Privacy Policy

1. Introduction

Welcome to TimeShift Explorer ("we," "our," or "us"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our historical location guessing game application.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Email address: Required for account creation and login
• Username: Your chosen display name
• Password: Securely hashed and stored (not applicable for OAuth users)
• Country: For regional leaderboards and statistics
• Profile image: Optional, either uploaded or from OAuth provider

2.2 OAuth Authentication

If you sign in with Google or GitHub, we receive:

• Email address
• Name
• Profile picture
• OAuth provider ID (for account linking)

2.3 Game Data

We collect and store your gameplay information:

• Game scores and statistics
• Guessed locations and distances
• Year guesses and accuracy
• Time spent per round
• Hints used (Golden Tickets)
• Daily play counters
• Leaderboard rankings

2.4 Technical Data

• IP address (for rate limiting and security)
• Browser type and version
• Device information
• Session cookies and authentication tokens
• Error logs and diagnostics

3. How We Use Your Information

We use your information to:

• Provide and maintain game services
• Authenticate your account and maintain sessions
• Track scores and display leaderboards
• Enforce daily play limits based on membership tier
• Distribute Golden Tickets monthly
• Send important account notifications (email verification, password resets)
• Prevent abuse and enforce terms of service
• Analyze usage patterns to improve the game
• Comply with legal obligations

4. Data Sharing and Disclosure

4.1 Public Information

The following information is publicly visible on leaderboards:

• Username
• Country
• Profile image
• Game scores
• Membership tier badges (Gold, Platinum)
• Beta tester status

4.2 Third-Party Services

We use the following third-party services:

• Google Maps API: For Street View imagery and geocoding
• MapTiler: For interactive world maps and satellite imagery
• Stripe: For payment processing (Gold/Platinum subscriptions and Golden Ticket purchases)
• Resend: For transactional emails
• Sentry: For error monitoring and diagnostics
• Redis (Upstash): For rate limiting and caching
• Cloudinary: For image storage (feedback uploads)
• Vercel: For hosting and infrastructure
• Neon PostgreSQL: For database hosting
• Google OAuth: For Google sign-in
• GitHub OAuth: For GitHub sign-in

4.3 Legal Requirements

We may disclose your information if required by law or in response to valid legal requests from government authorities.

5. Cookies and Tracking Technologies

We use cookies for:

• Authentication: HTTP-only cookies store JWT access and refresh tokens (7-day and 30-day expiry)
• Session Management: Keeping you logged in across pages
• Rate Limiting: Preventing abuse via Redis-backed counters
• Analytics: Understanding how users interact with the game (Google Analytics)

You can disable cookies in your browser settings, but this may affect functionality.

6. Data Security

We implement industry-standard security measures:

• Passwords are hashed using bcrypt with salt rounds
• HTTPS/TLS encryption for all data transmission
• JWT tokens with secure signing and expiry
• HTTP-only cookies to prevent XSS attacks
• Rate limiting to prevent brute-force attacks
• Regular security audits and updates
• Admin audit logging for sensitive operations

7. Data Retention

We retain your account and game data for as long as your account is active. If you delete your account, all associated data (game history, scores, profile) is permanently removed from our database within 30 days.

8. Your Rights

You have the right to:

• Access: View your personal data via your profile page
• Update: Edit your username, email, password, and profile image
• Delete: Request account deletion (contact admin)
• Export: Request a copy of your data (contact admin)
• Withdraw Consent: Opt-out of non-essential emails
• Object: Object to processing for marketing purposes

9. Children's Privacy

Our service is not directed to children under 13 years of age. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

10. International Data Transfers

Your data may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place to protect your information in accordance with this Privacy Policy.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or via a notice on our website. Continued use of the service after changes constitutes acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us: