Privacy Policy

Maponica ("we", "us", "our") operates the website at maponica.com and the multiplayer geography games available through it.

This policy describes what personal data we process, for what purposes, and the rights you have under the General Data Protection Regulation (GDPR) and applicable EU/EEA law.

The data controller is Maponica. For any privacy-related questions, contact us at privacy@maponica.com.

Technical data (collected automatically)

When you visit our website, our servers receive standard technical information: your IP address, browser type, operating system, and device type. This is necessary to deliver the game to your device.

Gameplay data (provided by you)

When you play, you choose a nickname and avatar. Live room data (the player list, chat messages, in-progress game state) is temporary and deleted shortly after the game room closes. Your match history (scores, map guesses, and per-round results) is retained after the game ends to provide your stats and history. It is keyed to a pseudonymous player identity. Playing does not require a name or email address.

Account data (optional)

An account is optional. When you play as a guest, we create a pseudonymous player identity that links your games and stats. If you sign in with Google, we additionally store your email address, the @tag you choose, your display nickname, and optionally your country. Authentication is performed by Google; we do not receive or store passwords.

Product analytics data

To understand performance and improve gameplay, we collect first-party analytics events such as page views, session starts, gameplay interactions, and client error diagnostics. These events may include pseudonymous identifiers, browser and device information, language, timezone, and referrer information. To diagnose blocked or failing networks, they may also include coarse network information (network operator and approximate region) in pseudonymised form, without the raw IP address. We also use Google Analytics 4 for aggregated traffic and engagement reporting.

Video interaction data

CityGuesser uses embedded YouTube videos. When a video plays, YouTube (operated by Google) may collect data about your interaction, including your IP address and device information. This data is processed by Google under their own privacy policy. We do not have access to this data.

Aggregated video statistics

We collect anonymous, aggregated statistics about videos (times played, average guess distances, like/dislike counts). This data cannot be traced back to individual players and is not personal data.

We do not collect:

• passwords or login credentials (authentication is handled by Google);
• real names (guests use a nickname, accounts use an @tag);
• payment or financial data;
• location data from your device (only the map guesses you place in-game);
• third-party advertising trackers (for example remarketing or ad targeting pixels).

Our own systems set no non-essential cookies. Third-party services such as YouTube and Google Analytics may set cookies (see Section 6).

Under GDPR Article 6, we process your data on these grounds:

• Contract necessity (Art. 6(1)(b)) — Processing your gameplay data (username, guesses, scores) is necessary to provide the multiplayer game service you requested.
• Legitimate interest (Art. 6(1)(f)) — Processing technical and product analytics data (such as request logs, event telemetry, and service diagnostics) is necessary for security, abuse prevention, service reliability, and product improvement. We have assessed that this interest does not override your rights.
• Consent (Art. 6(1)(a)) — Where third-party services set cookies or trackers (e.g. YouTube embeds or Google Analytics), this occurs on the basis of your consent. You may withdraw consent at any time.

• Live game room data (player list, chat, in-progress state) — deleted automatically shortly after the room closes.
• Match history (scores, guesses, per-round results) — retained long-term for your stats and history, for platform statistics, and for game integrity (Art. 89 GDPR / legitimate interest). When your account is deleted, we remove your profile and all direct identifiers; gameplay records are retained in de-identified form.
• Guest identities — deleted after extended inactivity (about a year).
• Sessions (including the IP address and browser they were created from) — expire automatically after inactivity; deleted on logout or account deletion.
• Server logs and raw analytics events — kept short-term for security and diagnostics, then deleted on a rolling basis.
• Aggregated, pseudonymous statistics — retained for longer-term product measurement; they cannot be traced back to individual players.

YouTube (Google)

We embed YouTube videos as part of the game experience. When a video loads, your browser connects directly to YouTube's servers. Google may collect data about your viewing activity and set cookies. Google processes this data as an independent controller under the Google Privacy Policy.

Google Analytics (Google)

We use Google Analytics 4 to understand aggregated usage patterns (for example page views, session trends, and feature engagement). Google may set cookies or use similar technologies and process related technical data as an independent controller under the Google Privacy Policy.

Google Sign-In (Google)

If you choose to sign in, authentication is performed by Google (OpenID Connect). Google confirms your identity to us (your email address and a unique account identifier); we do not receive your Google password. Google processes the sign-in as an independent controller under the Google Privacy Policy linked above.

Service providers (processors)

We use infrastructure and service providers for hosting (within the European Union), security and content delivery, cookie-free aggregated web analytics, and error monitoring. They process data only on our instructions; your gameplay data does not leave the EU except through the Google services listed above.

As an individual in the EU/EEA, you have the right to:

• Access — Request a copy of any personal data we hold about you.
• Rectification — Ask us to correct inaccurate data.
• Erasure— Ask us to delete your data ("right to be forgotten").
• Restriction — Ask us to limit how we use your data.
• Portability — Receive your data in a structured, machine-readable format.
• Objection — Object to processing based on legitimate interest.
• Withdraw consent — Where processing is based on consent, withdraw it at any time.

Signed-in players can download their data and delete their account from their profile. Account deletion takes effect after a 14-day grace period; signing in again during this period cancels the deletion. After the grace period, your profile and identifiers are permanently removed. For other requests, or if you play without an account, contact us with information that helps us locate your data.

You also have the right to lodge a complaint with your national data protection authority.

We do not knowingly process personal data of users under 16 without a valid legal basis (such as parent or legal guardian permission, or school authorization where allowed by law).

If you are a parent or guardian and believe your child has provided personal data to us, please contact us at privacy@maponica.com.

We use industry-standard measures to protect your data, including encrypted connections (HTTPS/TLS), access controls, and regular security reviews. No system can be guaranteed to be fully secure.

A small number of authorized administrators can access account data for moderation and support; such actions are logged.

We plan to introduce advertising (Google AdSense) and additional game modes. When these features launch, we will update this privacy policy accordingly and, where required, obtain your consent before any new processing begins. We will also implement a cookie consent mechanism before introducing advertising trackers.

We may update this policy to reflect changes in our practices or legal requirements. Significant changes will be communicated through a notice on our website. The "Effective date" at the top indicates when the policy was last revised.