Privacy

Who we are

Geowl is a geography learning app: an interactive map, quizzes and reviews that bring mistakes back. It is made and run by the sole trader named at the bottom of this page, registered in Poland, who is the controller of your personal data within the meaning of Article 4(7) GDPR.

Write to hello@geowl.app about anything in this document, including requests for access to your data or its deletion. This policy covers the website geowl.app, the browser version of the app at play.geowl.app and the Geowl app for iOS and Android.

The short version

The detail is below, but the whole of it comes to five sentences.

• The website sets no cookies of its own and runs no analytics, advertising or third-party trackers.
• The app creates an anonymous account on first launch: no name, no e-mail address, no password.
• What you play — rounds, answers, how long they took — is sent to our server so the questions can be calibrated, and one switch in Settings stops the whole feed.
• Crash reports go to Sentry in the EU without your IP address or device name.
• Nothing is sold, there is no advertising SDK in the app, and no decision about you is made automatically.

The website

The site is served by Cloudflare. Its servers process, in technical logs, your IP address, the time of the request, the address requested and your browser’s identification, so that pages are delivered and attacks are filtered. The basis is our legitimate interest in running and protecting the service — Article 6(1)(f) GDPR — and those logs are kept for up to 30 days.

We install no cookies. Cloudflare may set a strictly necessary security cookie (for example __cf_bm) to tell a browser from a bot; it carries no profile and is not read by us. Your choice of Light, Dark or System is kept in your browser’s local storage under geowl.site.theme and is never sent anywhere. The sample quiz on the site runs in page memory: reload it and it is gone.

The contact form

The form asks for a category, a subject, the message itself and — optionally — an e-mail address to reply to. It sends them to our database together with the address of the page you wrote from and the time.

It also sends a keyed hash of your IP address: an HMAC-SHA-256 computed with a secret held by the site, never the address itself. It exists so that the limits on the form (one message a minute, five a day per sender) can count without anyone being able to turn the value back into an address.

We use a message to answer you, to fix what you reported and to improve the app. The basis is our legitimate interest in supporting and improving the service, Article 6(1)(f) GDPR, or Article 6(1)(b) where your message concerns a contract between us. Giving an e-mail address is voluntary; without one we have no way to reply. Messages are kept for 24 months.

The app: account and device

On first launch the app signs itself in anonymously, so that everything it saves has an owner from the first answer. The account has no e-mail address and no password. Its identifier is shown in Settings and can be copied — that is what identifies you when you write to us about your data.

The installation also mints its own identifier, kept for the life of the install, and describes itself to the server once: platform, operating system version, device model name, app version, interface language and the time it was last seen. That is what lets support answer “which phone, which build”, and lets a dead installation be told from a quiet one.

The app: what you play

With the “Send gameplay data” switch on — its state when you have not answered the question — the app sends what happened in the game.

We use it to calibrate the difficulty of the questions, to check whether the wrong answers on offer actually mislead, to tune the revision algorithm, and to count how many players come back and how many installs run without crashing before a release. This is research on the content of the game, not measurement of you: the basis is our legitimate interest in improving the service, Article 6(1)(f) GDPR. Answer history tied to a stable identifier is personal data even without an e-mail address attached, which is why it is described here in full.

Switching the feed off means nothing about your play leaves the phone — not a round, not an answer, not an app open. Settings, history and progress stay on the device and the game works exactly as before. What is still sent is the profile you chose to show (nickname, country, avatar, frame, colour) and the state of the switch itself, so that a player who declined can be told from a phone that is broken. Turning it off does not delete what was sent earlier; write to us with the identifier from Settings and we will delete it.

• Rounds: the mode and set played, the result, times, the local day and time-zone offset, the language, the app version and the version of the map data.
• Answers: which question, which answer you gave, whether it was right, which wrong option you picked and how long it took.
• Sessions: the app being opened, which is how we count active players.
• Daily challenge results, coins and experience points with the reason they were awarded, and markers recording that progress before a given date was accounted for.
• Your profile: nickname, country, avatar, frame and colour.

Crash reports

The app sends crashes and unhandled errors to Sentry, in Sentry’s European region. An event carries the error, the stack, the app version and breadcrumbs — which screens and which taps came before it. It does not carry your IP address, your device name, screenshots or the contents of the screen; performance tracing and profiling are switched off, and network failures are dropped before they are sent.

This is the one feed that does not follow the gameplay switch, because a beta whose worst installs are the ones that opted out measures nothing. What the switch does change is identity: with the feed on, a crash carries the account identifier so it can be lined up with the round it interrupted; with it off, the report is anonymous. The basis is our legitimate interest in the app’s stability, Article 6(1)(f) GDPR. Sentry keeps events for 90 days.

