Privacy Policy

This Privacy Policy explains how the operators of aretheystupid.com (“we,” “us,” or “our”) collect, use, and protect your information when you use our website and services (the “Service”).

By using the Service, you consent to the data practices described in this policy. If you do not agree, please do not use the Service.

Anonymous Users

When you use the Service without an account, we store a session identifier in a secure cookie. This allows us to:

• Track your game progress across sessions
• Prevent replaying the same game for score manipulation
• Display anonymous entries on leaderboards

Registered Users

If you create an account, we additionally collect:

• Email address (for account recovery and optional communications)
• Display name (optional, for leaderboard display)
• Authentication tokens (if using Google or Apple Sign-In)

Game Data

For all users, we automatically collect:

• Games played and final scores
• Guesses submitted during gameplay
• Timestamps of game activity
• Device type and browser information

Technical Data

We automatically collect certain technical information:

• IP address (anonymized for analytics)
• Browser type and version
• Operating system
• Referring website
• Pages visited and time spent

We use collected information to:

• Provide and maintain the Service
• Track game progress and display scores
• Populate leaderboards and statistics
• Prevent abuse, cheating, and unauthorized access
• Improve the Service based on usage patterns
• Send service-related communications (if opted in)
• Comply with legal obligations

We use the following cookies:

We do not use advertising cookies or cross-site tracking. Analytics cookies are only set with your explicit consent.

We share data with the following service providers:

• Supabase: Database and authentication (stores user data securely)
• Vercel: Website hosting (processes requests)
• Google Analytics: Website analytics (with your consent)

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

We implement appropriate technical and organizational measures to protect your information, including:

• Encryption of data in transit (HTTPS/TLS)
• Secure, httpOnly cookies
• Regular security assessments
• Limited access to personal data

However, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security of your data.

• Anonymous session data: Deleted after 24 months of inactivity
• Account data: Retained until you request deletion
• Game history: Retained as long as your session/account exists
• Technical logs: Retained for up to 90 days

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request deletion of your data (“right to be forgotten”)
• Export your data in a portable format
• Object to or restrict certain processing
• Withdraw consent where processing is based on consent
• Lodge a complaint with a supervisory authority

To exercise these rights, contact us at: privacy@aretheystupid.com

For users in the European Economic Area, we process personal data under the following legal bases:

• Contract: Processing necessary to provide the Service
• Consent: For optional communications and newsletters
• Legitimate Interest: For security, fraud prevention, and service improvement

Data may be transferred to servers located outside the EEA. We ensure appropriate safeguards are in place for such transfers.

California residents have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information is collected
• Right to know if personal information is sold or disclosed
• Right to opt out of the sale of personal information
• Right to non-discrimination for exercising CCPA rights

We do not sell personal information as defined by the CCPA.

The Service is not intended for children under 13 years of age (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal information from children under this age.

If we learn that we have collected personal information from a child under the applicable age, we will take steps to delete that information.

Some browsers include a “Do Not Track” (DNT) feature. We respect your choice by requiring explicit consent before enabling analytics cookies. If you reject cookies, no analytics tracking occurs.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on the Service with a new “Last updated” date.

Your continued use of the Service after any changes constitutes your acceptance of the updated Privacy Policy.

For privacy-related questions, data requests, or concerns, please contact us at: privacy@aretheystupid.com

For general legal inquiries: legal@aretheystupid.com