Privacy policy

This privacy policy is a draft and has not yet received legal review. The final version will identify the operator, explain how long data is retained, and provide the relevant regulator details.

What we collect

Account details, session records, purchases and entitlements, investigation progress, submitted answers, and limited security logs. We do not log story email bodies, passwords entered inside a case, answer keys, or payment card details.

Why we use it

To provide accounts, save progress, deliver purchases, prevent abuse, support customers, and understand aggregate product usage. Non-essential analytics should not be enabled until an appropriate consent mechanism is configured.

Processors and retention

Stripe processes payments, while configured email and hosting providers may process operational data. The final policy will name every processor and set out the lawful bases, international transfers, retention periods, and data-controller contact.

Your choices

You may request access, correction, export, or deletion through the account page or support route. Some purchase and fraud records may need to be retained where law requires.