Privacy notice

Last updated 1 November 2026.

Who is responsible

Opengro Digital (Dylan Cromhout), South Africa, is responsible for personal information in the Riddlecote companion app. Contact: support@riddlecote.com.

What we collect, and why

• Without an account we collect no name or email. Essential cookies hold a random device id and a signed record of the games opened on this phone, so the app can remember them and keep each order to its phone limit.
• Etsy order numbers. To confirm a purchase we look the order up with Etsy. We store a scrambled (keyed hash) version of the order number, an encrypted copy so we can re-check it later, which games it covers, its status, and the device ids that used it. We never receive or store the buyer’s name, email or address from Etsy.
• Game codes. Codes are stored only as hashes. When a code attempt is made, we store a hash of the IP address, not the address itself, to stop guessing. These records are deleted after 30 days.
• Party invites store the game, an invite code, seat codes, the id of the host’s device and an expiry time. No player names.
• Optional account. If you sign in with email, we store your email address, the games you have added and your game progress.
• Marketing is a separate choice that is off unless you tick it. We record when you agreed or withdrew. We don’t send marketing email in this version.
• On your phone only: settings such as theme and text size, notes you type, and downloaded games are saved in your browser’s storage and are not sent to us.
• Usage statistics are cookieless page counts (Vercel Web Analytics) and do not include email, codes or names.

We use this information only to run the app: confirm purchases, open games, stop misuse, and save your progress. Our legal basis is providing the service you asked for, our legitimate interest in preventing abuse, and your consent for marketing. We don’t sell personal information or use it for advertising.

Who processes it

The app is hosted by Vercel and its database by Supabase. Order checks go to Etsy. These providers may store data outside South Africa and the EU, including in the United States, under their own data-protection terms.

How long we keep it

Code-attempt records: 30 days. Order checks: 13 months after last use. Account data: until you delete your account. Cookies on your phone last up to about 13 months unless you clear them.

Your rights

Under POPIA (South Africa) and the GDPR (EU and UK) you can ask to see, correct or delete your information, object to its use, and withdraw consent. Account holders can download or delete their account from the account page. For anything else, email support@riddlecote.com. You can also complain to the Information Regulator (South Africa) or your local data-protection authority.

Children

Accounts are for adults. Family and kids’ games are hosted by an adult, and we don’t knowingly collect information from children.

Changes

If we change this notice, we’ll update the date at the top.

The term 'Etsy' is a trademark of Etsy, Inc. This Application uses Etsy's API, but is not endorsed or certified by Etsy.