inherently unidentifiable data.

Daily-game fair-play telemetry

Fair-play telemetry applies only to the current daily game, not archive or practice games. Every current-daily start receives a random attempt identifier. For guests, we record the start and completion and a date-scoped HMAC of the exact IP address supplied by Cloudflare. The raw IP address is used in memory to calculate the HMAC and is not stored or intentionally logged by World Clue.

For an account that has accepted the current Terms and acknowledged this policy, we additionally process a random browser-device cookie, its date-scoped HMAC, accepted country guesses, selected bonus answers, per-round guess and bonus response times, and page lifecycle events. Lifecycle events show when the page became hidden or visible and when it was exited, shown, or resumed. They cannot establish whether you changed tab, minimized the browser, locked a device, received a call, or left for another reason. Missing or blocked telemetry is treated as unknown and is not independent evidence of cheating.

Guess and bonus durations both begin when the round starts. A guess duration ends only when a valid accepted guess is submitted; the bonus duration ends when its answer is accepted. We store client monotonic durations, limited client event times, and server receipt times. We do not use continuous heartbeats.

Date-scoped IP and device HMACs let authorised reviewers compare attempts made on the same game date. They do not contain the original value and cannot be decrypted, but they remain pseudonymous personal data because matching and singling out may still be possible. Raw telemetry is restricted to authorised operational access. A person reviews the full evidence before any fair-play sanction; there are no solely automated cheating decisions or automatic bans.

A confirmed human review may be converted to a coarse feature signature containing only duplicate-count buckets, timing histograms, hidden-duration buckets, and exit/resume buckets. A confirmed-cheating cohort is retained only when at least ten cases share a signature; a general-population baseline requires at least fifty. Cohorts contain only signature, schema version, and count—never account or attempt identifiers, hashes, exact dates or times, answers, names, notes, or free text. Undersized cases are discarded at expiry. Indefinite cohort retention is permitted only after a documented re-identification-risk review confirms that the aggregate is no longer personal data.

Public profile and leaderboard data

If you use account features, parts of your profile and score history may be visible to other users. Public surfaces can include your display name, avatar, joined date, leaderboard position, scores, season rewards, and game history summaries. Your email address is not displayed publicly.

You can disable your public profile, which limits profile access to your own signed-in account and also disables competitive mode. You can separately disable competitive mode while keeping your profile public. Voluntary opt-out periods are excluded from competitive rankings and rewards, while eligible historical entries are shown under “Private player” when competitive mode or public-profile visibility is disabled. Gameplay results, personal statistics, match history, and score-distribution placement continue to be stored and remain available to you.

If an administrator applies a competitive blacklist after manual review, we store the account concerned, the administrator identifier, written reason, time, and any later reversal details. An active blacklist removes the account from current and historical leaderboard and reward calculations but does not delete gameplay results or telemetry. These audit records support fair-play enforcement, appeals, accountability, and accurate reversal of a restriction.

Analytics events

World Clue records limited first-party product events (e.g. page views, game starts, and feature interactions) to understand how the site is used and to improve it. These events can include transient random request identifiers, page paths without query strings or fragments, the referrer's origin rather than its full address, and limited campaign labels. Ordinary analytics does not retain individual advertising-click identifiers. Product-analytics identifiers and campaign attribution are kept only in page memory and are not persisted in cookies, local storage, or session storage. Ordinary analytics events and Daily start/completion analytics are scheduled for deletion after 90 days. The legal basis for this server-side first-party processing is legitimate interests; you can object by emailing [email protected].

World Clue also offers optional Google Ads conversion measurement. It uses Basic Consent Mode v2: advertising storage and advertising user data are denied by default, and the external Google tag is not requested or executed unless you actively accept measurement. Google Ads personalisation, remarketing signals, and analytics storage remain disabled even after measurement is accepted.

If you accept, Google may receive the page URL, referrer, browser and device information, IP-derived location information, advertising click identifiers, and measured events such as a page visit or daily-game start. World Clue does not send Google account email addresses, display names, answers, scores, or detailed game telemetry through the Google tag. The legal basis for Google Ads measurement is consent. Rejecting has no effect on gameplay or account features. You can change or withdraw this choice at any time using the Privacy choices button.

