Privacy policy.
01Who is responsible
The data controller is S.C. UnlockIT S.R.L., registered at Strada Coltei 44, Sector 3, București, Romania; tax identification number (CUI) 50182863, Trade Register number J2024011135407. For any privacy question or to exercise your rights, contact support@unlockit.ro.
02What we collect & why
| Data | Why | Legal basis |
|---|---|---|
| Email, username/alias, password (stored only as a one-way hash) | To create and secure your account and sign you in | Contract |
| Password-reset and email-confirmation token digests, and delivery metadata | To send and securely complete a password reset you request, and to confirm that your email address is yours | Contract / legitimate interest |
| Newsletter: your email, the announcements you asked for (every new room, or one coming room), where you signed up, when you confirmed, and an unsubscribe token | To email you when a new room opens — only after you confirm the address, one short email per room | Consent |
| Purchases / bookings on your account, and for a paid booking the record Paddle sends us: its transaction ID, the room, the amount and currency, and its status, and for the complete file the room bookings left on your account (which room, until when, and when one was used) (never card details) | To give you access to the sessions you booked, to match a payment to its room, and to handle refunds and our bookkeeping | Contract / legal obligation |
| Game session state: progress, hints used, inventory, room, and in-game chat messages | To run multiplayer sessions and let teammates sync and reconnect | Contract |
| Technical data (IP address, request times) used transiently for rate-limiting and abuse prevention | To keep the Service secure and available | Legitimate interest |
| Public-page counts: page path, referring site, campaign tags and screen category. No cookies, IP address or visitor identifier is stored in these counts. Page views are not counted when your browser sends Do Not Track or Global Privacy Control | To understand how people find the site | Legitimate interest |
| Game-performance samples (quality level, frame rate, graphics chip) and game milestones (a room booked, started or finished, a hint used). Milestones carry a session ID which can be linked to accounts or guest seats through the session record; they are not anonymous merely because the event omits names and emails | To identify gameplay and performance problems | Legitimate interest |
We do not collect special-category data, and we do not build advertising profiles.
03Cookies & local storage
We do not use advertising or analytics cookies. The Service stores a few functional items in your browser's local storage: your sign-in token and basic profile, session clues, puzzle drafts and the latest result, plus preferences such as audio, display mode and room brightness. Signing out clears account and session data from that browser while keeping device preferences. You can also use “Clear this browser’s game data” in your profile. Page visits are counted without cookies and without storing anything in your browser.
A functional session cookie records whether this browser session is still open for the “Keep me signed in” choice. It contains no account identifier or authentication token and has no explicit expiry; browsers may restore session cookies when restoring a previous browsing session. Session storage also keeps a tab's sign-in separate when another tab changes accounts.
04Who processes data for us
- Supabase (database) — stores your account and session data as our processor under a data-processing agreement.
- Render (application hosting) — runs the servers that answer your requests; they see the technical data above while handling them.
- Resend (email delivery, when enabled) — receives your email address and delivery metadata only for an email you asked for: a password reset, a link to confirm your email address or a newsletter sign-up, and, if you opted in, the announcement of a new room.
- Paddle (Paddle.com Market Ltd, our reseller and Merchant of Record for paid bookings) — collects your email address, country, payment details and billing data directly in its checkout, takes the payment, handles sales tax and refunds, and sends your receipt, as an independent controller under its own privacy notice. We receive the transaction record described above; we never see or store card details.
05International transfers
Where a processor stores data outside the EEA, we use a legally recognized transfer mechanism where required, such as an adequacy decision or the EU Standard Contractual Clauses. Contact us for current processor-location and transfer-safeguard details.
06How long we keep it
We keep account data while your account is open. Completed or abandoned sessions are retained as part of your case history until you delete your account; in-game chat lines are deleted after 90 days. Transient technical data (rate-limit counters) is short-lived and is not stored long-term. Password-reset links expire after 30 minutes and email-confirmation links after 48 hours; only a one-way token digest is stored, and a newer request replaces the previous one.
Newsletter consent is kept until you unsubscribe — every announcement carries a one-click link, and your profile has a switch — or close your account. An address nobody confirmed is deleted after 30 days.
Anonymous page-view counts are deleted after 180 days, performance samples after 30 days and game milestones after 400 days.
The record of a paid booking is kept for as long as accounting law requires us to keep proof of sales. If you close your account, the record stays but is no longer linked to it. Room bookings left from the complete file are deleted with your account.
07Your rights
- Access & portability — download a copy of your data from your profile ("Download my data").
- Rectification — change your password from your profile. To correct your display name or email, contact support@unlockit.ro.
- Erasure — permanently delete your account and hosted sessions from your profile ("Close account").
- Objection / complaint — contact us, or lodge a complaint with your local data-protection authority.
08Security
Passwords are stored only as salted, one-way scrypt hashes; a hash made by our earlier scheme is replaced the next time you sign in. Access to game data requires authentication, and all puzzle validation happens on our servers. We use transport encryption (HTTPS) in production. No system is perfectly secure, but we take reasonable measures to protect your data.
09Children
Accounts are not intended for children under 16 (or below the digital-consent age in their country). A younger family member may participate beside a supervising adult account holder, but must not create an account or receive the adult's credentials. If you believe a child has registered, contact us and we will remove the account.
10Changes
We may update this policy. The new version will be posted here with an updated date; we will flag material changes where reasonable.