Updates and the stores

The app can be updated over the air between store releases. Checking for an update is a request to Expo’s servers (u.expo.dev), which see the IP address, the platform and the version being run.

Installing the app from the App Store or Google Play happens under Apple’s and Google’s own terms and privacy policies; we receive from them only aggregate statistics that identify nobody.

The legal bases, in one place

Under Article 6(1) GDPR we rely on the following.

• Performance of a contract — Article 6(1)(b): delivering the app and the account it saves your progress on, and answering a message that concerns that contract.
• Legitimate interest — Article 6(1)(f): technical logs and protection against abuse, gameplay data used to calibrate the questions, crash reports, and handling correspondence. You may object to any of these at any time.
• Legal obligation — Article 6(1)(c): accounting and tax records once paid features exist, and answering lawful requests from public authorities.
• Consent — Article 6(1)(a): not used today. Before anything that requires it is introduced — analytics tools, advertising, marketing e-mail — you will be asked, and you will be able to withdraw the answer as easily as you gave it.

Who processes data for us

We use a small number of providers, each bound by a data processing agreement.

• Supabase — database, anonymous accounts and the function behind the contact form. The project is hosted in Ireland (eu-west-1).
• Cloudflare — hosting and delivery of geowl.app and play.geowl.app.
• Sentry — crash reports, in the European region (de.sentry.io).
• Expo / EAS — builds of the app and over-the-air updates.
• Google Workspace — the hello@geowl.app mailbox.
• Apple and Google — distribution of the app through their stores.

Supabase Inc., Expo (Expo Project, Inc.), Functional Software, Inc. (Sentry), Cloudflare, Inc. and Google LLC are established in the United States, and transfers to them rely on the European Commission’s standard contractual clauses. Our database, the one place where your play is stored, is in Ireland. We do not sell personal data and we hand it to no one for their own marketing.

How long we keep things

Where a period below has not been reached yet because the service is young, it is a commitment rather than a description of the past.

• Gameplay data, the profile and the account: for as long as the account exists.
• Anonymous accounts with no activity for 24 months: deleted together with everything attached to them.
• Messages from the contact form and the app: 24 months.
• Crash reports: 90 days, which is Sentry’s retention.
• Server and edge logs: up to 30 days.
• Records we are required to keep by tax or accounting law, once there are any: for the period that law sets.

Your rights

You may ask for access to your data, for its correction, deletion, restriction of its processing or its transfer to you in a machine-readable form, and you may object to any processing we base on legitimate interest — including the gameplay feed, which you can also simply switch off in Settings. Where we ever rely on consent, you may withdraw it without affecting what was lawful before.

Write to hello@geowl.app. Because the account is anonymous, quote the identifier shown in the app’s Settings — without it we cannot tell which rows are yours, and we will not ask you for more identifying information than that. We answer within one month; if a request is complex we will tell you before that month is out.

You may also complain to the supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa.

Children

The terms set the age for using Geowl on your own at 16; a younger person may use it with a parent or guardian, who accepts the terms on their behalf. We do not knowingly collect data from a child under 16 outside that arrangement, and the app asks for no data that would tell us a player’s age.

There is no advertising in Geowl, no profiling and no advertising identifier. A parent or guardian may ask us to delete everything tied to a child’s account at hello@geowl.app, quoting the identifier from Settings.

Security

Everything travels over HTTPS. In the database, row-level security means a device can write only rows belonging to its own account and read nothing else — the key shipped in the app grants nothing more. The service key that can bypass those rules lives only in server-side functions, never in the app or on the website, and the admin panel is behind Cloudflare Access with a one-time code sent by e-mail.

The contact form stores a keyed hash of an address rather than the address. Crash reports are configured not to carry personal data. No system is perfectly secure; if a breach ever put your rights at risk, we will report it to the supervisory authority and, where the law requires, tell you.

What Geowl does not do

Some of what a privacy policy is for is saying plainly what is absent.

• No advertising, no advertising SDK and no advertising identifier.
• No sale or sharing of personal data for anyone else’s marketing.
• No location data. The country in your profile is something you picked, not something measured.
• No access to contacts, photos, the microphone or the camera.
• No cross-site tracking and no third-party scripts, fonts or embeds on the website.
• No automated decisions producing legal effects and no profiling within the meaning of Article 22 GDPR.

Changes

Accounts with an e-mail address, synchronisation between devices, paid features and rewarded ads are planned; each of them will require this policy to be updated, and the update will be published here and announced in the app before the feature is switched on. The date of this version is given below.