Last updated: March 2026
Questions? [email protected]
Guesshh (“we”, “us”, “our”) is a social deduction party game available at play.guesshh.com and on Google Play. Guesshh is available worldwide, with a primary focus on European users. This policy applies to all users regardless of location and covers all data collected via the game, the marketing site at guesshh.com, and any associated services.
The data controller for Guesshh is:
[YOUR FULL NAME] (or [YOUR COMPANY NAME] once a legal entity is registered)
Cyprus, European Union
Email: [email protected]
As data controller, we determine the purposes and means of processing your personal data. For payment processing, Stripe acts as an independent data controller. For cloud infrastructure, Supabase acts as our data processor under a signed Data Processing Agreement (DPA).
A randomly generated UUID created on your device and stored in localStorage. When you play multiplayer or purchase a premium plan, this ID is transmitted to our Supabase servers to manage your session or verify your subscription. Under GDPR, a persistent device ID may qualify as personal data.
When you purchase a premium plan, you complete payment via Stripe at play.guesshh.com. The email address you enter at Stripe checkout is stored in our Supabase database alongside your entitlement record. This email is used solely to restore your purchase access if you change devices, clear your browser data, or lose your device ID via the “Restore Purchases” feature. We do not use this email for marketing or any other purpose.
Language, haptics, and similar settings. Stored in localStorage on your device only - never sent to our servers.
If you purchase a premium plan we store in Supabase: your device ID, your Stripe checkout email, plan type, purchase date, expiry date, and your Stripe customer ID. This is required to verify your access, enable purchase restoration, and fulfil our EU accounting obligations. All payments are processed exclusively by Stripe - we never see or store payment card details.
Temporary data during multiplayer games: room codes, the nickname you choose, and game state. Stored in Supabase and deleted when the session ends or after 24 hours of inactivity.
Whether you confirmed you are 18 or older for the “Mature / Night Mode” category. Stored in localStorage on your device only - never sent to our servers.
When you consent via our cookie banner, GA4 collects anonymised usage data: pages visited, session duration, events (e.g. game started, plan purchased), approximate country, browser type, and device type. IP addresses are anonymised before storage. Loaded via Google Tag Manager (GTM).
Guesshh uses Google Play for app distribution only. All payments are processed through Stripe at play.guesshh.com via Google’s External Offers Program. Google Play does not process, see, or store any payment data for Guesshh transactions. Google Play has access only to standard app distribution and analytics data associated with your Google account, which is governed by Google’s Privacy Policy.
Under GDPR Article 6, we rely on the following legal bases:
| Processing Activity | Legal Basis | GDPR Article |
|---|---|---|
| Verifying premium subscription via device ID | Contract performance | Art. 6(1)(b) |
| Storing checkout email for purchase restoration | Contract performance | Art. 6(1)(b) |
| Retaining purchase & entitlement records | Legal obligation (EU accounting law) | Art. 6(1)(c) |
| Running multiplayer sessions (temporary device ID) | Legitimate interests | Art. 6(1)(f) |
| Google Analytics 4 & GTM analytics cookies | Consent | Art. 6(1)(a) |
| Google AdSense personalised ads (not yet active) | Consent (when enabled) | Art. 6(1)(a) |
| Stripe payment processing | Contract performance | Art. 6(1)(b) |
| Age verification for mature content | Legal obligation | Art. 6(1)(c) |
See our dedicated Cookie Policy for the full breakdown. In summary:
Strictly NecessaryAlways on
device_id, game_preferences, premium_status, cookie_consent - stored in localStorage. Cannot be disabled.
AnalyticsConsent required
_ga (2 years), _ga_XXXXX (2 years) - GA4 via GTM. Only set with your consent.
PaymentStripe
__stripe_mid (1 year) - set by Stripe during checkout for fraud prevention only.
Advertising - Google AdSenseNot yet active
Not currently enabled. No advertising cookies are being set. This policy will be updated before AdSense is activated.
You have the right to withdraw consent at any time. at any point - your choice will be saved immediately.
⚠ Google AdSense: Not Currently Active
The free tier will be supported by Google AdSense. As of this policy’s date, AdSense is not enabled - no advertising cookies are set. This policy will be updated and a new consent prompt displayed before AdSense is activated. Premium subscribers will never see ads.
Guesshh is available globally. We may run advertising targeted at US users through Google Ads or AdSense. Any such advertising will use Google’s infrastructure; data transfers to the US are covered by the EU-US Data Privacy Framework and SCCs. US users should review Google’s Privacy Policy for advertising data details. Meta Pixel, TikTok Pixel, and Google Ads Remarketing are not installed and not active.
Guesshh is operated from Cyprus (EU). Some data is transferred to the US:
To request a copy of applicable transfer safeguards, email [email protected].
As an EU/EEA resident, you have the following rights under GDPR Articles 15–22:
Right of Access (Art. 15)
Request a copy of the personal data we hold about you, including device ID, checkout email, and entitlement records.
Right to Rectification (Art. 16)
Ask us to correct inaccurate data, e.g. if the email stored for purchase restoration is wrong.
Right to Erasure (Art. 17)
Request deletion of your data. Note: purchase and entitlement records including checkout email must be retained for 7 years under EU accounting law.
Right to Restriction (Art. 18)
Ask us to limit how we process your data while a dispute is resolved.
Right to Data Portability (Art. 20)
Receive your personal data in a structured, machine-readable format (e.g. JSON).
Right to Object (Art. 21)
Object to processing based on legitimate interests (e.g. multiplayer session data).
Right to Withdraw Consent (Art. 7(3))
Withdraw consent for analytics or advertising cookies at any time via our cookie banner. Does not affect lawfulness of prior processing.
Right Not to be Subject to Automated Decisions (Art. 22)
We do not use automated decision-making or profiling that produces legal or similarly significant effects on you.
To exercise any right, email [email protected] with the subject “GDPR Request.” We will respond within 30 days.
| Data Type | Location | Retention Period |
|---|---|---|
| Multiplayer session data | Supabase | Deleted on session end or after 24h inactivity |
| Purchase & entitlement records (incl. checkout email) | Supabase | 7 years (EU accounting obligation) |
| Device ID (server-side) | Supabase | Up to 7 years with entitlements, or deleted on request where legally permissible |
| Device ID & preferences | Your device (localStorage) | Until you clear localStorage |
| Age verification result | Your device (localStorage) | Until you clear localStorage |
| GA4 analytics data | Google servers | 14 months (default GA4 retention) |
| Stripe customer records | Stripe | Per Stripe's own retention policy |
We respond to all privacy requests within 30 days.
As a Cyprus-based data controller, our lead supervisory authority is:
Commissioner for the Protection of Personal Data (Cyprus)
1 Iasonos Street, 1082 Nicosia, Cyprus
Website: dataprotection.gov.cy
Email: [email protected]
If you are in another EU member state, you may contact your local authority - full list at edpb.europa.eu. EU users may also use the EU Online Dispute Resolution platform at ec.europa.eu/consumers/odr.
We may update this Privacy Policy to reflect changes in our services, legal requirements, or data practices. We will update the “Last updated” date above. For significant changes - enabling Google AdSense, launching US-targeted advertising, or forming a registered legal entity - we will notify users through an updated cookie consent banner or in-app notice. Continued use of Guesshh after changes constitutes acceptance of the updated policy.