← Back to LingoGuessr

Privacy Policy

TODO – fill in before publishing This page is a placeholder scaffold. The technical description (which services are embedded) is taken directly from LingoGuessr's actual code and should be accurate – the legal wording, controller details, and legal bases must be filled in and reviewed by you (or, if you prefer, by a lawyer or a generator like eRecht24) before this page goes live. Note: if you have users in the EU/EEA, GDPR applies regardless of the site's language.

1. Data controller

[Name / company name]
[Street and house number]
[Postal code and city]
Email: [email address]

2. Services LingoGuessr actually embeds

Automatically identified from the code – please double-check This list is based on the external connections the site currently actually makes.

Google Fonts

The typeface "Plus Jakarta Sans" is loaded directly from Google's servers (fonts.googleapis.com, fonts.gstatic.com) when the page loads. This transmits visitors' IP addresses to Google (USA). In the EU this is considered a data transfer that needs to be disclosed and, depending on jurisdiction, may require consent. [Alternative: self-host the font instead of loading it from Google, which removes this issue entirely.]

Map rendering: Apple MapKit JS (primary) / Leaflet with CARTO map tiles (fallback)

The interactive map primarily uses Apple MapKit JS (connects to Apple's servers). If MapKit isn't available, the site falls back to the Leaflet library with map tiles from basemaps.cartocdn.com (CARTO, map data © OpenStreetMap). Loading these tiles transmits the visitor's IP address to the respective provider.

Supabase (multiplayer backend)

The multiplayer mode (create/join a lobby, live leaderboard) uses Supabase as its backend. This processes: the username chosen by players, lobby codes, round results/scores, and technically necessary connection data (including IP address) for the real-time connection. [TODO: check the Supabase project region (EU or US?), and if needed sign a Data Processing Agreement (DPA) with Supabase and reference it here.]

Browser storage (localStorage)

The following data is stored only locally in the visitor's browser and never sent to a server:

This data can be removed at any time via the browser's settings ("Clear site data").

Voice playback (Web Speech API)

When no real audio file is available, voice samples are played back using the browser's built-in speech synthesis (speechSynthesis). This runs entirely locally in the browser – no data is sent to any server for this feature.

3. Cookies & advertising

TODO – fill in once your ad network is active Fill in the actual network(s) once approved (e.g. Google AdSense, GameMonetize/GameDistribution), and add the consent-management-platform (CMP) details below. If you show ads to visitors in the EU/EEA/UK via Google AdSense, Google requires you to use a CMP that is registered with the IAB Transparency & Consent Framework (Google has its own free option under AdSense → Privacy & messaging) – a plain custom cookie banner alone is not sufficient for Google's own policy, even though it may satisfy GDPR in general.

This site uses a cookie consent banner to ask for your permission before any non-essential cookie is set. Until you actively accept, only strictly necessary cookies/local storage (see section 2, "Browser storage") are used.

Once you accept, this site and its advertising partner(s) [name the network(s), e.g. Google AdSense / GameMonetize] may set cookies or use similar technologies to: measure ad performance, prevent showing the same ad too often (frequency capping), and personalize which ads are shown based on your usage of this and other websites. This can involve transferring data (including your IP address) to servers outside the EU/EEA, including in the USA. [Name the specific legal basis you're relying on, e.g. Art. 6(1)(a) GDPR (consent) for non-essential cookies.]

You can withdraw your consent at any time by clearing this site's data in your browser settings, or via [add a link/button to reopen your CMP's consent dialog here once it's wired up]. You can also object to personalized advertising in general via Google Ad Settings and via youronlinechoices.eu.

4. Purposes of processing

[TODO: e.g. providing the game functionality, running the multiplayer mode, error analysis. Add the matching legal basis under GDPR Art. 6 for each purpose, e.g. Art. 6(1)(b) or (f).]

5. Retention period

[TODO: how long is lobby/multiplayer data retained in Supabase? Automatically deleted after the round ends?]

6. Your rights

Under the GDPR, users generally have the right to:

7. Contact for privacy inquiries

[TODO: email address for privacy inquiries, and a data protection officer if applicable.]