Privacy Policy

If you play as a guest:

• A randomly-generated player id stored in your browser (localStorage) so we can render your avatar consistently within a multiplayer room.
• A display name you type in for multiplayer.
• Standard request logs from our hosting providers (IP address, user-agent, timestamp) retained for a short period for security and debugging.

If you create an account:

• Your email address.
• A display name you choose.
• For email/password accounts: a bcrypt hash of your password. We never store the password itself.
• For Google sign-in: your Google account id, name, email, and profile picture as provided by Google.
• An optional avatar image you upload.
• Game data — your guesses, scores, streaks, XP, game history, multiplayer room memberships.
• A session cookie (JWT, httpOnly, sameSite=Lax) that keeps you signed in for 30 days.

• To run the game (deal listings, sync multiplayer rooms, track your score).
• To show public leaderboards. Your display name, avatar, level, streak, and scores may be visible to other users on leaderboards, in multiplayer lobbies, and on the site profile page.
• To email you transactional messages you request (e.g., password reset).
• To debug, improve, and secure the Service.
• To comply with legal obligations.

• We don't sell your data.
• We don't run advertising or share data with ad networks.
• We don't track you across other websites.
• We don't send you marketing email.

We use the following services to run NestGuess. Each may process personal data on our behalf strictly to provide their service:

• Vercel — Web hosting, static assets, serverless functions, analytics, avatar image storage (Vercel Blob)
• Prisma Data Platform — Managed PostgreSQL database
• Railway — Multiplayer real-time (Socket.IO) server hosting
• Google — OAuth sign-in provider (only if you choose Google to sign in)
• Resend — Sending transactional email (password reset)
• RapidAPI / third-party listing sources — Public real-estate listing data used to build the game (we're the reader, not sharing your data with them)

• nestguess_session — a signed, encrypted session cookie (httpOnly, sameSite=Lax, secure in production) so we know you're signed in. Expires in 30 days.
• g_oauth_state, g_oauth_verifier — short-lived cookies used during the Google sign-in redirect flow. Deleted immediately after sign-in completes.

We do not set analytics or advertising cookies.

• Account data, game history, and leaderboard entries are retained while your account exists.
• Password-reset tokens expire after 1 hour and are single-use.
• Server request logs are retained by our hosting providers for a short period (typically 7-30 days) for security and troubleshooting.
• If you delete your account (see below), we delete or anonymize your data within 30 days, except where retention is required by law.

Depending on where you live, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your account and associated personal data.
• Export your data in a portable format.
• Object to or restrict certain processing.
• Withdraw consent (for anything that relies on consent).

To exercise any of these, email info@nestguess.com. We'll respond within a reasonable time and never charge for reasonable requests.