This explains what Asymptote collects, why, who it is shared with, and how to get rid of it. It is written to be read, not to be survived.
The short version
- We collect your email address, a display name you choose, and how you play.
- There are no advertising trackers and no ad networks on this site. The analytics we use set no cookies, and nothing here follows you anywhere else.
- We never see your card details. Stripe handles payments.
- We never store a password, because there is no password.
- We do not sell or rent your data. Ever.
What we collect
If you play without an account
A guest is given a random identifier stored in a signed cookie so a run can be tied to the browser that started it. It is not linked to a name, an email address or an advertising profile, and guest runs never appear on a leaderboard. We also keep the runs themselves and the answers submitted in them.
If you create an account
- Email address: to sign you in and to contact you about your account or a payment. Provided by you, or by Google if you sign in with Google. If you are on a streak and have not played by 19:00 UTC, we also send one reminder that day, from our own email provider (Namecheap Private Email); turn these off on your profile or from the link in any of them.
- Display name: chosen by you, and public on leaderboards.
- Country: a two-letter country code derived from your IP address at the moment you sign up, used to set your regional price and your leaderboard country. We store only the country code. We do not store your IP address for this purpose, and we do not re-check it later.
- Gameplay: your runs, the answers you submitted, whether each was correct, how long each took, and the totals derived from them: XP, level, streak, titles and badges.
- Payment references: if you buy a Pass, the customer and subscription identifiers Stripe gives us, and your plan status. Not your card number.
- Creator links: if you arrive through a creator’s link (playasymptote.com/r/…), that a visit came through it and, if you sign up, that your account did, so the creator can be paid. To stop fake sign-ups we keep a one-way scrambled form of your network address and browser, never the address itself. Creators see only totals, never who you are. If you join as a creator, we also keep your PayPal email and what you have earned and been paid.
Why we are allowed to hold it
We hold it to run the service you asked us to run: to sign you in, to score your runs, to publish leaderboards, to charge you correctly for your region, and to keep the game fair. For users in the EEA and UK, that is performance of a contract (Article 6(1)(b) GDPR) for everything except abuse prevention, which rests on our legitimate interest in a game that is not overrun by bots (Article 6(1)(f)).
Cookies
Only ones that make the site work. There is no cookie banner because there is nothing to consent to. None of these are used for advertising or cross-site tracking. Our analytics are configured to set no cookies at all, which is why you are not asked about them.
- Session cookies: set by Supabase Auth when you sign in, so you stay signed in. They last up to 400 days unless you sign out.
- Guest cookie: a signed random identifier so a guest can finish a run and see the result. It carries no personal data.
- Creator link cookie: the name of the creator whose link you followed, for 30 days, so that creator is credited if you sign up.
Who we share it with
We use a small number of processors, each doing one job:
- Supabase: the database and authentication. Holds your email, profile and gameplay.
- Vercel: hosting. Processes requests and keeps short-lived operational logs. Also Vercel Web Analytics, which counts page views, and Speed Insights, which measures how quickly pages load on real devices. Neither sets cookies or identifies you.
- Stripe: payments. Holds your card details; we do not.
- Namecheap Private Email: our own email provider. Holds the mail you send us, and sends our emails to you, including streak reminders.
- Google: two separate things. Sign-in, only if you choose to sign in with Google, and only to confirm your identity to us. And Google Analytics, which counts page views so we know whether anyone is finding the site. Analytics runs with storage consent denied, so it sets no cookies, cannot follow you to another site, and cannot build an advertising profile of you. It receives the page you viewed and a truncated IP address.
These providers store data outside Canada, including in the United States and the European Union. Where required, transfers rely on Standard Contractual Clauses. We do not share your data with anyone else, and we do not sell it.
What is public
Your display name, country flag, score, level, badges, streak, and (with a Pass) your title appear on public leaderboards and on share images generated for your runs. Your email address is never public.
How long we keep it
- Account and gameplay data: until you delete your account.
- Guest runs: 12 months, then deleted.
- Payment records: seven years, because tax law requires it, even after account deletion.
Your rights
You can delete everything yourself, right now, from the Account section of your profile. It is immediate and it removes your profile, every run, every answer, and your name from every leaderboard. You can also ask us to show you what we hold, correct it, or send it to you in a portable form: email support@playasymptote.com and we will respond within 30 days.
Under Canadian federal privacy law (PIPEDA) you may complain to the Office of the Privacy Commissioner of Canada. In the EEA or UK you may complain to your local supervisory authority, and you additionally have the rights to object and to restrict processing. In California you have the rights to know, delete and correct, and we do not sell or share personal information as those terms are defined there.
Children
Accounts are for people aged 13 and over (16 in the EEA and UK, or with a parent’s permission). We do not knowingly collect personal information from anyone below those ages. If you believe a child has an account here, email support@playasymptote.com and we will delete the account and everything attached to it, without asking you to prove anything.
Security
All traffic is encrypted in transit. There are no passwords to steal. Answers to problems are never sent to the browser, and the database rejects reads from the public keys entirely. All access goes through our server.
Changes
If this policy changes in a way that materially affects you, we will tell you by email or in the app before it takes effect.
Contact
support@playasymptote.com. See also our Terms and Refund Policy.