1. Who controls your data
The controller of personal data processed through “This is it. Good luck.” (the “Service”) is Mikolaj Munchberg, ul. Smigielskiego 6C/1, 63-400 Ostrów Wielkopolski, Poland (“we”, “us”).
Privacy contact: ask@thisisitgoodluck.com.
2. Data we process
Depending on how you use the Service, we process:
- account data, including email address, username, avatar selection and authentication identifiers;
- legal acceptance records, including the date and versions of the Terms and Privacy Policy presented during registration;
- game data, including puzzle progress, completion dates, solve time, results, streaks and archive access;
- transaction data, including Stripe Checkout Session, Payment Intent and charge identifiers, payment status, price, amount, currency, refunds and disputes; we do not receive or store full payment-card details;
- promotional-code use and the resulting access entitlement; promotional codes are stored as keyed hashes;
- technical and security data, including IP address, country code, device/session identifiers, request metadata, rate-limit counters and anti-abuse verification results;
- communications and requests you send to us, including privacy, support, complaint and withdrawal requests;
- if you allow analytics, page-view and website-performance information provided by Cloudflare Web Analytics.
3. Why we use data
| Purpose | Legal basis |
|---|---|
| Creating and operating accounts, saving progress and providing free and paid access | Performance of a contract or steps requested before entering into a contract |
| Recording acceptance of the Terms and delivery of the Privacy Policy | Performance of a contract, compliance with legal obligations and our legitimate interest in documenting the terms presented |
| Processing purchases, refunds, disputes and promotional access | Performance of a contract and compliance with legal obligations |
| Accounting, tax records and handling legal claims | Legal obligation and legitimate interests in establishing or defending claims |
| Preventing fraud, automated abuse, account attacks and unauthorised access | Our legitimate interests in securing the Service and its users |
| Remembering the device, authenticating a user and keeping a requested session active | Performance of the requested Service; storage strictly necessary to provide it |
| Optional analytics that require access to a user's device | Consent, which may be refused or withdrawn without affecting essential access |
4. Cookies and similar technologies
The Service uses strictly necessary cookies for device sessions (sid), account authentication (game_access and game_refresh), security, fraud prevention and the purchase flow. Cloudflare Turnstile or other Cloudflare security features may also use strictly necessary cookies when a security check is required. These technologies provide features you request and remain active when you select “Necessary only”.
Our cookie banner stores your analytics choice in analytics_consent_v1 for six months. This preference cookie is necessary to remember and honour your choice. Selecting “Necessary only” does not limit the game or account features.
Cloudflare Web Analytics is cookie-free and reports limited page-view and performance information. As an additional privacy choice, we do not load its browser beacon unless you select “Accept analytics”. You may change or withdraw that choice at any time through Cookies in the website footer. Withdrawing consent stops future browser analytics after the page reloads and does not affect processing that occurred before withdrawal.
5. Service providers and recipients
We use processors and independent recipients only where needed to operate the Service:
- Cloudflare — hosting, content delivery, database and durable storage, security, Turnstile, logging and analytics;
- Supabase — authentication, password recovery and account-session support;
- Stripe — checkout, payment processing, receipts, refunds, fraud prevention and chargeback handling;
- professional advisers and public authorities where disclosure is required by law or necessary to protect legal claims.
Each provider may process technical data under its own documented security and retention arrangements. Payment-card data entered on Stripe's checkout page is handled by Stripe rather than by us.
6. International transfers
Some providers may process data outside the European Economic Area. Where required, transfers are based on an adequacy decision, the EU–US Data Privacy Framework for an eligible recipient, Standard Contractual Clauses, or another lawful safeguard. You may contact us for information about the safeguard applicable to a particular transfer.
7. How long we keep data
- account, game and registration acceptance data: while the account remains active and afterwards only for the period needed to complete deletion, resolve disputes or comply with law;
- the guest device identifier and associated guest puzzle progress: for up to 12 months after the last interaction with that puzzle on the relevant device;
- authentication cookies: the access cookie normally expires within approximately one hour, the refresh cookie within 30 days, and the device cookie within 12 months;
- payment, refund and accounting records: for the period required by applicable tax and accounting law and for the limitation period of relevant claims;
- short-window rate-limit data: used to enforce 60-second limits; pseudonymous security records and logs are kept only as long as reasonably necessary to investigate abuse and protect the Service;
- the analytics preference cookie: six months from the latest choice.
8. Your rights
Subject to applicable conditions, you may request access, correction, deletion, restriction, portability or object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing.
To exercise a right, contact ask@thisisitgoodluck.com. We may need to verify that the request concerns your account. You may also lodge a complaint with the President of the Personal Data Protection Office (UODO) in Poland or another competent EEA supervisory authority.
9. Account deletion
You may delete your account directly from the profile by selecting Delete and confirming the permanent action. This removes the Supabase authentication account, profile, email association, puzzle progress, solved-puzzle history, streaks, device-to-account links, promotional-code redemption record and free or paid access entitlements. The deleted game history and access cannot be restored to a new account.
Deletion does not erase records that we must retain for accounting, tax, refunds, chargebacks, fraud prevention, disputes or legal claims. We minimise those records and remove their direct link to the deleted account where possible. Stripe may retain transaction data under its own legal obligations and retention policy. You may also contact the privacy address above if the in-product deletion control is unavailable.
10. Children
If a user is not old enough under the law of their country to enter into the relevant agreement or provide a valid consent, a parent or legal guardian must act on their behalf. The Service is not intended to knowingly collect personal data from children contrary to applicable law.
11. Security
We use measures including encrypted transport, restricted server-side secrets, signed Stripe webhooks, hashed promotional codes, access controls, request-rate limits and anti-bot verification. No online system can guarantee absolute security. If you believe an account or the Service has been compromised, contact us promptly.
12. Changes
We may update this Policy to reflect changes in the Service or law. The current version and effective date will be published here. Where a change materially affects users, we will provide an appropriate additional notice.