Spy

Privacy Policy

Last updated: 25 October 2026

This policy covers Spy, the party word game at spythegame.app, and the Spy app for Android, which shows the same website.

Who is responsible

Lometics GmbH, Gaiserau 39, 9056 Gais, Switzerland
Email: info@lometics.com

The short version

Spy needs no account. A game on one phone stays on that phone. Online rooms store only what the game needs (the names you type in, the room settings and the current round) and are deleted after 30 days without use. There are no ads, no advertising trackers and no cookies, and we sell nothing about you.

What stays on your device

Stored in your browser (or in the Android app) and never sent to us:

• Player names and pictures for games on one phone, the current round, and your game settings
• Your own word lists
• Your language, your name for online rooms and the room you're in, so the app can bring you back
• A copy of the app's files, so it loads fast and works offline

Clearing the site's data in your browser, or uninstalling the app, removes all of it.

What we process, and why

Online rooms

What: when you create or join a room, your device gets an anonymous user ID (no email, no phone number, no name). The room stores that ID with the name you type in, the room code, the room's settings (including copies of word lists someone added to the room), the current round with each player's secret word, and when the room was last used.

How long: leaving a room removes you from it. A room that nobody has used for 30 days is deleted with everything in it. The anonymous ID itself contains no personal data.

Legal basis: providing the online game you asked for (Art. 6(1)(b) GDPR).
Recipient: Google (Firebase Realtime Database and Firebase Authentication), acting as our processor. The room database is located in Belgium (EU).

Crash reports

What: if the app hits an unexpected error, it sends the error message and technical details (where in the code it happened), the page it happened on, your browser and device type and the time. At most a few reports per visit, and never the content of your games.

Legal basis: our legitimate interest in finding and fixing errors (Art. 6(1)(f) GDPR).
Recipient: Google (Firebase), as above. We keep reports only as long as we need them to fix the problem.

Website analytics

What: pages viewed, the site that referred you, the country, region and city your IP address resolves to, device type, operating system and browser, and page-performance measurements. No cross-site tracking and no advertising tags.

What is stored on your device: nothing. The analytics set no cookie and no local storage entry. So that several pages in one visit count as one visit, Vercel derives a short-lived identifier from the request on its own servers and discards it after 24 hours; it is never written to your device and cannot recognise you on another site or on a later day.

Legal basis: our legitimate interest in understanding how the game is used (Art. 6(1)(f) GDPR).
Recipient: Vercel Inc. (USA), acting as our processor. It also hosts the website and, like every web host, briefly processes your IP address to deliver it.

The Android app

The app opens spythegame.app full screen in Chrome, so everything above applies unchanged. Google Play installs and updates it under Google's own privacy policy. The app itself collects nothing extra.

Who receives data

• Google (Google Ireland Ltd. / Google LLC, USA): Firebase for online rooms and crash reports (processor); Google Play for the Android app (independent controller)
• Vercel Inc., USA: hosting and website analytics (processor)

Nobody else. We do not sell personal data and do not share it for advertising. We may disclose data where the law requires it.

Transfers outside Switzerland and the EEA

We are based in Switzerland, which the European Commission recognises as providing an adequate level of protection. Google and Vercel are engaged under the European Commission's Standard Contractual Clauses (with the Swiss amendments) and, where they participate, the EU–US and Swiss–US Data Privacy Frameworks.

Your rights

You have the right to access your personal data, to have it corrected or erased, to restrict processing, to receive it in a portable format, and to object to processing based on our legitimate interests. Write to info@lometics.com and we will answer within one month. As rooms are anonymous, tell us the room code and the name you used so we can find your data, or simply leave the room, which removes you immediately.

You may also complain to a supervisory authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), in the EEA the data protection authority of your country.

Swiss law

The Swiss Federal Act on Data Protection (FADP) applies, and the GDPR applies alongside it where you are in the EEA. The rights above exist under both.

Children

Spy is not directed at children under 16, and we do not knowingly collect their personal data. Online rooms hold no personal data beyond the name a player chooses to type in.

Changes

If the app starts handling data differently, we update this page and the date at the top.