Privacy policy

Spotrep stores as little as it needs to run the game. No ads, no tracking cookies, no selling of data.

Who is responsible

The data controller is The operator of Spotrep.

What we store and why

• Your account. A random account id, created when you first play. If you add an email, we store it to sign you in and to send sign-in links. Legal basis: our contract with you (GDPR art. 6(1)(b)).
• Your games. Games, answers, scores, timings, streak and training progress, so we can score fairly, show your results and schedule your training. Basis: contract.
• Your callsign and daily scores are shown on the public leaderboard (you can turn that off on your account page), and on result pages you choose to share. Basis: contract.
• Your level and Merit. XP is worked out from your games. We keep a record of the Merit you earn and spend, the items you hold and the insignia and reticle you use; your insignia is shown next to your callsign on the leaderboard. Basis: contract.
• Problem reports you send about a round (reason and an optional note). Basis: legitimate interest in correct content (art. 6(1)(f)).
• Payments. If you buy Pro, Stripe handles your card details; we never see them. We store your Stripe customer id and subscription status. Stripe and we keep payment records as Danish bookkeeping law requires (5 years). Basis: contract and legal obligation (art. 6(1)(c)).
• Page statistics. We count page views with Vercel Web Analytics, which uses no cookies and doesn’t identify you across sites. We remove game ids and query strings from the addresses first and don’t count account or admin pages. Basis: legitimate interest in knowing which pages are used.
• Security. To stop abuse we count requests per player and per network address. The address is stored only as a salted one-way hash and is deleted within a day. Our hosting provider keeps short-lived server logs. Basis: legitimate interest in keeping the service secure.

We don’t use analytics or advertising cookies. The only cookies keep you signed in, and they are strictly necessary, so there is no cookie banner.

Who processes data for us

• Supabase (database, sign-in and image storage), hosted in the EU (Frankfurt).
• Vercel (web hosting and cookieless page statistics). Requests may pass through servers outside the EU, covered by the EU Standard Contractual Clauses and the EU–US Data Privacy Framework.
• Stripe (payments), only if you subscribe.

Each acts on our instructions under a data processing agreement.

How long we keep it

Account and game data are kept until you delete your account. Guest accounts that haven’t been used for 12 months may be deleted. Payment records are kept for 5 years as required by law. Security counters are deleted within a day.

Your rights

You can see, download and delete your data yourself on the Account page (“Download my data” and “Delete my account”). You can also ask us to correct data, restrict or object to processing. You can complain to the Danish Data Protection Agency (Datatilsynet, datatilsynet.dk).

Children

Spotrep is not meant for children under 13. If you think a child has created an account, contact us and we will delete it.

Changes

We will update this page if what we store changes, and tell signed-in players about important changes. Last updated 10 October 2026.