Privacy Policy

This policy covers wherecast.com and official WhereCast mobile apps that connect to the same service. WhereCast is operated by Burak Ozdemir, a self-employed trader (autónomo) established in Spain, at Calle Puerto 14, 5th floor, 29016 Málaga, Spain. The operator ("we") is the data controller for the information below and uses it to run the game, save progress and protect accounts. Contact us at [email protected] about your information or this policy.

What we collect

• Guest play: a random guest identifier, session identifier, puzzle and guess records, outcomes and timestamps. Guest play is pseudonymous, not fully anonymous: these identifiers let us recognise the same browser or app installation without asking for a name or email.
• Accounts: your email, username, a password hash if you register with a password, verification status, and preferences you provide, such as country, timezone, language and game settings. We do not store your real name. Optional external sign-in provides a provider identifier and email; if the provider also sends your name, we do not keep it. We do not receive your Google or Apple password.
• Mobile sign-in: an account access token, the device label supplied by the app, token creation/usage information and expiry. The server stores a hash of the token. It is not an advertising identifier.
• Technical information: requests may include your IP address, browser or app information, and error or security details processed by our servers and delivery providers. We do not need your GPS location, contacts, photos or advertising identifier to play the game.
• Purchases and support: if you buy an offered premium feature, we keep the customer/order references and entitlement information needed to provide it. Payment providers handle payment details. If you contact support, we receive what you send us.

Guest progress and account sync

Guesses are recorded on our servers as you play, including when you play without signing in. Creating a new account from that guest session saves its available game history to the account, including unfinished games. Signing in to an existing account does not automatically import a device's guest history. Where available in the native app, you can separately choose to keep that installation's server-recorded guest games. Existing account progress takes priority if both histories contain the same puzzle, and guest-origin games never gain leaderboard eligibility through transfer. Account games can be retrieved by signing in to the same account on another device.

Personal streaks are calculated from saved games. Guest-started games, practice replays and older games whose origin cannot be verified do not enter leaderboards. Games started while signed in can qualify. We do not import results claimed by browser storage, offline clients or development installations.

Cookies and device storage

The website uses session and security cookies, and a random wc_guest cookie to recover guest progress. The guest cookie is set for up to 365 days and renewed during play; your browser may shorten that period. Signing in can also set a persistent sign-in cookie. Guest history transfer adds no new cookie. Browser storage holds preferences such as units and help settings; it is not the source of your streak.

Mobile clients use session cookies for guest play and account tokens for signed-in requests. Clearing browser or app data can remove access to guest progress; it does not by itself delete server records or an account. Keep access to your account to recover saved account history. We retain server-side hashes of transferred guest/session identifiers to prevent repeated transfers; those hashes do not sign anyone in. Optional transfers also retain a receiving account identifier and a receipt with transferred and skipped game counts so interrupted requests can be recovered without duplicating games.

Why we use information

We use account and gameplay information to provide the service you request, recover progress, calculate statistics, authenticate you and fulfil purchases. We use security and technical information for our legitimate interests in preventing abuse and keeping the service reliable. Where consent is required, we ask for it. Optional email reminders use your selected time and timezone; you can turn them off in your profile. Account verification, recovery and security messages are separate from reminders.

Optional mobile push reminders are available to registered users and have separate controls in the app. When you enable them, we use your chosen game, language, reminder time and timezone to schedule messages. Enabled reminders may arrive even if you have already played that day. We use OneSignal to deliver these messages using an opaque push identity rather than your email address. The mobile notification service also processes installation and push-delivery information needed for this feature. You can turn reminders off without losing access to the game. This feature adds no website cookie.

Public results and service providers

Leaderboard responses may include your username, chosen country and eligible game statistics. Your email and password are not public leaderboard data. Sharing a result through your device's share controls sends it to the destination you choose.

We use service providers for hosting, storage, delivery, email and security. Cloudflare provides website delivery and image storage in our production setup. Configured email providers deliver account and reminder messages. Where offered, Polar processes website premium purchases under its privacy policy. An app store processes purchases made in a WhereCast app, and RevenueCat receives those purchase records with app and device information so we know which account has WhereCast Pro. RevenueCat processes them under its privacy policy and identifies the account by a random billing ID, not by your email. External sign-in providers also apply their own privacy policies. These services may process information outside your country; applicable data-protection requirements apply to such transfers.

The production website loads Ahrefs Web Analytics for aggregate usage measurement. Ahrefs describes this service as using no cookies or persistent identifiers, while processing IP address and browser information to measure visits. This website script is not a native app analytics SDK. We do not sell player data or use it for targeted advertising.

Weather is fetched for the game's cities, not your device location. Player account information and guesses are not included in requests to the weather or poster-generation services.

Retention and deletion

We keep account history while the account remains available, unless you request deletion. Guest records remain on the server to support returning play and registration; expiry or removal of a guest cookie is not an automatic deletion request. Technical records, transfer-protection hashes and backups have separate operational retention needs, including security, recovery and any applicable legal obligations.

Push-delivery records are removed after 35 days. Push identities are retired when removed in the app, when their account credentials are revoked or expire, or after 90 days without refreshing the push registration. Our scheduled cleanup requests their removal from OneSignal; provider failures can delay that cleanup and are retried. Turning reminders off stops new sends, while removing the push registration also requests identity cleanup. Notifications already submitted may still arrive.

You can delete your account from the website profile or in the WhereCast app (Profile › Account › Delete account). This deletes the account used across the website and mobile apps. Deletion removes the account, its game attempts, linked sign-in records and account tokens from the active database. A cached leaderboard entry may take a few minutes to disappear. Backup copies may remain until those backups are replaced, and payment providers may retain transaction records for their legal obligations. Signing out or uninstalling an app is not account deletion. Contact us to request deletion of guest records or help with an account request.

Your choices and rights

Depending on the law that applies, you can request access, correction, deletion, restriction, portability or object to processing, and withdraw consent without affecting earlier lawful processing. Contact [email protected]; we may need to verify the requester's identity. You can also complain to your local data-protection authority, including Spain's AEPD. Accounts are not intended for children under 13 or a higher minimum age required where they live; contact us if such a child has provided account information.

Changes

We update this notice when our practices change. Material changes will be brought to your attention through the service where appropriate.

Last updated: 2026-09-30