Last updated: 8/1/2026

Privacy Policy

Last updated: August 1, 2026

1. Introduction

This Privacy Policy explains how Artistle ("the Service", "we", "us") collects, uses, and protects information about you when you use artistle.com.

Artistle is operated by an individual developer based in the Czech Republic. If you have any privacy-related questions or requests, contact us at [email protected].

By using Artistle, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the Service.

2. Age Requirement

Artistle is intended for users 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal data, please contact us and we will delete it promptly.

3. Information We Collect

3.1 Account Information

When you register, we collect:

Email address — used for authentication and transactional emails
Password — stored as a secure one-way hash; we never see your plaintext password
Username / display name — shown publicly on the Service

3.2 Profile Data

Avatar image — if you choose to upload one; stored on our cloud file storage

3.3 Game Data

Your game history, guesses, scores, win/loss records, streaks, and earned medals/achievements

3.4 Technical Data

Session cookie — an HTTP-only authentication cookie set on login, valid for 6 months
Server logs — standard web server logs may include your IP address, browser type, operating system, referrer URL, and timestamps of requests

3.5 Analytics Data

We use Google Analytics 4 ("GA4") to understand how the Service is used. GA4 collects:

Pages visited and navigation paths
Session duration and frequency
Device type, browser, and approximate geographic location (country/city level)
Interaction events

GA4 does not log or store full IP addresses. IP addresses collected from users in the EU/EEA, UK, and Switzerland are truncated within Google’s infrastructure before any storage or further processing, and are never written to logs. Google acts as an independent data controller for the resulting analytics data. GA4 uses its own cookies (see Section 6). You can opt out of Google Analytics at any time through our consent banner, by installing the Google Analytics Opt-out Browser Add-on, or through your browser’s cookie controls.

3.6 Advertising Data

We display third-party advertising on the Service using Google AdSense. When ads are shown, Google and its ad-tech partners may collect:

Cookie and device identifiers (including cookies set by Google, DoubleClick, and IAB Transparency & Consent Framework ("TCF") vendors)
IP address and general geographic location
Pages viewed on Artistle and, for personalized ads, prior activity on other websites that participate in Google’s ad network

Third-party vendors, including Google, use cookies to serve ads based on your prior visits to our website or other websites. Google’s use of advertising cookies enables it and its partners to serve ads to you based on your visit to our sites and/or other sites on the Internet.

You may opt out of personalized advertising by visiting Google Ads Settings, or by visiting www.aboutads.info to opt out of a third-party vendor’s use of cookies for personalized advertising. For more information on how Google uses information from sites or apps that use its services, see policies.google.com/technologies/partner-sites.

If you decline consent for personalized advertising, we will instruct Google to serve non-personalized ads instead. Non-personalized ads still require a limited set of cookies to prevent fraud, count impressions, and enforce frequency capping.

4. How We Use Your Information

Creating and managing your account — using your email, password hash, and username
Authenticating your sessions — using your session cookie
Running the game (saving guesses, tracking progress) — using your game data
Sending password-reset or auth-related emails — using your email address
Displaying your profile — using your username and avatar
Improving the Service — using analytics data and aggregate usage patterns
Security and fraud prevention — using your IP address and server logs
Serving advertising to keep the Service free — using cookies and identifiers set by Google AdSense and its TCF vendors, as described in Section 3.6

We do not sell your personal data outside the CCPA context described in Section 12. We do not send marketing or promotional emails.

5. Legal Basis for Processing (EU / EEA / UK / Switzerland)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, our legal basis for processing your personal data under the GDPR and UK GDPR depends on the specific purpose:

Contract (Art. 6(1)(b)) — to create your account, authenticate sessions, and run the game
Legitimate interests (Art. 6(1)(f)) — to keep the Service secure, prevent abuse, and maintain server logs. You may object to processing based on legitimate interests at any time
Consent (Art. 6(1)(a)) — for analytics cookies, advertising cookies, and personalized advertising. You may withdraw consent at any time via our consent banner without affecting the lawfulness of earlier processing
Legal obligation (Art. 6(1)(c)) — where we are required to retain or disclose data by law

6. Cookies and Similar Technologies

We use cookies and similar identifiers in the following categories:

Strictly necessary — the HTTP-only authentication cookie that keeps you signed in (6 months) and the cookies set by our consent management platform to remember your consent choices (up to 12 months). These do not require consent because the Service cannot function without them.
Analytics — Google Analytics 4 cookies (_ga, _ga_<container>, etc.). Set only after you consent to analytics. Retention up to 2 years.
Advertising — cookies set by Google AdSense and IAB TCF vendors (including __gads, __gpi, IDE, NID, and others) used to serve, measure, and frequency-cap ads. Set only after you consent to advertising. Retention ranges from a single session to 2 years depending on the cookie.

