Your journey. Your choices.

Accounts and saved games

Clerk handles sign-in, email verification and account security. WhenWhere stores your player identity, profile choices, guesses, game results and progression in Turso so you can continue on another device. Social features also store the friends, clubs, collections, reports and invitations you choose to use.

Membership and payment data

When paid memberships are enabled, Stripe hosts checkout and the billing portal. Payment details go directly to Stripe; WhenWhere does not store your full card number or security code. We link your player account to Stripe customer and subscription identifiers, and store membership status, billing period and checkout references to provide access and prevent duplicate purchases.

Account deletion closes open checkouts and ends your membership. Subscription references and payment-provider records may remain for billing, refunds and payment disputes. Deleting a game account does not automatically erase records held by Stripe. See Stripe’s privacy notice.

Account emails and optional game emails

Clerk sends verification and account security emails. When our email service is enabled, Resend delivers a one-time welcome email. Daily challenge reminders and journey emails are separate optional choices in account settings, both off by default. Journey emails can include photo-reading tips, game suggestions, unfinished-game reminders, return invitations and Plus offers. We use your saved progress and membership status to choose relevant messages and stop suggestions you have already acted on. Agreeing to analytics or in-app notifications does not subscribe you to email.

We use your current verified primary email address from Clerk at send time. The game database stores your email preferences, their change history, an optional time zone and delivery status, without storing a separate copy of your email address. Resend processes the destination address and message content to deliver the email. We receive delivery, delay, failure, bounce and complaint reports. We do not enable email tracking pixels or the provider’s click-tracking redirects.

Resend receives support messages and we forward them to our support inbox. While forwarding or retrying, the game service may temporarily retain the sender’s address, subject and plain-text message. That temporary copy is cleared when forwarding finishes, fails or expires. Attachments and original HTML are not copied into the forwarded message; the original remains available in the email provider’s support tools. Deleting a game account does not automatically erase messages already delivered to support or retained by email providers.

Only authorized support operators can read messages and send replies through our private inbox. A submitted reply may be stored temporarily while its delivery status is uncertain. Its text is cleared after provider acceptance, a confirmed rejection, or expiry after 23 hours. We retain delivery references and status to prevent duplicate replies.

You can stop either category in account settings or through that email’s unsubscribe link without signing in. This does not disable necessary verification or security emails. We retain a hash of addresses that report spam or permanently bounce so we can avoid sending to them again. See Resend’s privacy notice.

What other players can see

Your display name and chosen avatar identify you in shared games and social features. You can choose whether to appear on the daily leaderboard in My journey. Treat public usernames, club names and published collections as information other players can read.

Cookies, maps and hosting

Sign-in uses authentication cookies. A separate guest cookie lets you resume an introductory game. Your browser also remembers preferences such as game sound. Vercel hosts the website and processes requests, including technical information needed to serve and protect the service. Google Maps loads when you use the map; it receives the requests needed to display map tiles and controls. WhenWhere does not request your device’s precise location.

See Clerk’s privacy notice, Vercel’s privacy notice, and Google’s privacy notice for their services.

Measuring the experience

We use Vercel Web Analytics and Speed Insights to understand visits to public pages and how quickly those pages respond. Our integration removes query strings and fragments, and excludes account, sign-in, invitation and private game paths from those page metrics. It does not send your game-session token, email or username as a custom analytics event. We also count game starts, first guesses, completions and failures, using game mode and bounded timing values. Client diagnostics contain only error categories and where they were caught, without error messages, stack traces or entered values. Game progression and product activity are stored separately by the game service.

Optional product analytics

With your permission, we use PostHog to understand signup, onboarding, gameplay and return visits. PostHog uses a persistent analytics ID in your browser. When you sign in, we connect that activity to your opaque WhenWhere account ID. These identifiers let us measure a journey across visits; they are not your public username or email address.

Optional product tracking stays off until you allow it. We respect Global Privacy Control and Do Not Track signals. You can decline or change this browser’s preference below and keep using the game. Turning it off stops future optional product tracking; it does not erase events already collected.

With optional analytics enabled, we use a broad visit source, such as search or social, for up to 30 minutes to keep it consistent as you navigate. This tab’s session storage holds only the source category and its expiry, without a referring URL, campaign text or game token. Turning optional analytics off removes that record.

We send selected events and bounded measurements, such as a chosen sign-in method, game mode, score range, timing and fixed error categories. PostHog session replay and automatic form capture are off. We do not include names, email addresses, entered form values, photo coordinates, game session tokens, raw error messages or stack traces in these events. Read PostHog’s privacy notice for information about its service.

With optional product analytics enabled, an email link can identify its message category, such as a Daily reminder, without putting your email address or account ID in the link. When you are signed in, we can associate that visit with a recent email to your account and measure subsequent completed games or membership activation for up to seven days. Turning optional analytics off clears active email attribution and stops new associations. Delivery reports and your email subscription choices remain separate from analytics consent.

With a separate, optional choice, Microsoft Clarity creates heatmaps and masked replays of interactions on public marketing pages. This helps us see confusing navigation, repeated clicks and scrolling. Text, images and entered values are masked; account, sign-in, payment, support, review, social and game-session pages are excluded. We remove query strings and referrers, and do not send Clarity your WhenWhere account ID. Microsoft receives technical browser and connection information, including your IP address, when processing replay requests. Advertising storage is denied.

Replays stay off unless you select the separate replay option. An earlier choice to allow product analytics does not enable replays. Both preferences respect browser privacy signals. Turning replays off stops future collection and removes Clarity’s first-party cookies; it does not erase recordings already collected. Recording ends after four minutes, when you hide the tab or when you navigate away, and resumes only on a new eligible page load while permission remains on. Read Microsoft’s privacy statement.

Export, delete or report a concern

You can download your game data or start account deletion from account settings. Deletion removes saved games and associated profile data, replaces your identity in retained shared records with “Deleted explorer,” and deletes your Clerk account. Close any clubs you own before deleting your account. When you confirm deletion, membership access ends immediately and future renewals stop; unused time is not automatically refunded. If billing or sign-in deletion cannot finish, your profile stays locked and you can retry the deletion page. A checkout still being created must finish loading before deletion can proceed.

The in-app account deletion flow does not automatically delete analytics already held by PostHog or Microsoft Clarity. For a concern about that data, use the contact route below; changing your analytics preference controls future collection in this browser.

Email support@playwhenwhere.com for account, payment or privacy help, including after deleting your account. You can also use Report a concern while signed in. These controls describe the current service; this page will be updated as its features and providers change.