Privacy Policy

Effective August 5, 2026

1. Who we are

Riddler Go is an interactive puzzle event platform operated at https://riddlergo.com. For privacy questions, contact us at hello@riddlergo.com.

2. What we collect

Account data when you create a host account: name, email address, and profile image from your chosen sign-in method (a one-time code emailed to you, Google, or Facebook). We never ask for or store a password.
Event data you create as a host: event titles, puzzles, hints, answers, and branding.
Participant data when you join an event: the display name you choose and, optionally, an email address. Participants can play anonymously.
Gameplay data: puzzle answers submitted, timestamps, hint usage, and rankings.
Feedback ticketsfrom our in-app "Submit feedback" tool: the screenshot you approve, browser info (user agent, viewport, timezone, locale), the page URL you were on, and any description you type. Recovery PINs, payment fields, and any other sensitive input are automatically redacted from screenshots before upload.
Technical data: IP address, browser type, and cookies necessary for the site to function (session, participant identity, CSRF).

3. How we use it

Authenticate you and keep you signed in.
Run puzzle events: score answers, generate leaderboards, deliver hints.
Send transactional email tied to your account (event invitations, sign-in verification, feedback responses). We do not send marketing email without your consent.
Diagnose bugs from your feedback submissions.
Comply with legal obligations.

4. Who we share it with

We use the following service providers to run Riddler Go:

Clerk — authentication and user session management.
Neon — Postgres database hosting for account and event data.
Vercel — application hosting and edge networking.
Vercel Blob — screenshot and file storage for feedback tickets.
Resend — transactional email delivery.
Google and Facebook — optional single sign-on providers, only if you choose to sign in with them.

We do not sell your personal data. We do not share it with advertisers. We only share data with the providers above to the minimum extent needed to deliver the service.

5. Cookies

We use only strictly-necessary cookies: an authentication cookie, a participant identity cookie (so anonymous players can resume a session), and CSRF protection tokens. We do not use advertising or third-party tracking cookies.

6. How long we keep it

Account data: retained while your account is active. Deleted within 30 days of your account-deletion request.
Event data: retained while the parent account exists.
Participant data: retained until the associated event is deleted or the retention period elapses (typically one year after event completion).
Feedback tickets: retained for 24 months for support and quality purposes, then deleted.
Server logs: retained up to 90 days.

7. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete the personal data we hold about you, and to object to or restrict certain processing. To exercise any of these rights, email hello@riddlergo.com and we will respond within 30 days.

If you signed up with Facebook and want us to delete data we obtained from Facebook, you can request deletion at the same address. We will confirm deletion in writing.

8. Children

Riddler Go is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with data, contact us and we will delete it.

9. Security

We use industry-standard measures to protect your data: TLS in transit, encryption at rest in Neon and Vercel Blob, principle-of-least-privilege database access, and regular dependency updates. No system is perfectly secure; we will notify affected users of any breach that materially impacts them.

10. Changes to this policy

We will post any changes to this page and update the effective date at the top. Material changes will be announced by email to active account holders.

11. Contact

Questions? Email hello@riddlergo.com.