Privacy policy

What data we use

• Account data: alias, email, country and avatar. Supabase Auth manages credentials; the game does not store readable passwords.
• If you choose Google sign-in, Google shares your identifier, email and basic profile with Supabase Auth to authenticate you. Your Google name and photo are not published in the game: you choose your own alias and avatar.
• Game data: your moves, when you made them and your stats.
• Technical data, such as IP address and browser, to provide the service, protect access and prevent abuse.
• Your language is saved in your account for the game and its emails. Your browser also stores your session and language, theme and sound preferences.

What is public

Your alias, avatar, country and stats appear in the tops and the live activity. Your email is never shown.

What for

• Creating and protecting your account.
• Running the game and its tops.
• Preventing fraud and abuse.
• Sending you news, only if you agree (unsubscribe any time).

Who with

Who Left It On uses Vercel for web hosting, Supabase for accounts and data, and Resend for transactional email. These providers may process data outside your country. We do not sell your data.

How long

We keep your account data while the account is active. You can export it or delete your account from Profile. Deletion removes your identity and progress and unlinks your moves; collective world results remain. Provider logs and backups have their own retention periods; account deletion does not erase them instantly.

Your rights

Email hello@wholeftiton.com with the subject “Personal data” about privacy, terms, access, correction or deletion. We will handle your request under applicable law.

Browser storage

We use local storage to keep your session and preferences. You can clear it in your browser; you will need to sign in again. Your account language stays saved on the server.

Visit measurement

Google Analytics is enabled by default and uses analytics cookies to measure visits and sessions. Google receives connection data and public page information; we do not send your alias, email or account ID. Ad personalisation is disabled. Admin pages and sign-in or recovery links are excluded.