Privacy Policy

spotevil.com is run by inithouse.com s.r.o., Company ID (IČO) 23374390, VAT ID CZ23374390, registered office Příčná 1892/4, Nové Město, 110 00 Praha 1, Czech Republic, entered in the Commercial Register kept by the Municipal Court in Prague, file C 425130. We are the controller of your personal data.

Write to info@inithouse.com about anything in this policy. We have not appointed a data protection officer, as the law does not require one for us; this address reaches the people who decide how your data is handled.

• Account: your email address, a password (our authentication provider stores only a hash of it), display name, optional avatar and language. If you sign in with Google, we receive your name, email address and Google account ID.
• Gameplay: games you start, your answers, scores, hints used, leaderboard positions and streaks. In party mode, the display name you choose for the party.
• Messages: what you send us through the contact form or a content report, with the email address you give us.
• Technical data: IP address, browser user agent and the cookies described in the Cookie Policy.
• Analytics, only if you allow it: which pages and features you use, collected by Google Analytics and Microsoft Clarity.

• Running the game and your account, including sign-in and password-reset emails: performance of our contract with you (Art. 6(1)(b) GDPR).
• Security and abuse prevention: rate limits, bot checks, error monitoring. Our legitimate interest in a safe, working service (Art. 6(1)(f) GDPR).
• Answering your messages and content reports: our legitimate interest in replying to you (Art. 6(1)(f) GDPR).
• Usage analytics with Google Analytics and Microsoft Clarity: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in the Cookie Policy.

You need an email address to create an account. Everything else is optional, and you can play as a guest without an account.

We make no decisions about you based solely on automated processing that have legal or similarly significant effects.

We use the providers below. Each processes data on our behalf under a data processing agreement.

• Supabase (Supabase, Inc., USA): database and sign-in. Your data is stored in Frankfurt, Germany.
• Vercel (Vercel Inc., USA): hosting of the website and API. Server functions run in Frankfurt, Germany; pages are delivered through Vercel’s worldwide network.
• Cloudflare (Cloudflare, Inc., USA): delivery of panorama images, the Turnstile check that keeps bots out of our forms, and DNS.
• Resend (Resend, Inc., USA): delivery of sign-in and password-reset emails, and forwarding of contact-form messages to our inbox.
• Google (Google Ireland Ltd): our email inbox (Google Workspace), sign-in with Google if you use it, and Google Analytics if you allow analytics.
• Microsoft (Microsoft Ireland Operations Ltd): Microsoft Clarity, if you allow analytics.
• Sentry (Functional Software, Inc., USA): error reports from the website and server, stored in Frankfurt, Germany.
• MapTiler (MapTiler AG, Switzerland): the map tiles your browser loads when you place a guess on the map.

We do not sell your data and we do not use it for advertising.

Some of these providers are based in the USA or may access data from there. Where a provider is certified under the EU–US Data Privacy Framework, the transfer relies on the European Commission’s adequacy decision for it; otherwise on the Commission’s standard contractual clauses. Switzerland has its own adequacy decision. Ask us at info@inithouse.com for a copy of the safeguards that apply.

• Account and gameplay data: until you delete your account. Deletion takes effect immediately: your profile is hidden and your name is removed from leaderboards. We erase the data for good 14 days later, so you can change your mind in the meantime.
• Rate-limit records with IP addresses: up to 3 days.
• Messages to us: as long as we need them to deal with your request and any follow-up.
• Error reports: up to 90 days. Google Analytics: up to 14 months. Microsoft Clarity: session recordings 30 days, aggregated heatmaps up to 13 months.

Under the GDPR you have the right to:

• Access: get a copy of your data at any time with the data export.
• Erasure: delete your account on the account deletion page.
• Rectification: correct your data in your account settings, or ask us.
• Restriction: ask us to pause processing while we resolve a dispute about it.
• Objection: object to processing based on our legitimate interest. We then stop unless we have compelling grounds that override your interests.
• Portability: the data export is a machine-readable JSON file.
• Withdrawal of consent: switch analytics off in the Cookie Policy. This does not affect processing before the withdrawal.
• Complaint: to the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz, or to the authority in your own EU country.

To use any of these rights, write to info@inithouse.com. We reply within one month.

We use cookies the site needs to work, and analytics cookies only with your consent. The Cookie Policy lists each one and lets you change your choice.

spotevil.com is intended for people aged 16 and over. We do not knowingly collect data from younger children. If you believe a child under 16 has given us personal data, write to us and we will delete it.

When we change how we handle your data, we update this page and the date at the top. We tell people with an account about significant changes by email before they take effect.