Privacy policy

1. Who is responsible for your data

The data controller is Clueboard (https://clueboard.tech). For data questions contact info@clueboard.tech.

2. What we collect

Email address — to create your account and sign you in by link.

Game progress — your actions in cases (locations visited, evidence, answers, chosen ending), play time and hints used. We need this to let you continue and to show your ending.

Purchase data — which case you bought and when, order status and amount. Card details are handled solely by Paddle; we do not receive them.

Technical data — IP address, browser type, request logs and a session identifier (secure cookie) — for security, abuse prevention and diagnostics.

Marketing source — if you arrive via a link with utm tags, we keep the source and campaign in a cookie for 30 days and record them on your account to understand what works.

Newsletter — if you leave your email in a “notify me” form, we use it only for that.

Feedback and support messages you send us.

3. Why we process it (legal bases)

Providing the service and performing our contract — account, gameplay, payment, access to purchased cases.

Legitimate interests — security, fraud prevention, improving the game, service-wide analytics.

Your consent — news emails (withdraw any time).

Legal obligations — accounting and tax requirements (mainly handled by Paddle as seller).

4. Cookies

We only use essential cookies: a session cookie (to keep you signed in) and a marketing cookie (utm tags, 30 days). We also count anonymous site visits (no IP, no identifiers): only utm tags and the referring domain. There are no advertising trackers or third-party analytics on the site. At checkout Paddle may set its own cookies — see paddle.com for its policy.

5. Who we share data with

Paddle — payment, taxes, receipts, fraud prevention.

Hosting provider (Hostinger) — data storage and servers.

Email provider — delivering sign-in emails.

We do not sell data or share it with ad networks. Some processors may handle data outside Ukraine and the EEA; where they do, we rely on standard contractual clauses or adequacy decisions.

6. How long we keep data

Account data and progress — as long as you have an account. After you delete your account we delete or anonymise your data; payment records are kept for the period required by accounting law (typically 5–7 years). Technical logs are kept only as long as needed for security and diagnostics. Sign-in tokens expire after 15 minutes.

7. Your rights

You may: get a copy of your data (export), correct it, delete your account and data, restrict or object to processing, withdraw consent, and lodge a complaint with a supervisory authority — in Ukraine the Parliament Commissioner for Human Rights, in the EU your national data protection authority.

Export and deletion are available in your account; you can also email info@clueboard.tech — we reply within 30 days.

8. Security

We use HTTPS, store only hashes of sign-in tokens and sessions, rate-limit sign-in attempts, and protect the admin panel with several authentication layers. No system is perfectly secure; if an incident affects your data we will notify you as the law requires.

9. Children

The service is not intended for children under 16 without parental consent. If you believe a child has given us data without consent, email us and we will delete it.

10. Changes

If we change this policy materially we will update the date above and, where needed, notify you by email.