Privacy policy
Last updated 13 October 2026. Applies to spanzo.app and everything served from it.
Spanzo is a free daily estimation game. You can play it without an account and without telling us who you are. This policy explains what we collect, why, who processes it for us and what you can do about it. Short version: gameplay is tied to a random ID, not to you; an email address only exists if you choose to sign in; we never sell personal data.
Who is responsible
The data controller is the operator of Spanzo, reachable at [email protected]. Write to that address for any privacy question or request; we answer within 30 days.
What we collect and why
- Gameplay data: your guesses, round scores, totals, streak, completion times and the questions you were shown, linked to a random player ID that we store in a cookie. We need this so a refresh does not lose your game, so leaderboards can rank you and so a friend can play the same rounds. Legal basis: performing the service you asked for.
- Display name (optional): the name you type when challenging a friend. It is shown to the people you send the link to and on the daily leaderboard. Choose something you are happy to make public; we may remove names that are offensive or impersonate others.
- Account data (optional): your email address, if you sign in. We use it to send you a sign-in link, to keep your streak and stats across devices and to attach a Pro subscription to you. There is no password. Legal basis: performing the service; we send no marketing email without a separate opt-in.
- Question reports: if you tap “Report” on a round, we record the question, the reason you chose and your player ID so we can check and fix the fact.
- Payments: Pro is sold by Lemon Squeezy as the merchant of record. Lemon Squeezy collects your billing details and card and is responsible for them; we receive only your subscription status, order and customer identifiers and the email used at checkout, which we keep to switch Pro on and off. We never see or store your card number.
- Technical data: our hosting provider's servers log the IP address, user agent, requested URL and timing of each request for security, abuse prevention and debugging. We keep these logs for a limited period (no more than 30 days) and do not join them with gameplay data.
- Product analytics (when enabled): anonymous events such as “daily completed” or “challenge opened”, with a random device ID, so we can see which parts of the game work. Until you tap “OK” on the cookie notice, no analytics identifier is persisted on your device; “Essential” keeps it that way. Legal basis: consent (identifier) and our legitimate interest in improving the game (aggregate counts).
- Advertising (free players only): see “Advertising” below. Pro players see no ads and no ad is ever requested for them.
Cookies and local storage
We keep this list current; nothing else is set by Spanzo itself.
nd_pid: your random player ID (strictly necessary, 1 year, HTTP-only).sb-*-auth-token: your sign-in session, only after you sign in (strictly necessary, HTTP-only).nd_admin: only on the operator's own admin login; never set for players.nd.v1(local storage): your settings, local stats and streak on this device;nd.consent: your cookie choice.- Third-party cookies from Google when ads are shown to you (see below) and from Lemon Squeezy on its checkout pages.
You can clear all of it by clearing site data in your browser. Doing so signs you out and resets the guest progress stored on that device.
Advertising
Free games are supported by ads from Google AdSense: a banner at the bottom of the Daily intro, results, stats, leaderboard and how-to-play screens, a box at the end of the results report and, on large desktop screens only, one tall ad beside the Daily board. Never on phones or tablets during the five rounds, never on a friend's challenge invitation and never for Pro players. Google, as a third-party vendor, uses cookies (including the DoubleClick cookie) to serve ads based on your visits to this and other sites. Ads are requested as non-personalised unless you tap “OK” on our cookie notice; in the EEA, UK and Switzerland personalised ads are only shown after you consent through Google's certified consent tool, where you can also withdraw consent. You can opt out of personalised advertising at Google Ads Settings and read how Google uses data from sites that use its services at policies.google.com/technologies/partner-sites. If we change ad network we will update this section before the change takes effect.
Who processes data for us
We use a small number of providers under written data-processing terms. They only act on our instructions.
- Railway (hosting of the application and request logs, European Union region).
- Supabase (database and sign-in service, United Kingdom region).
- Resend (delivery of sign-in emails).
- Lemon Squeezy (payments, as merchant of record and independent controller for billing data).
- Google AdSense (advertising to free players) and, when enabled, PostHog (product analytics, United States).
Some of these providers are outside the European Economic Area. Where that is the case, transfers rely on the provider's standard contractual clauses or an adequacy decision.
How long we keep data
- Guest gameplay data: for as long as the player ID cookie exists, then up to 24 months of inactivity before deletion.
- Account data: until you delete your account or ask us to; subscription records for as long as tax and accounting rules require.
- Question reports: until the question has been reviewed, then anonymised.
- Request logs: short retention as described above. Analytics: up to 12 months, aggregated afterwards.
Your rights
Depending on where you live you can ask us to access, correct, export, restrict or delete your personal data, object to processing based on legitimate interest, and withdraw consent at any time without affecting earlier processing. Email [email protected] from the address you signed in with; we verify requests that way and reply within 30 days. You can also complain to your local data-protection authority. We do not sell personal information and do not use it for automated decisions with legal effects. Residents of California and similar states: choosing “Essential” on the cookie notice is our “do not share” control for advertising.
Security
Everything is served over HTTPS only; session cookies are HTTP-only; answers are scored on our servers and never sent to your device before you lock a guess; payment data never reaches us. No system is perfectly secure, so if you believe your account has been misused tell us immediately.
Children
Spanzo is a general-audience game and is not directed at children under 13 (or the higher age your country sets for consent, 16 in parts of the EU). We do not knowingly collect personal data from them; Pro requires an adult or a parent's consent. If you believe a child has given us an email address, write to us and we will delete it.
Changes
We may update this policy as the game evolves. Material changes are announced on this page with a new date, and, for signed-in players, by email where the law requires it.