1. Who is responsible for your data?
Vague.no is a personal, non-commercial project operated from Norway by Thomas Skjerdal (“Vague.no”, “we”, “us”). The operator is responsible for the processing described in this notice.
Questions, privacy requests and account-deletion requests can be sent to hi@vague.no.
2. Data we process and why
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Account ID, email, authentication provider, login records and session tokens | Create and secure your account, authenticate you and send requested login links. | Performance of our agreement; legitimate interests in account security. | While the account exists, then for only as long as needed to complete deletion, security checks or resolve a dispute. |
| Anonymous account ID and associated quiz activity | Let you play as a guest and preserve progress if you later create an account. | Performance of the service you request. | Until it is upgraded, deleted during maintenance, or the service is discontinued. Automatic inactivity deletion is not currently implemented. |
| Username, avatar, settings and equipped cosmetic items | Provide and personalise your profile. | Performance of our agreement. | For the life of the account, subject to earlier removal by you. |
| Quiz prompts, answers, response time, correctness, score and session history | Run quizzes, calculate results, show history and improve question selection. | Performance of our agreement. | While the account exists, unless deleted earlier following a valid request. |
| Mastery, achievements, streaks, XP, points and cosmetic-item activity | Track progress and provide game features. | Performance of our agreement. | For the life of the account. |
| Leaderboard entries, challenges and challenge attempts | Provide competition, ranking and sharing features. | Performance of our agreement; legitimate interests in operating social features. | While the associated account and quiz session exist. |
| IP address, device/request information, security events and rate-limit keys | Deliver the service, prevent abuse and protect users and infrastructure. | Legitimate interests in security, reliability and fraud prevention. | For the period configured by the relevant infrastructure provider and only while reasonably needed for security and reliability. |
| Error reports and technical context | Detect, diagnose and fix failures. | Legitimate interests in maintaining a reliable service. | For the retention period configured in Vague.no’s Sentry project, then deleted by Sentry. |
| Aggregate page views and approximate visitor country (no cookies, no persistent identifier) | Understand overall usage of Vague.no, such as how many people play and roughly where from. | Legitimate interests in understanding and improving the service. | Per the retention period configured in Vague.no’s Vercel Web Analytics project. |
We do not use quiz performance to make decisions that have legal or similarly significant effects on you. We do not sell personal data or use behavioural advertising at the date of this notice.
3. Public and shared information
Your username, avatar, selected achievements and quiz scores may appear to other users on leaderboards and profile views. Anyone with a challenge link may be able to see the challenger’s username, avatar, score, achievements and challenge-related results. Do not use a username or avatar that reveals information you do not want to make public.
4. Where data comes from
Most data comes directly from you or is generated when you use Vague.no. If you choose Google or Apple login, we receive an identifier and account information made available by that provider in accordance with your provider settings.
5. Service providers and recipients
We currently use the following categories of recipient:
- Supabase for authentication, database services and avatar storage.
- Vercel for application hosting, content delivery and cookieless aggregate web analytics.
- Sentry for error monitoring and security/abuse-event alerting.
- Upstash for rate limiting and abuse prevention.
- Cloudflare Turnstile for automated-abuse protection.
- Google and Apple when you choose their sign-in services.
These providers process only the information needed for their role. Their own privacy notices also apply when you interact directly with them. We may disclose information where required by law or where necessary to establish, exercise or defend legal claims.
6. International transfers
Vague.no uses international service providers. Depending on their infrastructure, support and subprocessors, information may be processed outside Norway or the EEA. Where personal data is transferred outside the EEA, we rely on a legally recognised transfer mechanism, such as an adequacy decision, the EU–US Data Privacy Framework where applicable, or the European Commission's Standard Contractual Clauses, together with any required supplementary safeguards. Contact us if you want more information about a particular provider or transfer.
7. How long we keep data
We use the periods and criteria described above. Deletion from active systems may not immediately remove copies from provider backups, caches or security records. Those copies are isolated from ordinary use and disappear through the provider’s normal overwrite and retention cycle. We may keep limited information longer where necessary to comply with law, protect the service or handle a dispute.
8. Your rights
Depending on the circumstances, you may have the right to:
- access your personal data and receive a copy;
- correct inaccurate or incomplete data;
- request deletion or restriction;
- receive portable data you provided to us;
- object to processing based on legitimate interests; and
- withdraw consent without affecting earlier lawful processing.
You can delete your account and its associated data at any time from the Danger zone in your account settings. For other requests, contact hi@vague.no. We may need to verify your identity. You may complain to Datatilsynet or another competent EEA supervisory authority.
9. Children
Vague.no is a general-audience service intended for users aged 13 and over. If you are under the age at which you can enter this agreement or provide any required consent in your country, ask a parent or guardian to help you. We do not knowingly use children’s data for behavioural advertising. A parent or guardian who believes a child has provided data contrary to this notice can contact hi@vague.no.
10. Security
We use access controls, encrypted transport, database row-level security, restricted privileged credentials, rate limiting and other organisational and technical measures appropriate to the risk. No online service can guarantee absolute security.
11. Changes and contact
We will post changes here and give additional notice where a change materially affects your rights or how we use data. Contact us at hi@vague.no.