Privacy Policy

This explains what Asymptote collects, why, who it is shared with, and how to get rid of it. It is written to be read, not to be survived.

The short version

• We collect your email address, a display name you choose, and how you play.
• There are no advertising trackers, no third-party analytics scripts and no ad networks on this site. Nothing here follows you anywhere else.
• We never see your card details. Stripe handles payments.
• We never store a password, because there is no password.
• We do not sell or rent your data. Ever.

What we collect

If you play without an account

A guest is given a random identifier stored in a signed cookie so a run can be tied to the browser that started it. It is not linked to a name, an email address or an advertising profile, and guest runs never appear on a leaderboard. We also keep the runs themselves and the answers submitted in them.

If you create an account

• Email address: to sign you in and to contact you about your account or a payment. Provided by you, or by Google if you sign in with Google.
• Display name: chosen by you, and public on leaderboards.
• Country: a two-letter country code derived from your IP address at the moment you sign up, used to set your regional price and your leaderboard country. We store only the country code. We do not store your IP address for this purpose, and we do not re-check it later.
• Gameplay: your runs, the answers you submitted, whether each was correct, how long each took, and the totals derived from them: XP, level, streak, titles and badges.
• Payment references: if you buy a Pass, the customer and subscription identifiers Stripe gives us, and your plan status. Not your card number.

Why we are allowed to hold it

We hold it to run the service you asked us to run: to sign you in, to score your runs, to publish leaderboards, to charge you correctly for your region, and to keep the game fair. For users in the EEA and UK, that is performance of a contract (Article 6(1)(b) GDPR) for everything except abuse prevention, which rests on our legitimate interest in a game that is not overrun by bots (Article 6(1)(f)).

Cookies

Only ones that make the site work. There is no cookie banner because there is nothing to consent to. None of these are used for advertising or cross-site tracking.

• Session cookies: set by Supabase Auth when you sign in, so you stay signed in. They last up to 400 days unless you sign out.
• Guest cookie: a signed random identifier so a guest can finish a run and see the result. It carries no personal data.

Who we share it with

We use a small number of processors, each doing one job:

• Supabase: the database and authentication. Holds your email, profile and gameplay.
• Vercel: hosting. Processes requests and keeps short-lived operational logs.
• Stripe: payments. Holds your card details; we do not.
• Google: only if you choose to sign in with Google, and only to confirm your identity to us.

These providers store data outside Canada, including in the United States and the European Union. Where required, transfers rely on Standard Contractual Clauses. We do not share your data with anyone else, and we do not sell it.

What is public

Your display name, country flag, score, level, badges, streak, and (with a Pass) your title appear on public leaderboards and on share images generated for your runs. Your email address is never public.

How long we keep it

• Account and gameplay data: until you delete your account.
• Guest runs: 12 months, then deleted.
• Payment records: seven years, because tax law requires it, even after account deletion.

Your rights

You can delete everything yourself, right now, from the Account section of your profile. It is immediate and it removes your profile, every run, every answer, and your name from every leaderboard. You can also ask us to show you what we hold, correct it, or send it to you in a portable form: email support@playasymptote.com and we will respond within 30 days.

Under Canadian federal privacy law (PIPEDA) you may complain to the Office of the Privacy Commissioner of Canada. In the EEA or UK you may complain to your local supervisory authority, and you additionally have the rights to object and to restrict processing. In California you have the rights to know, delete and correct, and we do not sell or share personal information as those terms are defined there.

Children

Accounts are for people aged 13 and over (16 in the EEA and UK, or with a parent’s permission). We do not knowingly collect personal information from anyone below those ages. If you believe a child has an account here, email support@playasymptote.com and we will delete the account and everything attached to it, without asking you to prove anything.

Security

All traffic is encrypted in transit. There are no passwords to steal. Answers to problems are never sent to the browser, and the database rejects reads from the public keys entirely. All access goes through our server.

Changes

If this policy changes in a way that materially affects you, we will tell you by email or in the app before it takes effect.

Contact

support@playasymptote.com. See also our Terms and Refund Policy.