We do not use "preference" or "targeting" cookies outside of the categories above. Some in-browser UI state (theme choice, dismissed banners) is stored in your browser’s localStorage, not in cookies.

You can control or delete cookies through your browser settings or through our consent banner (see Section 7). Disabling the authentication cookie will log you out.

7. Consent Management

For visitors in the European Economic Area, the United Kingdom, and Switzerland, we display an IAB TCF v2.2-certified consent banner on your first visit. The banner asks you to consent to — or reject — analytics and advertising cookies independently from strictly necessary cookies.

Before you make a choice, we apply Google’s Consent Mode v2 with all non-essential storage denied by default — no analytics events are recorded and only non-personalized advertising is served.

You can change your consent choices at any time by clicking "Manage cookie preferences" in the footer, which re-opens the consent banner.

8. Data Sharing and Third-Party Services

We use the following third-party processors and independent controllers. Each accesses your data solely to provide its service, or — where noted — as an independent data controller:

Supabase (processor) — database hosting and file storage; receives all account, game, and avatar data
Railway (processor) — application hosting; may transiently process any data passing through the Service
Resend (processor) — transactional email delivery; receives your email address and email content
Google Analytics 4 (independent controller) — usage analytics; receives page-view and event data via your browser, only after consent
Google AdSense and IAB TCF advertising partners (independent controllers) — ad serving; receive cookie identifiers, IP address, and interaction data via your browser, in accordance with your consent choices. A live list of ad-tech vendors is presented in the consent banner.

We do not share your personal data with any other third parties, except as required by law.

9. International Data Transfers

Some of the third parties listed in Section 8 (Google, Resend, and potentially Supabase and Railway depending on region) are established in or transfer data to the United States and other countries outside the EEA and UK.

Where personal data of EEA, UK, or Swiss users is transferred outside those regions, we rely on the following safeguards:

The European Commission’s Standard Contractual Clauses (SCCs) and the equivalent UK International Data Transfer Addendum / IDTA
Certification under the EU-US Data Privacy Framework and its UK Extension, where applicable — Google LLC is certified under the DPF

Copies of the relevant safeguards are available on request via [email protected].

10. Data Storage and Security

Your data is stored in a PostgreSQL database hosted by Supabase, and avatar images are stored in Supabase’s S3-compatible object storage. Both services apply industry-standard security controls including encryption at rest and in transit.

We take reasonable technical measures to protect your data, but no system is completely secure. Use a strong, unique password for your account.

11. Data Retention

Account data — retained for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where retention is required by law.
Game data — retained with your account and deleted alongside it.
Server logs — retained for up to 90 days for security and debugging purposes.
Analytics data — governed by Google Analytics’ own retention settings (default: 14 months for GA4 event data).
Advertising cookies and identifiers — retention is set by Google AdSense and each IAB TCF vendor, typically from a single session to 24 months. See Google’s cookie disclosures for details.
Consent records — we and our consent management platform keep a record of your consent choices for up to 12 months so we can honor and prove them.

12. Your Rights

Regardless of your location, you may:

Access — request a copy of the personal data we hold about you
Rectify — correct inaccurate data (most profile data is editable directly in your account settings)
Delete ("right to be forgotten") — request deletion of your account and associated personal data
Portability — request your data in a structured, commonly used, machine-readable format
Restrict or object — restrict processing, or object to processing based on legitimate interests (including profiling for advertising)
Withdraw consent — for analytics and advertising, via the consent banner; for other purposes, via email

If you are in the EEA, UK, or Switzerland, you also have the right to lodge a complaint with a supervisory authority. Because Artistle is operated from the Czech Republic, the lead authority is the Czech Office for Personal Data Protection (ÚOOÚ), but you may also file with the authority in your country of residence.

If you are a California resident, you have similar rights under the CCPA/CPRA — including the right to know, delete, correct, and opt out of the "sale" or "sharing" of personal information. Under the CCPA’s broad definition, cookie-based personalized advertising can constitute "sharing" — you can opt out at any time via our consent banner.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

13. Data Protection Contact

Artistle is operated by an individual developer and does not meet the thresholds that require formally appointing a Data Protection Officer under Article 37 GDPR. For all privacy and data-protection matters, the point of contact is:

Email: [email protected]

14. Children’s Privacy

The Service is not directed to children under 18. We do not knowingly collect data from minors. If we discover that we have inadvertently collected data from someone under 18, we will delete it immediately.

15. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For material changes affecting your rights — for example, new categories of advertising cookies or new ad-tech vendors — we will re-prompt your consent through the banner. Continued use of the Service after non-material changes constitutes acceptance of the revised policy.

16. Contact

For any privacy questions, requests, or concerns: