Privacy Policy

This policy explains which data Where In The World? collects, what it is used for and what you can do about it. It follows Brazil's General Data Protection Law (LGPD) and, for players in the European Union, the General Data Protection Regulation (GDPR).

1. Who the controller is

Where In The World? is maintained by Marcos Leandro, the controller of the data processed by the service. For any privacy matter, write to [email protected].

2. What we collect

• Account data: e-mail, display name, username and password. The password is stored only as a hash, never as plain text.
• Social sign-in: when you sign in with Google, Discord, X or Twitch, the provider sends us your account identifier, e-mail and name. We never receive your password for those services.
• Game data: games, guesses, scores, level, experience and the maps you create.
• Technical data: IP address, browser and access logs, used for security and to diagnose errors.

We don't collect your device location, contacts, photos or payment data.

3. What we use it for

• Running the game: keeping you signed in, recording games, calculating scores and rankings and showing your profile. Legal basis: performance of a contract, which is the Terms of Service.
• Security: preventing abuse, cheating and automated account creation. Legal basis: legitimate interest.
• Communication: sending account confirmation, e-mail change and password reset e-mails. Legal basis: performance of a contract.

We don't use your data for advertising and we don't sell it.

4. What is public

Anyone can see your profile: display name, username, level, game statistics, ranking positions and published maps. Your e-mail is never shown.

5. Cookies and local storage

We only use what the site needs to work. There are no advertising or tracking cookies.

• Session: keeps you signed in.
• Language: remembers the language you chose.
• Previous page: stores the page of this site you were on, to take you back to it after you sign in.
• Social sign-in: protects the return from the provider against forgery and lasts only while the sign-in happens.
• Theme: kept in the browser's local storage, it remembers whether you prefer the light or the dark theme.

6. Who we share it with

• Google Maps: street imagery and maps are loaded directly from Google, which receives your IP address and browser data, under the Google Privacy Policy.
• Cloudflare Turnstile: checks that the sign-in and sign-up forms are used by a person and not a bot, under the Cloudflare Privacy Policy.
• Social sign-in providers: only when you choose to sign in with one of them.
• Authorities: when required by law or court order.

Some of these services may process data outside Brazil, with the safeguards required by the LGPD.

7. How long we keep it

Account and game data are kept for as long as the account exists. When you delete it, they are erased, except what the law requires us to keep, such as access logs, stored for six months under Brazil's Internet Civil Framework (Marco Civil da Internet). The maps you published are removed along with the account.

8. Your rights

At any time, you can:

• confirm whether we process your data and access it;
• correct incomplete or outdated data;
• request portability or a copy of your data;
• delete your account and the associated data;
• find out who your data is shared with;
• object to processing or file a complaint with Brazil's National Data Protection Authority (ANPD) or the data protection authority in your country.

Display name, e-mail, password and account deletion are on the Edit account page. For anything else, write to [email protected].

9. Security

All communication with the site is encrypted, passwords are stored as hashes and access to data is restricted. No system is completely immune to failures; if an incident affects your data, we will notify you and the authorities as required by law.

10. Children

The service is not intended for children under 13. If we learn that an account belongs to someone under 13, it will be deleted.

11. Changes to this policy

This policy may be updated. The date at the top of the page shows the latest version. If the change is significant, we will let you know on the site or by e-mail.