Privacy notice

[COMPANY NAME, ADDRESS] (“we”) is the controller of your personal data. Questions or requests: support@nextstopgoal.com.

TODO: add an EU and/or UK representative here if the company is established outside the EU/UK.

• No ads, no third-party analytics, no tracking pixels. We never sell your data.
• You can play without an account. We only need your email address if you choose to sign in.
• Your leaderboard name is a random pseudonym, never your email. You can change it.
• You can delete your data at any time in Settings → Delete my data.

All of these are strictly necessary or remember a choice you made, so we don't show a cookie banner.

TODO: confirm the PECR / ePrivacy “strictly necessary” exemption covers lang and units.

• When you play (no account needed): your random device ID; for each question, the point you tapped on the map, the distance and your points; when each question was shown and answered; your daily total. We use this to score your round on our server, keep it if you reload, work out your streak and stats, and spot automated play.
• If you sign in: your email address; a random leaderboard name (for example “Panenka123”) that you can change; your language; and whether you want reminder emails. In our database, your sign-in code is stored only as a hash, for up to 10 minutes. Rounds you played on this device are linked to your account.
• The public leaderboard: if you're ranked, your leaderboard name, score and total distance off are shown to everyone on that day's board.
• Product events: a few first-party in-app events (for example: the Share button was pressed, the reminder prompt was shown or tapped, the intro was finished) with the date and a code derived from your device ID that changes every day, so events can't be linked across days. We only look at them as totals, such as shares per 100 players.
• Name reports: if you report a leaderboard name, we store which account was reported, the name at the time, when, and your device ID (one report per device per account), so we can review it and prevent abuse.
• Reminder log and consent record: the days we emailed you a reminder, so you never get two on one day, and when and where you turned reminders on or off, so we can show your consent.
• Server logs: our hosting provider keeps standard technical logs (such as IP address, browser type and the page requested) for security and troubleshooting.

We don't store your IP address in our database. The game does not ask for your real name, phone number, contacts or location. Your taps are points on a map about the clue, not where you are. If you email us, we receive the information you choose to include in your message.

• Contract (UK GDPR / EU GDPR Art. 6(1)(b)): running the game, your account, streaks, stats and the leaderboard.
• Consent (Art. 6(1)(a)): reminder emails. You can withdraw it at any time with the unsubscribe link in every email or in Settings.
• Legitimate interests (Art. 6(1)(f)): keeping the game secure and fair, handling name reports, server logs and aggregate product statistics.

TODO: confirm the legal bases and document a legitimate interests assessment.

We use these service providers:

• Hosting: Railway — EU West (Amsterdam) runs the website.
• Database: Turso — AWS eu-west-1 stores the game and account data described above.
• Email: Resend sends your sign-in codes and, only if you opt in, daily reminders through its Ireland (eu-west-1) sending region. Every reminder has a one-click unsubscribe link.
• Domain and support email: Cloudflare provides DNS and Email Routing for our domain. Messages sent to support@nextstopgoal.com are forwarded to our private Gmail inbox, provided by Google. This involves handling your sender address, message content, attachments and delivery information so we can receive and answer your request.

Map tiles: your browser loads the map directly from OpenFreeMap (tiles.openfreemap.org). Like any website you visit, that server can see your IP address and browser details. We don't send it anything else.

Fonts are self-hosted by Next.js, so your browser doesn't contact Google Fonts.

We don't share your data with advertisers. We'll disclose it only if the law requires us to.

Resend stores email metadata, logs and API records in the United States. Choosing its Ireland sending region does not change where those records are stored. Our safeguard for international transfers is [TRANSFER SAFEGUARD].

TODO: confirm and document the applicable safeguard (EU–US Data Privacy Framework and UK extension, or SCCs / IDTA) after reviewing Resend's data processing agreement. Also confirm the applicable transfer terms and data locations for Railway, Turso, Cloudflare and the Gmail inbox; the website and database regions do not establish where all provider records or support messages are processed.

• Account (email, leaderboard name, preferences): until you delete it, or [RETENTION PERIOD] after your last visit.
• Rounds, guesses and scores: [RETENTION PERIOD], or until you delete your data.
• Sign-in codes: up to 10 minutes. Sessions: up to 180 days. Anti-abuse counters (hashed IP address, device or email, never stored in the clear): up to 2 days.
• Product events and name reports: [RETENTION PERIOD]. If you delete your data, reports you made are kept without your device ID and reports about your account are deleted.
• Server logs: [RETENTION PERIOD].

Under the UK GDPR and the EU GDPR you can ask to access, correct, delete, restrict or port your data, object to how we use it, and withdraw consent at any time.

• Delete: Settings → Delete my data immediately removes your account, your rounds, scores and streak, including rounds played without signing in on devices linked to your account. If you're not signed in, it removes this device's rounds; sign in first to delete an account. Reports you made are kept without your device ID.
• Correct: change your leaderboard name in Settings.
• Stop reminders: use the unsubscribe link in any reminder, or Settings.
• Anything else: email support@nextstopgoal.com. We'll reply within one month.

You can also complain to a data protection authority: the ICO in the UK, the AEPD in Spain, or the authority where you live.

Next Stop Goal is for people aged 13 and over. We use privacy-friendly defaults for everyone: random pseudonyms, no profiling and no ads. If you think a child under 13 has signed up, email support@nextstopgoal.com and we'll delete the account.

TODO: confirm the minimum age with counsel. The digital age of consent is 13 in the UK but 13–16 across the EU (14 in Spain, 16 in Germany and the Netherlands). Decide whether signing in needs a higher age or parental consent in some countries.

Cookies are signed and httpOnly. Our database stores sign-in codes and session tokens only as hashes, and the site is served over HTTPS. No system is perfectly secure, so if you spot a problem please tell us at support@nextstopgoal.com.

If we change this notice we'll update the date at the top. If a change is significant, we'll also tell signed-in players by email.