Privacy Policy

Last updated: June 2026.

This policy explains what personal data FindOrNot collects, why, and your rights. The data controller is Zoran Marić (Serbia) — full details on the Legal notice. For privacy questions: privacy@findornot.com. We aim to collect as little as possible.

What we collect and why

• Playing without an account: a random session ID (stored in a cookie) so the game can track today’s puzzle and your guesses. Legal basis: our legitimate interest in running the game.
• With an account: your email, an optional display name, your chosen language, and your gameplay history (rounds, guesses, streaks, progression). Legal basis: performance of the service you asked for.
• Security: on sign-in/sign-up we process limited technical data — including your IP address and browser user-agent — to prevent abuse, bots, and brute-force attempts (e.g. via Cloudflare Turnstile and rate-limiting), and we keep short security logs of authentication events. Legal basis: our legitimate interest in keeping the Service secure.
• Analytics: if you accept the cookie banner, we use product analytics (PostHog, EU-hosted) and Google Analytics to understand which screens are used. None of it loads before you consent. Legal basis: your consent. We also record minimal first-party gameplay metrics (e.g. “game finished”) to improve the game.
• Ads: ads are off by default. If we enable them and you accept ad cookies, Google AdSense may process data (including via cookies and your IP) to show and measure ads. Legal basis: your consent.
• Emails you trigger: account emails (verification, password reset) and, if you use “invite a friend”, a one-off invite to the address you enter. We don’t add invited addresses to any mailing list and we don’t send marketing. Legal basis: performance of the service / our legitimate interest.

Who we share it with (processors)

We don’t sell your data. We use a few service providers that process data on our behalf under data-processing agreements:

• Brevo — sending transactional email.
• Cloudflare — bot protection (Turnstile), email routing, and content delivery.
• PostHog (EU) — product analytics, only after consent.
• Google (Analytics and AdSense) — analytics and ads, only after consent; Google may transfer data to the US under the EU–US Data Privacy Framework.
• Sentry — error monitoring (configured not to collect personal data).
• Better Stack — operational/security logs.
• Cloudflare R2 / Amazon S3 — hosting images and data exports.

Some providers may process data outside Serbia/the EU; where they do, transfers are covered by appropriate safeguards such as the EU Standard Contractual Clauses. We self-host our fonts, so no font data is sent to third parties.

Cookies

Strictly-necessary cookies keep you signed in and remember your session, language, and consent choice (e.g. session, CSRF, login tokens, the anonymous-play ID, and your consent flag). These don’t need consent. Analytics and ad cookies are only set after you accept the banner, and you can decline or change your mind at any time.

How long we keep it

Account data is kept until you delete your account; deleting it from your profile removes your account and associated data immediately and permanently. Anonymous play data is tied to a session ID that expires after about a year. Security logs are kept for a limited period. Analytics data is retained per the provider’s settings.

Your rights

You can access, correct, delete, restrict, or object to the processing of your data, withdraw consent at any time, and request a copy of your data in a portable format (signed-in users can export their data as JSON from their profile). To exercise these rights, email privacy@findornot.com. You also have the right to complain to a data-protection authority — in Serbia, the Commissioner for Information of Public Importance and Personal Data Protection; in the EU, your local authority.

Automated decisions

We use basic automated anti-cheat checks to protect fair play, which may flag or restrict an account. You can ask us to review any such decision by emailing us.

Children

The Service is intended for users aged 16 and over. We don’t knowingly collect data from children below that age without the consent of a parent or guardian.

Changes

We may update this policy; we’ll change the “last updated” date above and, for significant changes, give reasonable notice.