How we handle your data.

Stationhunt is an independent project operated by Maximilien Bohm, acting as the data controller under the EU General Data Protection Regulation (GDPR) and the UK GDPR. You can reach me at privacy@stationhunt.com for any privacy question.

Stationhunt is a daily puzzle game. To make the game work and pay for hosting, the following data is processed:

• Puzzle progress(the grid you’re solving, your score, attempts left, theme preference): stored in your browser’s localStorage. It never leaves your device. Cleared if you clear browser data.
• Anonymous usage data (page views, page load speed, browser type, country): collected by Vercel Analytics and Vercel Speed Insights without cookies and without identifying you personally. We use this to keep the site fast and understand which puzzles are popular.
• Analytics events with cookies (which cells you guess, whether you finish the puzzle, how long it takes): collected by Google Analytics 4 only if you accept analytics cookies. We use this to improve the game.
• Advertising data(ad impressions, ad clicks, contextual signals): processed by Google AdSense. If you accept advertising cookies, ads may be personalised; if you refuse, you’ll see non-personalised, contextual ads instead. Ads pay for the site so it stays free to play.

We do not collect your name, email, phone number, precise location, or any other directly identifying information unless you choose to send us an email.

Under GDPR, we rely on the following lawful bases:

• Legitimate interest(Art. 6(1)(f) GDPR) — for cookieless analytics that don’t identify you (Vercel Analytics, Vercel Speed Insights) and for security/anti-abuse logging by our hosting provider.
• Consent(Art. 6(1)(a) GDPR) — for all cookies used by Google Analytics 4, Google AdSense, and any personalised advertising. Consent is collected through Google Funding Choices, our consent management platform (CMP). You can withdraw consent at any time using the “Manage cookies” link in the footer.
• Contractual necessity (Art. 6(1)(b) GDPR) — if in the future you create an account, the data strictly needed to operate that account.

Cookies are small files placed on your device. Stationhunt uses two categories:

• Strictly necessary — localStorage entries (theme preference, puzzle progress, the “help seen” flag). These do not require consent because they are needed for the game to work.
• Analytics and advertising — set by Google Analytics and Google AdSense only after you give consent. These cookies remember your session, measure ad performance, and (with personalisation consent) tailor ads to your interests.

We use Google’s Consent Mode v2: by default in the EEA, the UK, and Switzerland, all advertising and analytics cookies are denied until you explicitly accept them through the Funding Choices banner.

We never sell your data. To run the site, we share limited data with the following processors:

• Vercel Inc. (USA) — website hosting and cookieless analytics. Vercel privacy policy.
• Google LLC / Google Ireland Ltd. — Google Analytics 4, Google AdSense, and Google Funding Choices (our CMP). Google privacy policy.
• Supabase Inc. (USA / EU) — database for aggregate puzzle statistics and, in the future, optional player accounts. Supabase privacy policy.

Some of these processors are located outside the European Economic Area. Transfers rely on the European Commission’s Standard Contractual Clauses where applicable.

• localStorage— kept until you clear your browser data. Stationhunt automatically prunes puzzle states you haven’t played in 3 days.
• Analytics data — Google Analytics 4 retention is set to 2 months for user-level data (the minimum). Vercel Analytics aggregates data and does not store individual profiles.
• Advertising data — retention is controlled by Google AdSense according to their policies.

Under the GDPR, the UK GDPR, and similar laws (CCPA, LGPD, etc.), you have the right to:

• Access the data we hold about you;
• Have inaccurate data corrected;
• Have your data deleted (“right to be forgotten”);
• Object to or restrict processing based on legitimate interest;
• Withdraw your consent at any time, without affecting the lawfulness of past processing;
• Receive your data in a portable format;
• Lodge a complaint with your local data-protection authority (in France, the CNIL).

To exercise any of these rights, email privacy@stationhunt.com. We will reply within one month.

You can change your consent choices at any time:

• Click “Manage cookies” in the footer of any page to re-open the Google Funding Choices banner.
• Clear your browser’s cookies for stationhunt.com to be asked again on your next visit.
• Use browser-level settings (Do Not Track, Global Privacy Control) — we honour the Global Privacy Control signal where technically feasible.

Stationhunt is not directed at children under 16. If you believe a child has provided personal data, please contact us and we’ll delete it.

This policy may change as the site evolves (for example, when we add player accounts in a future milestone). Material changes will be announced on the homepage at least 14 days before they take effect. The current version is dated below.

For any privacy question, complaint, or data-rights request: privacy@stationhunt.com.