Privacy Policy

Last updated: October 12, 2026

This text is published in more than one language. If the versions ever differ, the English text prevails.

PlayWhydunit (playwhydunit.com) is a lateral-thinking puzzle platform. We respect your data and collect only what is needed for you to play, nothing more. This page explains, in plain words, what we keep, where and why.

The data controller is C. Georgiou (sole trader, Cyprus; full details and postal address in the Terms). Contact: [email protected]. Legal bases: performance of our contract with you (account, play, purchases, story submissions), your consent (analytics) and our legitimate interest (security and abuse prevention). Where data reaches providers in the US, the transfer is covered by the EU standard contractual clauses or the provider’s EU–US Data Privacy Framework certification.

What we collect

Account

Username, email address, display name, hashed password.
The moment you accepted the Terms of Service.
Your wallet: the current token balance, whether you claimed the one-time welcome gift, and which achievements have already paid their bonus.
Your wallet history: how many tokens have been credited and spent in total, broken down by reason (purchase, gift, achievement, Game Master question, hint, revealed solution). We keep it so we can answer precisely if you ever ask where your tokens went.
Your order history: for each purchase, the pack, the amount, the VAT, the currency, the date and the status (completed or refunded). Card details never reach us.
Your email choices: whether you have asked not to receive optional messages (and when you asked), which language you want them in, which such messages we have sent you and when, and whether you came back to the site through one of them. We keep this precisely so that your choices are respected and so that we know what we have already written to you, and when.

Play data (on our server)

Your AI Game Master runs: the text of the questions you asked and the verdict each one received (Yes / No / Partly / You are on the right track / Irrelevant / Unclear), question counts, the clues you uncovered, start/finish times and outcome (solved / solution revealed). We keep them so you can continue the same run from any device, for support, and for fair play.
A technical record of every call made to the AI provider for your run: time, model, the model’s token counts and cost. It carries neither your name nor your email, but it is linked to your session. We need it to cost the service, to debug, and to protect against abuse.
An “exposure” record: if you saw a story’s solution or hints, it is permanently recorded on your account. It serves two purposes: it protects fair play and the leaderboards, and it is the proof that you already paid, so you are never charged twice for the same solution or hint.

Purchases

We are the seller of token packs; the payment itself is handled by Stripe as our payment services provider. Stripe processes your card on its own pages; we never see or store card details.
At checkout we attach your email and account id so the tokens are credited to the right account. From Stripe we receive the order confirmation and keep the pack, amount, VAT, currency, status and date on your account as purchase history, nothing more.

Contact messages

If you write to us through the form on the Contact page, we store your name, email and message on our server for the sole purpose of replying. We keep them for as long as your enquiry needs and delete them once they are no longer required.
To keep spam out, messages from signed-out visitors that contain links are automatically flagged as possible spam. They are still stored and reviewed (no genuine message is ever lost); they simply do not trigger an immediate notification.

Story submissions

If you send us a story of your own through the “Send us your story” page, we store on our server: the title, the scenario, the solution, the category and difficulty you chose, your acceptance of the submission terms and its timestamp, our decision (approved or declined) and, if published, the link to the published story.
You will receive a service email with the decision (approval or rejection) and, if your story is published, one more when it goes live. You can also follow each submission’s progress on the “My account” page.
If the story is approved, its text is sent to an AI provider to make it playable (see “Where data goes”), without your name or email.
Unpublished submissions are deleted on request.

Email updates

If you have an account, we may occasionally send you an email about your own account: that you have earned badges you never claimed, that you left a mystery unfinished, that it has been a while since you played, that you have not yet claimed your welcome gift, or to ask what you thought. Each such message is written from your own play data and sent by hand, one player at a time; there is no bulk mailing list.

What we promise: we send no advertising, we never sell or rent your address to anyone, and we keep them rare: we only write when there is genuinely something that concerns you.

How to stop them: every such email ends with a link that stops them for good in one click, with no need to sign in. You can also switch them off (or back on) at any time on the “My account” page. On the same page you choose their language: Greek, English, or both together in one message.

What is always sent: service email (registration confirmation, password reset, purchase confirmation, a reply to a message you sent us, news about a story you submitted: approval, rejection, publication) is not optional and goes out regardless of the choice above, because you asked for it.

Legal basis: our legitimate interest in contacting our registered players about matters concerning their own account, with the right to object at any time, and objecting is exactly one click.

Technical

IP address in short-lived abuse-prevention counters, cleared within 24 hours, and in server logs, which we keep for no more than 30 days. We use them for nothing beyond security and troubleshooting.

Analytics (Google Analytics)

With your consent (the “Allow analytics” button on the cookie bar), we use Google Analytics 4 for anonymous, aggregate traffic statistics: which pages and stories are read, from which country, on what device, and how you found us. We never send Google your name, email or account details, and IP addresses are anonymised. If you decline (or simply never answer), nothing loads and nothing is sent to Google. You can change your choice at any time via the “Cookies” link in the footer. Provider: Google Ireland Ltd; more at policies.google.com/privacy.

