Privacy policy

Last updated Oct 23, 2026

This page explains what data WhereIsShe (whereisshe.gg) uses, why, who else receives it, and what you can do about it. We don't sell your data. WhereIsShe is run by one independent developer, who is responsible for this data; you can reach us at the address at the bottom of this page.

If you just play (no account)

Your progress, scores, streak and settings (theme, sound) are stored only in your browser (localStorage). They aren't sent to us. “Clear my game data” in the menu deletes them.

If you sign in

• Email sign-in or Google sign-in. We get your email address (and from Google, the basic profile Google shares with apps; we only use the email). It's used to sign you in, and to contact you about your submissions or Premium.
• Stats sync. Your stats, saved results (your guesses and scores per puzzle) and settings are copied to your account so they're the same on every device. They're merged with the copy in your browser each time you sign in and after each game.
• Accounts and synced data are stored with Supabase, our database and login provider. Each player can only read their own data.
• Login session. When you sign in, Supabase's sign-in library keeps a session token in your browser's local storage so you stay signed in. Signing out removes it. Supabase also records basic sign-in logs (time, IP address, browser) for security.
• If you have Premium, your account also stores whether Premium is active, until when, and the Lemon Squeezy order/subscription and customer IDs.

Feature me submissions

• We store what you send: your Instagram handle, your email, the links you paste, the photos and videos you upload, the location text you give for each, and your confirmations (that it's you, your consent, that you're 18+).
• Uploads are kept in private storage (Supabase Storage), visible only to us for review. Nothing is public unless we feature you, and you approve your day first.
• You need to be signed in (with a verified email) to submit. Each submission is linked to your account, so we can contact you and so that limits (one submission a day, a few waiting at a time) work. We don't store your IP address with submissions.

Premium payments

Payments are handled by Lemon Squeezy (merchant of record). We never see or store your card details. Lemon Squeezy tells us that an order or subscription was paid, cancelled or refunded, with your account ID and email, so we can switch Premium on or off. See Lemon Squeezy's privacy policy.

Cookies and local storage

WhereIsShe itself doesn't set tracking cookies and doesn't use analytics. It uses your browser's local storage (and session storage for the current tab) for things the game needs to work:

• your progress, results, stats and streak, and settings such as theme and sound (keys starting with wis.);
• if you sign in, your login session (a Supabase token);
• small flags such as whether you've seen the welcome card.

This data stays on your device unless you sign in (then your stats, results and settings are synced to your account). You can delete it at any time with “Clear my game data” in the menu, or by clearing your browser's site data for whereisshe.gg.

Google AdSense and third-party advertising cookies

• Free players may see ads served by Google AdSense. Third-party vendors, including Google, use cookies (and similar technologies such as local storage and device identifiers) to serve ads based on your previous visits to this website and other websites, and to measure how ads perform and prevent fraud.
• Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and/or other sites on the Internet. Learn more in how Google uses cookies in advertising and how Google uses information from sites that use its services.
• You can opt out of personalised advertising by Google at Google Ad Settings (adssettings.google.com). You can opt out of some other vendors' use of cookies for personalised advertising at aboutads.info or, in Europe, youronlinechoices.eu. If you opt out you'll still see ads, but they'll be less relevant.
• When ads are shown, Google receives your IP address, browser details and the page you're on. Its processing is described in the Google Privacy Policy.
• Premium players don't load the ad script at all, so no ad cookies are set for them by us.

Consent in the EEA, the UK and Switzerland

• If you're in the European Economic Area, the United Kingdom or Switzerland, ads are only shown after a consent message from a Google-certified consent management platform (Google's own Privacy & messaging tool). It asks whether you agree to cookies and personalised ads before any are used.
• If you don't consent, Google may show non-personalised or limited ads, which use cookies only for things like frequency capping, fraud prevention and aggregate measurement, where the law allows.
• You can change or withdraw your choice at any time from the privacy/cookie settings link shown with the consent message, or by clearing your browser's site data for whereisshe.gg (the message is then shown again).
• The legal bases we rely on are: performing our agreement with you (the game, your account, Premium), our legitimate interest in keeping the service secure and free of spam, and your consent for ad cookies and personalised ads.

Other services the game loads

Map tiles come from OpenFreeMap (and Esri as a fallback), and the site is hosted on GitHub Pages (GitHub, Inc.). Like any website, these services receive your IP address and browser details when your browser loads files from them.

Keeping and deleting data

• Game data in your browser stays until you clear it (“Clear my game data”, or your browser's site data).
• Your account and synced stats stay until you ask us to delete your account. When you do, we delete your profile, synced stats and settings.
• Feature me submissions (the form details and your uploaded photos and videos) are kept in private storage while we review them. If we decline a submission, or you withdraw it, we delete it and its files, normally within 30 days. If you're featured, we keep the photos used in your day for as long as you're in the game; ask us and we'll remove them and your profile link.
• Premium records (order and subscription events) are kept as long as needed for accounting, refunds and disputes. Lemon Squeezy keeps its own payment records as merchant of record.
• To delete your account and synced data, to withdraw a submission, or to remove your photos and profile link, email us from the address on your account (or with your Instagram handle). We'll confirm when it's done.
• You can also ask for a copy of your data, to correct it, or to object to or restrict how we use it. If you're in the EEA or UK you can also complain to your local data protection authority.

Children

Submissions are only for people 18 or older. The game isn't directed at children under 13, and we don't knowingly collect their data.

Changes

If this policy changes, we'll update the date at the top.

Contact

Questions or requests: mikelyaps@gmail.com