Privacy Policy

Last updated: 11 August 2026

What we store, and why

Game data. A random player identifier stored in a cookie, with the scores, words found, Streak days and statistics recorded against it — to provide the game (contract) — plus the invite link you arrived on, so the player who invited you can be credited (legitimate interest). The marketing campaign you arrived from is recorded only if you allow analytics: refuse, and nothing about it is stored on your device or sent to us.
Account data. If you create an Account: the email address or Google account identifier you sign in with, your nickname, and the game history linked to the Account — to provide it (contract).
Email choices. Marketing email and Streak reminders are two separate opt-ins; we store each choice and when it was made (consent), and you can turn either off at any time. Sign-in links are sent only when you request one.
Analytics. Only with your consent, Google Analytics records the pages you view, an approximate location from your IP address, your device and browser type, how you reached the site, and share and invite events. It never receives your email address, nickname, or Account data.
Security data. Technical logs (IP address, browser type) used to operate and protect the service, and a Cloudflare Turnstile check on the contact page, which sends Cloudflare the same (legitimate interest).

Cookies

Everyone is asked, everywhere, before anything optional runs: Google Analytics is not loaded and no analytics cookie is set until you consent. Your choice is remembered for 12 months, and the cookie settings link at the foot of every page reopens it, so withdrawing is as easy as agreeing was. A Global Privacy Control signal counts as a refusal, which this site will not override. Declining analytics changes nothing about the game.

Name	Purpose	Category	Expires
`sevenspell-user`	Keeps your scores, Streak and statistics yours	Strictly necessary	1 year
`.AspNetCore.Culture`	Remembers your chosen language	Functional	1 year
`.AspNetCore.Cookies`	Completes Google sign-in	Strictly necessary	Session
`.AspNetCore.Correlation.*`	Secures the Google sign-in handshake	Strictly necessary	A few minutes
`.AspNetCore.Antiforgery.*`	Protects forms against cross-site submission	Strictly necessary	Session
`sevenspell-theme`	Remembers your theme; never sent to us	Functional	Until you clear it
`sevenspell-consent`	Stores your cookie choice and which version of this notice you saw	Strictly necessary	12 months
`_ga`, `_ga_*`	Google Analytics visitor measurement	Analytics — optional	Up to 2 years
`sevenspell-analytics-optout`	Remembers that you switched analytics off; never sent to us	Functional	Until you clear it
`sevenspell-referred-landing:*`	Stops one invite being counted twice; never sent to us	Analytics — optional	Session
`sevenspell-campaign-landing`	Holds the campaign link you arrived on so it is recorded once; written only if you allow analytics	Analytics — optional	Session

How long we keep it

Game and Account data are kept while needed to provide their features; you can request deletion at any time via the contact page. A record of each cookie decision — what you chose, against which version of this notice, and when — is kept for 24 months as evidence that the choice was honoured; it contains nothing that identifies you and is not linked to your Account. Google Analytics deletes user-level data after 14 months. Technical logs are kept only as long as security requires.

Providers and transfers

We use providers for EU hosting, diagnostics, email delivery, Google sign-in, Google Analytics and the Cloudflare check; each receives only what its function requires. The cookie notice itself is served by this site, not by a third party. We do not sell personal data. Where a provider — Google, Cloudflare, Microsoft — processes data outside the EU/EEA, we rely on the European Commission's standard contractual clauses and, where the provider is certified, on the EU–US Data Privacy Framework adequacy decision.

Your rights

Under the GDPR you can request access to, correction or deletion of your data, restriction of or objection to processing, a portable copy, and withdraw consent at any time — via the contact page. You can also complain to your data protection authority.

Who we are

SevenSpell (sevenspell.com) is operated by Avantibit AB, Sweden, the data controller. For privacy matters, reach us via the contact page.

Cookie	Lasts	What it does
`sevenspell-consent`	12 months	Remembers the choice you make here, so you are not asked again.
`sevenspell-user`	12 months	Tells your device apart from anyone else's, so your daily result, streak and statistics stay yours. It holds no name and no email address.
`.AspNetCore.Culture`	12 months	Remembers which of the twelve languages you are playing in.
`.AspNetCore.Cookies`	Until you close the browser	Keeps you signed in after you sign in with Google. Only set if you do.
`.AspNetCore.Antiforgery.*`	Until you close the browser	Checks that a form on this site was really submitted from this site. Set on the pages that have one.
`.AspNetCore.Correlation.*`	Until you close the browser	Checks that a sign-in arriving back from Google is the one this browser started. Deleted as soon as that is done.