We also use Google Search Console, which shows us in aggregate which search terms lead to the site and which pages appear in results. It sets no cookie, does not track your visit and does not depend on consent: the data comes from the search engine itself, not from your browser, and is always aggregated.

What your browser keeps

Your browser keeps a local copy of your progress in localStorage (play clocks, your Game Master chat, completion records, opened hints) so the page opens instantly and keeps working through a brief drop in connection. It is a copy, not the original: the same progress is also held on your account on our server (see “Play data”), which is exactly why you can continue the same run on another device. We also use WordPress login cookies and a language cookie (bs_lang). The language of a page is now decided by the address you visit (pages under /en/ are in English), and the cookie merely remembers your preference for the sign-in screens. With your consent, Google Analytics statistics cookies are added too (see “Analytics”). No advertising trackers.

Where data goes (processors)

Anthropic (US): the questions you ask the AI Game Master are sent to the Anthropic API to be answered. They are not accompanied by your email or name. Per Anthropic’s API policy, the data is not used for model training. Anthropic also receives the texts of player-submitted stories when we prepare them for publication, without name or email.
OpenAI (US): used only to produce site content (story narration, images); no player data is sent.
Stripe (Stripe Payments Europe, Ltd., Ireland), payment services provider: we transmit your email address and account id so the tokens reach the right account. Stripe processes your card data under its own privacy policy (stripe.com/privacy) and may transfer data outside the EEA under the European Commission’s standard contractual clauses.
Cloudflare, Inc. (delivery and protection network): every visit to the site passes through it, so pages load quickly and attacks are turned away. It sees your IP address, the page you asked for and your browser, and sets one technical cookie that tells people apart from automated programs. It does not read your account and does not use your data for advertising. It processes under its own privacy policy (cloudflare.com/privacypolicy) and may transfer data outside the EEA under the European Commission’s standard contractual clauses.
Google Ireland Ltd (EU/US): Google Analytics traffic statistics (only if you have given consent) and Google Search Console for aggregate search data.
Google (Gmail): mail addressed to [email protected] is forwarded to a Gmail account, from which we read and answer your messages.
Hosting provider (EU): where the site’s database, files and mail server live; every email we send you leaves from there.

What is public: leaderboards & player profile

At registration you choose a public name. That, and only that, represents you in public. Your login username and your email are never shown publicly, anywhere.

If you solve stories, the following is public: your public name, your performance (questions, hints, time), your leaderboard position, the achievements you earned, the stories you solved and the month you joined. The same information is gathered on your public profile page (/player/…), so other players can see who they are competing against. If a story of yours is published, the credit “A story by [public name]” is public too: on the story page, on its card wherever it is listed (home page, categories, search, recommendations) and on your public profile. Your public name travels with the card, so it is visible to any visitor without an account.

Those pages are open to everyone and may be indexed by search engines (e.g. Google). Never published: runs in progress, failures, revealed solutions, your token balance or wallet history, your purchases, and the emails we have sent you. You can change your public name at any time on the “My account” page, and deleting your account removes the profile with it.

If you play with friends while signed in, each round is saved to your account: which mystery, when, how long it took, how many questions and hints it needed, and the first names typed in for the players. Of these, only what your Friends profile page (/friends/player/…) shows is public: your public name, the month you joined, how many rounds you narrated, how many different mysteries, how long around the table, and which mysteries you played and when. The names of the people at the table, how many they were, the questions and the hints are never shown publicly; only you see them, in your account. That page is not indexed by search engines, and it is deleted along with your account.

If you are signed in while you play with friends, your favourites, tonight’s list, the stories you have played and your ratings are also kept with your account, so they are the same on every device you sign in on. If you are not signed in, they stay only on your device. If you delete your account, they are deleted with it.

Retention & deletion

We keep your data for as long as your account exists. You can delete your account on the “My account” page; your details are erased and your play sessions are anonymised (they stop being linked to you). Your email choices and the record of what we have sent you are deleted along with it. Any unspent tokens are deleted with the account and are not refunded. Stories you submitted that were already published remain on the site under the licence you granted, but the public credit with your name stops being shown. The accounting facts of a purchase (pack, amount, VAT, currency, date and order number) are retained for as long as tax law requires, both by the payment provider and by us. Our own copy is kept anonymously: it is permanently detached from the account and carries no name, no email and nothing else that leads back to you, only the financial fact, as bookkeeping requires. The same applies to the site-wide wallet totals (how many tokens have been given and spent in total): they are counted, but no longer linked to you. If a story is permanently withdrawn from the site, the runs, Game Master conversations and ratings attached to it are deleted with it.

Your rights

You have GDPR rights of access, rectification, erasure, restriction of processing, portability and objection. Where we rely on your consent (analytics), you can withdraw it at any time through the “Cookies” link in the footer; withdrawing it does not affect what was lawfully done before. Most of it happens directly on the “My account” page: there you change your public name, your email address, your password and your picture, set your optional-email preferences and delete your account. When you change the email address, we send a confirmation link to the new one, and until you open it the address counts as unconfirmed. For anything else, write to us. If you believe your rights have been infringed, you can lodge a complaint with the data protection authority of the country where you live or work, or where the infringement took place.

Contact

For any question about your data: [email protected]