To document your choice, World Clue stores a random consent receipt identifier, decision, notice version, privacy-policy version, decision time, and expiry time. The local preference expires after 180 days, when the site asks again. A matching consent audit event is retained in World Clue's database for up to 24 months. The audit record is not used for analytics or advertising and does not contain your name, email address, advertising click identifiers, or stored IP address.

Feedback and contact submissions

Feedback and contact forms store your message, selected category or topic, submission time, and limited page or game context needed to understand the request. Signed-in messages are linked to your account. If you allow a reply, the server uses your account email when you are signed in, or the email you enter as a guest. When optional replies are disabled, no reply address is stored with the submission. We also record your reply preference, its wording version and the time it was recorded. This permission covers follow-up on that message only and does not subscribe you to marketing.

Messages are used to investigate bugs, correct information, consider suggestions, handle support requests and appeals, or answer legal and business enquiries. Please do not send passwords, identity documents or unnecessary sensitive information. You can withdraw optional reply permission by emailing [email protected] and identifying the message. Direct emails are handled through the relevant mailbox for the same purpose; please use the legal address for privacy requests, the support address for account help, and the contact address for other enquiries.

Country data

The country profiles and related facts shown in World Clue are assembled from public and license-compatible sources. The site is intended for informational and educational use.

Cookies and local storage

World Clue uses the following browser storage mechanisms:

• wc_session — a secure, HttpOnly cookie that maintains your login session. It expires 30 days after it is issued. This cookie is strictly necessary for the account feature to work and does not require separate cookie consent under the ePrivacy Directive.
• __Host-wc_device — a secure, HttpOnly, SameSite=Lax random identifier with a sliding 180-day lifetime, used for Daily fair-play checks after a signed-in account accepts the current Terms and acknowledges this policy. It is ignored for guest attempts. It is separate from optional Google measurement, and is not controlled by the Google privacy-choice buttons. It can also be issued when a signed-in player has disabled competitive mode. Accepting the Terms is not a separate cookie-consent choice.
• Local storage and IndexedDB — store gameplay progress, pending result synchronisation, played-status markers, saved summaries, theme preference, tutorial/update notices, and related in-browser settings so requested game features work between visits. Browser-only progress and downloaded results are not removed by deleting your server account; use your browser's site-data controls to clear local copies. Product-analytics identifiers and campaign attribution are not persisted there.
• worldClueGoogleConsentV1 — a strictly necessary preference and audit-receipt record that stores your Google Ads measurement choice, random receipt identifier, decision time, notice version, and expiry. It expires after 180 days.
• Google advertising storage — only if you accept measurement, Google may set first-party _gcl_* cookies and related conversion-linker storage to associate an advertising click with a game start. Google states that _gcl_* cookies last for 90 days. With no choice or a rejected choice, the Google tag is not loaded and existing accessible _gcl_* storage is removed.

You can reopen the consent control and withdraw optional Google Ads measurement consent at any time. Withdrawal disables further Google measurement and removes accessible Google conversion storage. World Clue account, security, consent-record and gameplay storage is separate. Blocking or clearing site storage may sign you out or remove unsynchronised progress. For questions or objections about fair-play storage, email [email protected].

Third-party services

The site is hosted on Cloudflare Pages and uses Cloudflare Workers and D1. Cloudflare processes requests, including IP addresses and headers, to deliver the service and provides the trusted IP header used for fair-play HMAC generation. Cloudflare may also process request metadata for security and performance under its privacy policy: cloudflare.com/privacypolicy.

Google Ireland Limited provides the optional Google Ads conversion-measurement service. Google Ads personalisation and remarketing remain disabled by World Clue. Read how Google uses information from sites that use its services, Google's Privacy Policy, and the Ads Data Processing Terms.

