Privacy policy

Information we process

For guest play, your browser stores a random explorer credential and preferences in local storage. Our server stores a hashed credential with your game attempts, submitted answers, scores, discoveries and error reports. If you sign in by email, we store your email and a hashed, short-lived verification code. Google sign-in provides a Google account identifier, verified email when available and a display name. We do not receive your Google password. You can change or clear your display name. We also log each visit to the game page (time, page, language, referring site and browser type, but not your IP address) and whether you create, share or save a result image, so we can see how the game is used.

Why we use it

We use this information to authenticate you, save and synchronise progress, count check-ins, judge answers, prevent abuse and respond to requests. Submitted question ideas include the text, source and optional credit name you provide. A credit name may appear publicly if a question is published. Contact messages and an optional reply email are stored for support. Hosting services may process technical request information, such as IP address and browser details, for delivery, security and troubleshooting.

Service providers and AI

Railway hosts the application and its database. Resend sends sign-in emails; Google handles Google sign-in when you choose it. If ordinary matching cannot recognise an eligible answer, it may be sent to DeepSeek with the question and answer choices for AI judging. We do not intentionally send your account email, Google identifier, explorer key or nickname in that request; avoid typing personal information as an answer. Providers process information under their own terms and privacy policies and may process it in other countries. Google also provides Google Analytics and the Google Ads tag on the game page, and Plausible Analytics counts visits there, as described below.

Local storage, cookies, analytics and advertising

Local storage is used for sign-in sessions, guest progress access, language, sound and other preferences. The game page uses Google Tag Manager to load Google Analytics, which measures visits and how the site is used, such as pages viewed, scrolling, link clicks and form use, along with browser, device and approximate location. It also loads the Google Ads tag, which tells Google when someone who came to Galumio from one of our Google ads visits or plays, so we can measure our advertising. We do not intentionally send your email, explorer key, nickname or answers to Google. Outside the EEA, the UK and Switzerland, these Google tags set their own cookies to recognise returning browsers, and Google may use the visit to show you Galumio ads on other sites (remarketing). In the EEA, the UK and Switzerland, Google's consent mode keeps them cookieless: no analytics or advertising cookies are set, and only measurement signals without cookies or identifiers are sent. Browsers that send a Global Privacy Control signal get no advertising cookies anywhere. The game page also uses Plausible Analytics, hosted at analytics.agentx.love, which counts visits, pages, referring sites, device type and country without cookies and without storing your IP address. The information pages, including this one, load none of these tools. The site itself shows no ads. Google sign-in runs on Google's site and may use Google's own cookies. Before showing ads on the site, or using analytics or advertising cookies in the EEA, the UK or Switzerland, we will update this policy and ask for consent where required.

Retention and your choices

Game and account records remain on our server while they are used to provide the service, until removed in response to a verified request or maintenance. Email codes expire after ten minutes; expiry is not a guarantee that the database row is immediately erased. Contact messages and reports are kept while handling the request and for necessary follow-up. Security or legal needs and backup rotation may delay final erasure. You may request access, correction or deletion through the contact page; applicable rights depend on your location. We may need to verify ownership without asking for your password or explorer key. Visit logs are deleted after 180 days.

Clearing browser data signs you out and removes local preferences; it does not delete server records. Signed-in users can sign in again to recover account progress. Guests need their saved explorer key, or they may lose access. Signing out is not account deletion.

Sharing and children

Sharing a result image is your choice. It includes your display name, spacecraft, check-in streak and game result, not your email or credential. Choose a nickname if you do not want to share a real name. Accounts are not intended for children under 13 or below the age required by local law. A parent or guardian can contact us about a child's data. We do not sell personal data.