1. Who we are
GeoTrainers (www.geotrainers.com) is an independent project published by Alessio M., an individual publisher based in France. For the purposes of the General Data Protection Regulation (GDPR), the publisher is the controller of the personal data described in this policy.
For any question about this policy or about your data, write to contact@geotrainers.com.
2. Playing without an account
Every game mode can be played without signing up. In that case we do not know who you are: your scores, your sessions and your settings stay in your browser's local storage and are never linked to an identity.
An account only becomes necessary for features that are shared with other people — competitive leaderboards, friends, multiplayer sessions and cross-device synchronisation.
3. Data we collect
We collect only what a game account actually needs. We never buy data about you, and we never sell or rent your data.
| Category | What it includes |
|---|---|
| Account | Your email address, your display name, your password (stored only as an Argon2id hash — never in clear text), your optional country, your preferred language, whether your email is verified, and your registration date. |
| Google Sign-In | If you choose to sign in with Google, we receive your Google account identifier, your verified email address and your public name, which is used to suggest a display name. We never receive your Google password. |
| Gameplay | Scores, sessions, rounds played, cities found, Elo rating, daily challenge results and the statistics derived from them. |
| Social features | Friend requests and friendships, your online presence, multiplayer sessions you create or join, the messages you send in in-game chat, and the invitation or challenge links you generate. |
| Preferences | Your theme, your language, and whether your name is visible on public leaderboards. |
| Technical data | Your IP address, used to rate-limit sign-in and sign-up attempts, and standard server logs kept for security and troubleshooting. |
We do not collect any special category of data: no precise geolocation, no biometric data, no payment data. Support on Patreon happens entirely on Patreon's own platform, and we never see your payment details.
4. Why we use it, and on what legal basis
- Running your account and the game — creating your account, saving your progress, ranking you, letting you play with friends. Legal basis: performance of the contract you enter into by creating an account.
- Sending service emails — email verification and password resets. Legal basis: performance of the contract. We do not send marketing emails.
- Keeping the service secure and fair — rate-limiting authentication attempts, detecting cheating and abuse, moderating chat. Legal basis: our legitimate interest in protecting players and the service.
- Measuring how the site is used — anonymous, aggregated counters that tell us which modes are played. Legal basis: our legitimate interest in improving the game, with the opt-out described below.
- Complying with the law — responding to a valid legal request. Legal basis: legal obligation.
6. Audience measurement
We use no external analytics service: no Google Analytics, no advertising pixels, no session recording, no profiling. Our audience measurement is built in-house and privacy-friendly by design.
For each day and each game mode we increment simple counters — page views, games started, sessions completed. To count unique visitors without identifying them, your IP address is turned into an irreversible salted hash; the hash is stored, the IP address is not. A country code may be derived from our network provider's header to show a rough geographical breakdown. None of this data is linked to your account or used to build a profile.
You can opt out at any time. Setting the key geotrainer_track_ignore_v1 to 1 in your browser's local storage excludes it from measurement on every page: the request is then never sent. If you would rather we do it for you, or if you have any doubt, write to contact@geotrainers.com.
7. What other players can see
Some of the information attached to your account is visible to other people, because the features would not work otherwise:
- Your display name, your country flag and your score appear on public leaderboards.
- Your display name and your online status are visible to the players you have accepted as friends.
- In a multiplayer session, the other participants see your display name, your progress in the game and the messages you send in chat.
Your email address is never shown to other players. You can also hide your name from public leaderboards at any time from your account page: your score is then displayed anonymously.
8. Service providers and third parties
We do not sell your data and we do not share it with advertisers. A small number of technical providers are involved in delivering the game, and by the nature of a web request they receive your IP address:
- Our hosting provider, which runs the servers and the database in the European Union.
- Google, for the optional "Sign in with Google" feature and for the web fonts used by the interface.
- CARTO and OpenStreetMap, which supply the map tiles displayed in the game modes.
- jsDelivr, the content delivery network that serves the interface libraries.
- Our email provider, which delivers verification and password-reset messages over SMTP.
Links to Patreon, X or YouTube are ordinary external links: those platforms only receive data if you actually click through, and their own policies then apply.
9. International transfers
Your account and gameplay data are stored in the European Union. Some of the providers listed above, in particular Google, may process technical data outside the European Union. Those transfers rely on the safeguards provided for by the GDPR, such as the European Commission's standard contractual clauses or an adequacy decision.
10. How long we keep your data
- Account and gameplay data: for as long as your account exists. Deleting your account deletes them.
- Finished multiplayer sessions and their chat messages: automatically purged a few weeks after the session ends.
- Rate-limiting records: kept for a short period, only as long as needed to block a burst of attempts.
- Verification and password-reset tokens: valid for a few hours, then expired and deleted.
- Aggregated audience counters: kept without time limit, as they contain no personal data.
Deleting your account is immediate and permanent: your profile, your scores, your friendships and your messages are removed, and we cannot restore them afterwards. A score already published on a leaderboard may remain visible in an anonymous form until the next refresh.
11. Security
Passwords are hashed with Argon2id and are never stored or transmitted in clear text. The whole site is served over HTTPS, sessions are protected against cross-site request forgery, sign-in attempts are rate-limited, and database queries are parameterised against injection. Access to the servers is restricted to the publisher.
No system is perfectly secure. If you believe you have found a vulnerability, please report it privately to contact@geotrainers.com rather than disclosing it publicly.
12. Your rights
Under the GDPR you have the right to access your data, correct it, erase it, restrict or object to its processing, and receive it in a portable format.
Several of these rights can be exercised directly and instantly from your account page: change your display name or country, adjust your leaderboard visibility, or delete your account entirely. For anything else, write to contact@geotrainers.com; we reply within one month at the latest, and we may need to verify your identity before acting on a request.
If you consider that your rights have not been respected, you can lodge a complaint with the French data protection authority, the CNIL — www.cnil.fr.
13. Children
GeoTrainers is suitable for all ages, but creating an account requires you to be at least 13 years old. In France, players under 15 need the consent of a parent or guardian, who may exercise the rights described above on their behalf. If we learn that an account was created for a younger child without such consent, we will delete it.
14. Changes to this policy
As the game evolves, this policy may be updated. The date at the top of the page always shows the latest version. If a change materially affects how we use your data, we will announce it on the site before it takes effect.
15. Contact
A question, a request about your data, or a doubt about something in this policy? Write to us — a human reads every message.