Privacy policy

The short version

Verdict is a puzzle game, not a data business. It is operated by Endpaper Labs LLC ("we," "our," or "us"). We collect the minimum needed to run the game: an email if you create an account, your puzzle results, and anonymous usage statistics. We don't sell data, we don't run ads, and we don't use third-party advertising or tracking SDKs.

What we collect

Without an account: you can play the daily case with no signup. On the web, your progress and streak are stored only in your browser (localStorage) and never leave your device unless you create an account.

With an account: your email address, an optional display name, a securely hashed password (or your Google account email if you sign in with Google), and your puzzle results (solve times, hints used, streaks).

Subscriptions: web payments are processed by Stripe, and in-app purchases by Apple or Google via RevenueCat. We never see or store your card number — we store only your subscription status and a customer reference.

Bug reports: if you send one, we receive the description you write plus basic device context (app version, platform, OS version, device model) so we can reproduce the problem.

Notifications: if you opt into reminders, we store a push token so we can send them. Turning reminders off deletes the token.

Analytics: we use self-hosted, cookie-free analytics (Umami) with anonymous event counts — no advertising identifiers, no cross-site tracking, no personal profiles. Crash reports (Sentry) include stack traces and device context, not your puzzle data.

What we never do

No selling or renting data. No ads or ad networks. No data brokers. No social-media tracking pixels. No collecting contacts, location, photos, or anything else the game doesn't need.

Where your data lives

On servers we operate in the EU (Hetzner). Email (password resets, bug-report notifications) is delivered via Resend. Web payments via Stripe; in-app purchases are brokered by RevenueCat (with Apple or Google as the store of record). Crash and diagnostic reports go to Sentry. Push notifications are delivered via Expo's push service. That's the full list of processors.

Deleting & exporting your data

Settings → Delete account immediately removes your account, results, streaks, push tokens, sessions, and pending tokens from our live systems, and asks our payment processors to delete your customer records. A few things persist briefly or by legal necessity — anonymized bug reports, Stripe's required transaction records, error logs that expire within 90 days, and encrypted backups that expire within 30 days. Full detail: verdictpuzzle.com/account-deletion. You can export everything we hold about you as JSON first (GET /api/v1/me/export), or email us (below) for deletion or a copy of your data — we respond within 30 days.

Children

Verdict is not directed at children under 13, and we don't knowingly collect personal information from them.

Changes & contact

If this policy changes materially, we'll note it in the app. Questions or requests: hello@endpaperlabs.com.