Privacy Policy

1. Scope

The public website provides project information, a Word Hunt demo, playtest signup, and a contact form. Visiting the website or playing the demo does not create an app account or join an online room. Information about account and match data applies when you use those app features.

This policy applies to witloop.app, the waitlist form, the WitLoop app, guest and registered profiles, rooms, matches, and messages sent to us.

WitLoop is an evolving platform for short games. Features may change, so we update this policy before using data in a new and material way.

2. Who is responsible for your data

WitLoop is the name of a project developed by individuals, not a separate incorporated company. The controller identified in this document is responsible for personal data.

The data controller is controller details to be completed, address: address to be completed.

For privacy matters, use the contact form below or in the website footer. We have not appointed a data protection officer. If we appoint one, their contact details will be published in this document.

3. Data we process

4. Why we use data and our legal bases

5. Whether you must provide data

• Joining the waitlist is optional. Without an email, we cannot send an invitation or launch update.
• Guest profile and gameplay data are needed to create a player, join a room, and calculate results.
• An email is needed only to create or recover a registered account and carry over guest progress.
• Country, optional analytics consent, and support details are voluntary.

6. Analytics, logs, and cookies

The website uses essential local storage to record the version, date, and expiry of your choice and whether you consent to optional analytics. This record contains no unique identifier and is not sent to the server on its own. Without it, we would have to ask on every visit.

The website is prepared to use Google Analytics 4 (GA4), loaded and managed through Google Tag Manager (GTM). In a given deployment, these tools operate only when WitLoop has configured them and the user has consented. They help us understand how visitors use the website, which sections and actions are useful, whether the demo and form work correctly, and how to improve performance. We do not use them for advertising, remarketing, or cross-service profiling.

We use basic Consent Mode: before consent, the GTM and GA4 scripts are not downloaded and no analytics requests are sent to Google. After consent, we grant analytics_storage only; ad_storage, ad_user_data, and ad_personalization remain denied.

GA4 may set the first-party cookies _ga and _ga_<identifier> to distinguish users and persist session state. Their default lifetime is up to 2 years and may be shortened by browser settings. Google receives the IP address during the connection; according to Google, for EEA traffic it is used to derive approximate location and then discarded before it is logged in Analytics.

You can accept, reject, or later change consent through the cookie settings button in the footer. Withdrawal does not affect the lawfulness of earlier processing and does not restrict the website's or game's core functions.

The app stores settings and session data locally as required to provide the service. The device's secure storage holds the guest secret and refresh token. We do not access other device data without a legal basis and the appropriate permission.

Essential server events such as profile creation, room entry, match start, and match result help operate and assess the service. If we introduce additional analytics or marketing tools, we will update the information and provide the appropriate, separate consent choices before activation.

7. Who may receive data

We disclose only what is needed to run WitLoop. Recipients may include hosting and cloud, database, email, error monitoring, logging, and support providers, as well as legal or accounting advisers.

Where GA4 is active and the user has consented, analytics data is received by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, the provider of Google Analytics 4 and Google Tag Manager, and Google's approved subprocessors. Google processes the data under the applicable data processing terms for measurement services.

We may also disclose data to public authorities when required by law. We do not share user lists with advertising partners and do not sell data.

8. Transfers outside the EEA

We prioritise processing in the European Economic Area. Some technology providers may nevertheless process data in the United States or other countries.

According to Google, Analytics data from users in the EEA is first collected through domains and servers based in the EU, but Google and its processors may then process it outside the EEA, particularly in the United States.

Where this happens, the transfer relies on a legally recognised mechanism, in particular an adequacy decision under the EU-US Data Privacy Framework where applicable, or European Commission Standard Contractual Clauses with supplementary safeguards. We will provide information about the applicable safeguard on request.

9. How long we keep data

10. Your rights

To exercise a right, send a request through the contact form. You can use “Privacy” as the subject and describe your request in the message. To withdraw consent to playtest messages, identify the email address used at signup. We may ask only for information needed to confirm that the request concerns the right person. We generally respond within one month.

• access to data and a copy
• correction of inaccurate data
• deletion or restriction of processing
• portability of data processed automatically on consent or contract
• objection to processing based on legitimate interests
• withdrawal of consent at any time
• a complaint to the Polish Data Protection Authority or your local supervisory authority

11. Children and family play

WitLoop is intended to work for family play, but the service is not designed to collect children's consent independently. In Poland, where consent is the legal basis for processing a child's data in an online service, a person under 16 needs a parent or guardian to give or authorise that consent.

If you believe a child provided data without the required consent, report it through the contact form. We will investigate and delete the data unless another legal basis requires us to retain it.

12. Automated decisions

We do not make solely automated decisions about you that produce legal or similarly significant effects. Automatic scoring, ranking, and progress are game mechanics, not decisions under Article 22 GDPR.

13. How we protect data

We use safeguards appropriate to risk, including encrypted connections, hashed secrets and tokens, limited session lifetimes, access control, request limits, backups, and service monitoring. No method is completely secure, so we review safeguards and respond to incidents regularly.

14. Policy changes and contact

We publish the current version at a stable address with its revision date. If a change materially affects how we use data, we will notify you in the app, on the website, or by email depending on its importance and the contact details available.

Send privacy questions, requests, and comments through the contact form available in this document and in the website footer. The address entered in the form is used to reply to your request; sending a message does not sign you up for playtests or give marketing consent.