Privacy policy

Data controller

Hosting and website access

We host the website with Scaleway S.A.S. on a Dedibox server in the Netherlands. When you visit, the hosting infrastructure processes your IP address and the requested resource to deliver the page. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is operating the website and making it available securely.

Domain registration

The domain is registered with IONOS SE. IONOS processes the domain holder’s registration details for this purpose.

Cookies and browser storage

The website stores your selected language for up to one year in the Games.UrbanCryptics.Language cookie. Progress, revealed clues, your guess and result are saved locally in your browser for each daily puzzle until you clear the website data. Changing language preserves your progress. No registration is required; submitting your first guess creates a guest account. The website serves its own fonts and map data.

Clue media

Images and audio are delivered from private Scaleway object storage in Paris, France, using temporary links. Scaleway processes your IP address and the requested file to deliver the media. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is providing puzzle clues.

Contacting us

When you write to us, we process your contact details and the contents of your message to handle your request. The legal basis is Article 6(1)(b) GDPR for contract-related enquiries and otherwise Article 6(1)(f) GDPR. Our legitimate interest is responding to your enquiry. We delete this data once the enquiry is resolved, subject to any legal retention requirements.

Guest accounts and game results

Submitting your first final guess creates a guest account with a randomly generated username. We store its identifier, creation time, last game activity, total score, and each game’s date, puzzle revision, guess coordinates, revealed clue identifiers, target and calculated scores. The legal basis is Article 6(1)(b) GDPR to provide the requested game and its progress. The essential first-party UrbanCryptics.Guest cookie contains a random access key; the server stores only its SHA-256 digest. Access lasts 180 days and is renewed by game requests. After 180 days without game activity, access expires; the guest account and results are deleted during the daily cleanup. Clearing cookies or ending a private browsing session can lose access; recovery without the access key is unavailable. For access or deletion requests, use the contact details above; we verify entitlement without asking you to disclose the access key by email.

Administrator sign-in

When an administrator signs in, we use an essential session cookie. The session ends at sign-out or after two hours at the latest.

Your rights

Subject to the conditions in the GDPR, you have the right to access, rectify, erase, restrict processing and receive a portable copy of your data. You can object to processing based on legitimate interests under Article 21 GDPR and lodge a complaint with a data protection authority, such as the Bavarian State Office for Data Protection Supervision (BayLDA).