Data retention

Account data, play preferences, cooldown timestamps, voluntary opt-out periods, fair-play notice acknowledgements, and competitive-enforcement audit records are retained while the account exists, subject to legal and operational requirements. Raw anti-cheat attempts, event telemetry, review records, and personal feature staging are deleted 180 days after the relevant season ends. A game date outside a season expires 180 days after that date. Account-linked telemetry, reviews, preferences, acknowledgements, and enforcement records are deleted when the account is deleted. Game results are unlinked from the deleted account, and account-linked season rewards are deleted.

Existing thresholded, risk-reviewed anonymous cohort counts may remain after account deletion because no source mapping is kept. Account deletion does not create new cohorts or add the deleted account's records to them; its personal feature staging is removed.

• Feedback and contact messages: scheduled for deletion 12 months from submission, or 30 days from submission for messages classified as spam. Account deletion removes linked submissions and reply details, except for a specifically documented legal hold as described below.
• Ordinary product analytics and Daily start/completion analytics: scheduled for deletion after 90 days. Google consent audit events retain their separate 24-month limit; fair-play telemetry follows the season-based rule above.
• Game results: retained for history and score statistics; deleting an account removes the account link rather than every result. Those retained records are not automatically anonymous merely because the link is removed.
• Local and downloaded copies: remain until cleared by the person holding them. We cannot erase a copy another player has independently downloaded.

Cleanup runs daily; expired records are removed in batches, so a backlog or service interruption may delay completion. A message needed for a specific legal obligation or claim may be placed under a documented, time-limited hold. If you delete your account, held messages lose their account link, reply address and technical identifiers; any content still needed for that legal purpose is retained only for the hold, then deleted. Hosting recovery copies and mailbox copies have separate lifecycles, so an active-database deletion does not mean that every backup disappears immediately. Contact us for the applicable retention information and to include identifiable email correspondence in your request.

International transfers

Cloudflare operates a global network, and Google sign-in and optional Google measurement may also involve processing outside the European Economic Area. Their roles and transfer arrangements depend on the service; Cloudflare's safeguards do not cover Google's processing. Provider information is available from Cloudflare's GDPR centre and Google's data-transfer information. Email [email protected] to request information about the safeguards applicable to your data, including a copy where available. Linking a provider's policy is not a guarantee that all processing occurs in the EEA.

Your rights

Under the GDPR and similar data protection laws you have the right to:

• Access — view the personal data we hold about you.
• Portability — export your data in a machine-readable format.
• Rectification — correct inaccurate personal data.
• Erasure — delete your account and personal data.
• Restriction — request restriction of processing in certain cases.
• Objection — object to the processing of your data.
• Withdraw consent — where processing is based on consent, withdraw it without deleting your account; this does not affect earlier lawful processing.

The account export includes linked gameplay records; legal and fair-play acknowledgements; play preferences; competitive enforcement and review records; and account-linked feedback and contact submissions. Use Account settings to export account data or delete an account. The export does not automatically locate guest messages or separate email correspondence. For those records, an objection, restriction request, correction, appeal or any other privacy request, email [email protected] or use the contact form. We may ask for proportionate information to verify your identity; do not send an identity document unless specifically needed and requested.

These rights apply subject to the conditions and exceptions in the relevant law; for example, portability applies to qualifying data processed automatically on consent or contract grounds. We normally respond to a GDPR rights request within one month. If a lawful extension is necessary because of complexity or the number of requests, we will explain it within that first month.

You can complain to Sweden's Swedish Authority for Privacy Protection (IMY), or to the supervisory authority in the EU/EEA country where you live, work, or believe an infringement occurred. You do not have to contact us first.

Minimum age

World Clue accounts are currently for people aged 16 or older. A parental-permission account route for younger players is not currently available. Do not create an account if you are under 16. If you believe a child has provided personal data contrary to this policy, email [email protected] so we can review and address it. A future service for younger players would require its own safeguards and updated information before it becomes available.

Changes

This policy may be updated as the project evolves. Account holders are asked to acknowledge a material new version before their next account-linked Daily game. The 7 October 2026 update identifies the operator, adds direct contact addresses, clarifies reply permission and current storage, and updates message retention, exports and deletion information. Read the previous published-text snapshot. A privacy acknowledgement records that the notice was presented; it does not replace any separate consent required by law.