Privacy Policy

The short version

Today there are no accounts, no analytics and no advertising tracking. Your progress, notes, saved references and optional discovery times are stored only on your device (in this browser, or in the app), and you can export or delete them in Settings. We do not receive them, and we do not sell personal data.

What reaches other services today

• Our hosting provider, Cloudflare, serves this website and the browser game. It receives the technical details every request carries, such as your IP address and browser type, to deliver the pages and protect them from abuse.
• When you read a Wikipedia, Wiktionary or Wikisource page inside YDOINTI, or see a picture from Wikimedia Commons or Wikidata, your browser fetches it directly from the Wikimedia Foundation, under their privacy policy. Some reader pages are loaded from the Internet Archive in the same way, under its policy.
• Search shortcuts, links in hunts and share buttons open other websites (a search engine, an archive, a social site) only when you choose them. Those sites then apply their own policies. YDOINTI does not see what you do there.
• Files you check for evidence hunts are fingerprinted on your device and are never uploaded.
• The iPhone and Android apps are not in the App Store or Google Play yet. When they are, those stores apply their own privacy policies to the download.

If you write to us

We keep your message and email address only to answer you, and delete them when they are no longer needed.

Accounts (not open yet)

Optional accounts, for the apps first, are being built and are not available yet. This section describes what they will store, so you can decide before creating one. It will be updated, with a new date, if anything changes before they open.

What an account stores

• Your email address, whether it is confirmed, and the display name you choose. Your password is stored only as a one-way hash, never in readable form. If you use Sign in with Apple, we receive what Apple shares with us (an Apple identifier and, if you allow it, your email address, which may be a private relay address).
• Sign-in sessions: for each device you sign in on, its IP address and a description of the browser or app, so you can see your sessions and end them. A session lasts 30 days unless you sign out or end it.
• Short email codes for confirming your address and resetting your password. They are stored hashed and expire after 10 minutes.
• Progress you choose to sync between your devices: hunt progress, notes, saved references, settings and your profile. Sync is off until you join a device’s progress to your account.
• Game records the server keeps so that unlocks, completions, balances and memberships are the same on every device.
• Counters that limit repeated attempts (for example, wrong codes or too many requests), to protect your account and the service.

Notifications

Push notifications are off until you allow them on your device. If you do, we store a device token, the platform, your notification choices and your time zone offset (so quiet hours work). Notifications are sent through Expo to Apple or Google. They carry a short fixed line, such as “You have a new message.”, not the message itself. A token is removed when you sign out or when Apple or Google reports it no longer works.

Profile, pictures and Community

Community is not open yet. When it is, your username, display name, badges, picture and banner, and what you post or reply, are visible to other people. Do not post anything you want to keep private. Pictures, banners and GIFs you upload are for members only and are checked by a person before anyone else can see them; a rejected upload is never shown. Reports go to moderators. Moderation actions are recorded in an audit log.

Who processes it

• Cloudflare, which runs the account service on our own Cloudflare Worker and stores its data and uploaded files.
• An email delivery provider, to send confirmation and password-reset codes. It has not been chosen yet and will be named here before accounts open.
• Cloudflare Turnstile, which may check that a sign-up or sign-in comes from a person rather than an automated script.
• Apple, if you choose Sign in with Apple.
• Expo, Apple and Google, to deliver notifications you have allowed.

Deleting your account

You will be able to delete your account yourself, after confirming it is you. Deletion immediately removes your account and sign-in details, your sessions, your synced progress and notes, your profile and uploaded pictures, your balances, completions, ownership and memberships, your inbox, notification settings and device tokens, your reactions, hearts, friendships, blocks and reports. Your posts and replies stay as empty “deleted” entries, with your name and their content removed. Records of purchases and of the other store-linked records the server needs (for example, to prevent a purchase being used twice) are kept for tax, refund and fraud purposes, with your account replaced by an anonymous identifier. We also keep a one-way fingerprint of your email address, which cannot be turned back into the address, so that one-time sign-up benefits cannot be claimed twice. How long these kept records are held, and for how long logs are kept, will be stated here before accounts open.

Payments

This website takes no payments and stores no card, bank or UPI details. When memberships go on sale, they will be sold in the YDOINTI apps for iPhone and Android, through the App Store and Google Play. This website has no checkout and takes no payments. When you buy through Apple or Google, they handle your payment details under their own privacy policies; we receive only a confirmation of the purchase (such as the product, its transaction identifier, its status and dates) so that the membership can be attached to your account.

Your choices

You can play without an account. On your device you can export or delete everything in Settings. To ask about your data, or to ask us to correct or delete anything we hold, write to us from the Contact Us page.

Who is responsible

raiseCatError (Jai Sukka) is responsible for YDOINTI and this website. We will post any change to this policy here with a new date.