Privacy

What we collect

When you sign in — with Google, Apple, or an email magic link — we store your name, email address, and profile image (when your provider gives us one). We keep a signed-in session cookie so you don't have to sign in on every visit.

While you play we store the guesses you make (map coordinates), the questions you saw, your round scores, your daily streak, and any badges you've earned.

We collect anonymous product analytics on how the game is used — things like which pages you visit, how long a round takes, when the map paints, whether you shared your result. When you're signed in we associate these events with your account; when you're not, they stay anonymous.

Our hosting provider keeps standard request logs (IP address, user agent, request time) for operational and security reasons.

Why we collect it

To authenticate you, remember your progress, build the leaderboard, send you a magic-link sign-in email when you ask for one, prevent abuse, and improve the game by understanding what works and what's broken.

Who else sees it

We use a small number of third-party services to run the game. Each processes only the data it needs to do its job:

• Vercel — hosting, serverless functions, edge caching.
• Neon — Postgres database (your account and gameplay data).
• Google, Apple — OAuth sign-in providers, when you use them.
• Resend — delivers sign-in magic-link emails.
• PostHog — product analytics (us.i.posthog.com).
• Stadia Maps, Esri, OpenStreetMap — map tiles for the globe.

Other players see your public leaderboard entry — display name, score, streak — but not your email address.

We do not sell your data. We do not run ads. We do not share your data with advertisers or data brokers.

Cookies

We use a signed-in session cookie so you stay signed in, and standard security cookies required by the sign-in flow. PostHog sets an anonymous ID cookie so we can tell one visit apart from another. No advertising or third-party tracking cookies.

Data retention

We keep your account and gameplay data for as long as your account exists. If you delete your account, we delete your personal data within 30 days (some hosting logs may persist longer for security and abuse-prevention purposes). Anonymous analytics events may be retained for longer, but are not tied to you personally after deletion.

Your rights

You can ask us to access, correct, export, or delete your personal data. Depending on where you live, you may also have rights under the GDPR, UK GDPR, CCPA, or other privacy laws. To exercise any of these, contact us at the address below.

Children

RealityDrop isn't directed at children under 13, and we don't knowingly collect their information. If you believe we've collected data from a child under 13, contact us and we will delete it.

Changes

If we materially change this policy we'll update the effective date at the top and, when appropriate, notify signed-in players by email.

Contact

Email privacy@realitydrop.app for anything privacy-related.