Privacy Policy

REPODLE is an independent fan project that operates the website repodle.com and is funded by advertising. The operator of the site is the data controller for the processing described here, within the meaning of Art. 4(7) GDPR and Article 3 of Turkish Law No. 6698 on the Protection of Personal Data (KVKK). Every privacy request — access, erasure, objection or anything else — goes to repodle@outlook.com. We answer within one month of receipt (Art. 12(3) GDPR); if a request is unusually complex we may extend that by two further months and will explain why within the first month.

REPODLE has no accounts, no registration and no contact forms, so we never ask you for a name, an e-mail address or any other identifying detail. Three kinds of data still occur. First, your game progress, statistics and settings, which are written only to your own browser's local storage and are never transmitted to us. Second, the guesses you submit, which reach our game server so it can score the round and add one to an anonymous daily solve counter — they are not stored against you and are linked to no identifier. Third, technical connection data, above all your IP address, which our server unavoidably sees for every request. Our advertising and analytics partners collect further data in their own right; sections 05 and 06 describe that.

Running the game and returning your guess results is necessary to provide the service you asked for (Art. 6(1)(b) GDPR). Protecting the server against flooding and abuse rests on our legitimate interest (Art. 6(1)(f) GDPR; Art. 5(2)(f) KVKK): your IP address is held in memory by a rate limiter for a few minutes at most and is never written to a database, an access log or any file. Analytics and personalised advertising happen only if you consent (Art. 6(1)(a) GDPR, Art. 5(3) ePrivacy Directive, § 25 TTDSG, Art. 5(1) KVKK), and you can withdraw that consent at any time as easily as you gave it.

REPODLE sets no cookies of its own. Your game data lives in local storage under the key 'repodle', and your cookie choice is recorded under 'repodle_consent' so that we do not have to ask again on every visit. Third-party cookies from Google are placed only once you have accepted the relevant category. The Cookie Policy lists every cookie, who sets it, why, and how long it lasts.

Hosting is paid for with advertising served by Google. We run Google Consent Mode v2: until you accept advertising cookies, ads are delivered in non-personalised form — without advertising cookies and without advertising identifiers — and are based only on the content of the page and coarse location. If you accept, Google may use cookies and device identifiers to personalise ads and measure them across sites. Google acts as an independent controller for that processing; its terms are at policies.google.com/technologies/partner-sites, and ad personalisation across all Google products can be managed at myadcenter.google.com.

Google Analytics 4 measures how the site is used in aggregate. It is loaded with analytics storage denied by default, so before consent it neither reads nor writes analytics cookies; after consent it sets the cookies listed in the Cookie Policy. Google shortens IP addresses before storing them. Separately, Vercel Web Analytics counts page views without cookies and without any persistent cross-site identifier; we rely on our legitimate interest for that (Art. 6(1)(f) GDPR), and it cannot be used to recognise you on other websites.

Vercel Inc. hosts the website and serves it from its edge network. The game API runs on a separate host behind api.repodle.com, and the anonymous daily counters are stored in a PostgreSQL database provided by Supabase — that database holds no personal data at all, only per-mode counts and dates. Google LLC serves advertising and analytics. The hosting and database providers act as processors on our instructions; Google acts as an independent controller for its own advertising and measurement purposes. We do not sell data and we share it with no one else.

Our hosting, database and advertising providers are established in, or process data in, the United States. Google LLC and Vercel Inc. participate in the EU-U.S. Data Privacy Framework; where that framework does not apply, transfers rest on the European Commission's Standard Contractual Clauses together with the supplementary measures those providers describe. For visitors in Türkiye, the same transfers rely on your explicit consent or on a standard contract within the meaning of Art. 9 KVKK as amended in 2024. Declining the advertising and analytics categories avoids these transfers entirely.

Game progress and statistics stay in your browser until you clear them — we hold no copy and cannot delete them for you, but clearing your browser storage removes them instantly. Your consent record expires after twelve months, after which you are asked again. IP addresses in the rate limiter are discarded within minutes and never persisted. The daily solve counters are kept indefinitely because they contain no personal data. Retention by Google follows Google's own published periods, listed per cookie in the Cookie Policy.

Under Art. 15 to 22 GDPR you have the right of access, rectification, erasure, restriction of processing, data portability, and objection to processing based on legitimate interest. Under Art. 7(3) GDPR you may withdraw consent at any time, which does not affect the lawfulness of processing carried out before withdrawal. Article 11 KVKK grants you in addition the right to learn whether your data is processed, to learn the purpose and whether it is used accordingly, to know the third parties at home or abroad to whom it is transferred, to request correction, deletion or destruction and that this be notified to those third parties, to object to a result produced solely by automated analysis, and to claim compensation for damage caused by unlawful processing. In practice, because we hold nothing that identifies you, most requests are answered by confirming that no personal record exists; the data that matters is on your own device and under your own control.

If you believe your data has been handled unlawfully, you can lodge a complaint with a supervisory authority. In the EEA this is the data protection authority of your country of residence or place of work (Art. 77 GDPR); in Germany this is the authority of your federal state. In Türkiye it is the Personal Data Protection Authority (kvkk.gov.tr), to which you may apply after first addressing us under Article 13 KVKK.

We do not use your data for profiling or for automated decisions producing legal or similarly significant effects on you within the meaning of Art. 22 GDPR. Ad personalisation, where you consent to it, is carried out by Google under its own terms and does not produce such effects.

REPODLE is not directed at children. In the EEA, consent to cookies and to ad personalisation may be given from the age of sixteen, and some member states set a lower age, down to thirteen. If you are younger than the age that applies where you live, please decline the advertising and analytics categories or ask a parent or guardian to decide with you. We do not knowingly collect personal data from children, and because we ask for no personal data at all, none reaches us.

The site is served over HTTPS only. The game API sits behind our own domain and is rate-limited, and guesses are checked on the server so answers cannot be extracted by brute force. Statistics kept in your browser are obfuscated so that they are not trivially readable or editable, though this is a tamper deterrent rather than a security guarantee, since the key ships with the page. No system is perfectly secure, but we hold no personal data whose loss could harm you.

We may update this policy when the site or its providers change. The date at the top always shows the current version, and a material change resets the cookie banner so that you can review your choices.

Write to repodle@outlook.com about anything in this policy, including requests under the GDPR or the KVKK. Please tell us which right you are exercising so that we can answer within the legal deadline.