How ViralTakes handles your data

Your streak, today’s progress and your recent results are stored in your browser (local storage) on the device you play on. Nothing identifies you to us. Clearing site data in your browser removes it.

If you create an account we store your email address and a password hash (or your Google sign-in link, if enabled) with our database and authentication provider, Supabase, plus the username you choose. Your email is never shown to other players and never appears on leaderboards or profiles.

With an account, your official Daily Challenge results and standalone game results are saved to your account so they follow you between devices and count on the leaderboards. They contain scores, dates and which game you played — not your typed answers.

Your public profile shows aggregate statistics only. You can make it private from your account page, after which it shows nothing but your username.

Party rooms and friend challenges work without an account. When you join as a guest we store the nickname you type, a random guest identifier, your answers for that room, your scores and a “last seen” time on our server, so the room can keep everyone in step and let you rejoin after a refresh. Your browser keeps a signed session token for each room you join (local storage); it identifies your seat in that room only, cannot be used elsewhere, and expires within twelve hours. Nicknames are shown to the other people in the room and, for a challenge, to everyone who opens that challenge link.

Rooms are deleted about four hours after they are created (finished rooms are kept for a day so results can be viewed); challenges are deleted seven days after they are created. Nothing from a room is added to the public leaderboards. If you play a room or a challenge while signed in, the result is linked to your account for XP and achievements.

Room codes are only a way to find a room. They are not secrets and do not prove who you are; do share them only with the people you want in the room.

Subscriptions are sold by Paddle, our merchant of record. Paddle collects your payment details, billing address and tax information and processes the payment. We never receive or store card numbers. We store the identifiers we need to know whether your subscription is active: a Paddle customer id, a subscription id, its status and its paid-through date, plus a short log of the billing notifications we received.

Paddle’s own privacy policy applies to the checkout and to the customer portal where you manage payment methods, receipts and cancellation.

If you allow analytics in your privacy settings, ViralTakes measures how the site is used with its own analytics, run on our own servers and database rather than by an analytics company. Before you decide, or if you decline, nothing is collected.

With your permission we store:

• a random visitor ID kept in your browser’s local storage (not a cookie) and a random ID for each visit;
• the pages you open, as paths only: no query strings, and room codes, challenge codes and usernames are replaced by placeholders; and how long each page was visible;
• how you arrived: the domain of the site that linked to us (never its full address) and any campaign tags in the link;
• a device type (phone, tablet or computer), browser family, operating-system family and browser language, worked out from what your browser sends; the full browser string is not kept;
• game events such as “game started” or “Daily completed” with scores and player counts, page-speed measurements (Core Web Vitals), and the type of any error the page hit (never its message or what you typed);
• if you are signed in, a link from your visits to your account, so we can count active players.

We do not store your IP address in analytics, do not fingerprint your device, do not use cookies for analytics and do not sell or share analytics with advertisers. Detailed records are deleted after 90 days; only daily totals without personal data are kept longer. Withdrawing consent in privacy settings stops collection and deletes the visitor ID from your browser.

Separately, to run the service our server keeps daily counts that contain no personal data (for example how many Party rooms were created, or how often a page returned an error), and, like every website, our servers see your IP address when you connect; it is used briefly to protect the site from abuse and is not part of analytics. If an external analytics provider is ever configured, it receives the same product events, under the same permission, and never your email, answers, nicknames, codes or payment details.

The free plan may show ads from Google AdSense where advertising is switched on for the site. Google and its partners may use cookies or similar technologies under their own policies to show and measure ads; see Google’s partner-sites policy. In the EEA, the UK and Switzerland the consent message you see is provided by a Google-certified consent platform; personalised advertising is not used until you have agreed to it there, and you can change your choice at any time from “Privacy settings” in the footer. ViralTakes+ members never see ads and the ad code is not loaded for them.

Necessary storage keeps you signed in and keeps the game working: your session, your streak and progress, and your privacy choice itself. Optional storage (the analytics visitor ID described above, advertising, personalisation) is only used after you allow it.

Privacy settings lets you change your choice at any time.

Our database and authentication run on Supabase (hosted in the EU region we selected for the project). Payments are processed by Paddle. Facts about films (titles, years, cast) come from public sources and are not personal data.

• Change privacy choices at any time with Privacy settings.
• Make your profile private from your account page.
• Cancel ViralTakes+ from Manage billing on your account page.
• Ask us to export or delete your account data by contacting us at the address below; deleting your account removes your profile, results and billing links from our database (Paddle retains the records it is legally required to keep).

Operator: operating entity and address to be completed before launch

Support: support address to be published before launch

Questions about privacy, or a request to export or delete your account data: write to the support address above. See also the contact page.