Privacy Policy

Who we are

Guess the District (guessthedistrict.in) is run by its three co-founders, Ansh Raj Suryavanshi, Aaditya Ahuja and Aaradhya Gupta. For the purposes of the DPDP Act, they are the data fiduciary: the people who decide why and how your personal data is processed.

Address: B/30, Samdariya Residency, MR4 Road, Jabalpur, Madhya Pradesh 482001. Email: guessthedistrict@gmail.com. Phone: +91 9425866720. Our grievance officer and contact for data questions are listed on the Contact & Grievances page.

What we collect and why

We collect only what the game needs. Each item below says what it is used for.

• Session cookie. A random token that keeps you signed in and links your rounds to you, including when you play as a guest without signing in. Our database stores only a one-way hash of it, never the token itself.
• Account details, when you sign in with Google or Discord. Your account id with that provider, your display name and a link to your profile picture. Used to create your account, show your name in the game and let you sign in again.
• A fingerprint of your email. When you sign in, we turn your verified email address into an HMAC (a keyed, one-way fingerprint) and store only that. It lets us recognise that a Google sign-in and a Discord sign-in belong to the same person, so your progress isn't split. We never store your email address.
• Your handle, if you choose one. It is shown on leaderboards, in battles and on your public profile.
• Your age group. We ask for your birth year once and store only the group it falls into (under 13, 13 to 17, or 18 and over), never the year itself. We use it to apply the protections for children described below.
• Game history. Your rounds, guesses, clues opened, scores, streaks, achievements and friend battles. Used to run the game, keep scores fair and show your stats.
• Your IP address. Used to stop abuse and limit how fast requests can be made. Our rate limiter keeps only a salted, one-way hash of it for a short time. Raw IP addresses can appear in our server security logs.
• Messages you send us. If you email us, we keep the message and your email address to answer you and to keep a record of grievances.

We do not collect your location, contacts or phone number. We do not sell personal data, and we do not use third-party analytics or tracking tools today.

Features we are planning

We will update this policy, and ask for your consent where the law requires it, before any of these goes live:

• Discord Activity. A version of the game you can play inside Discord. It will use your Discord user id, username and avatar to run the game and keep your progress.
• Premium, paid through Razorpay. Razorpay (India) will process your payment. We will receive and keep only payment and subscription reference numbers and the status of your plan. We will never see or store your card, UPI or bank details.
• Ads from Google AdSense. Ads will come with a consent banner. See Cookies and similar technologies.

Why we are allowed to use your data

We process your data on the basis of your consent, which you give when you sign in and agree to this policy, and for the purposes you yourself provide it for, such as playing the game.

You can withdraw your consent at any time, and doing so is as easy as giving it: delete your account from the Me page, or email us. After that we stop processing your data and ask our service providers to stop too. Withdrawing consent does not affect processing that happened before it.

Who we share data with, and where it is stored

We use these service providers (data processors) to run the game. Each one gets only the data it needs for its job.

• Vercel hosts the website's pages, which are static files with no personal data in them. Vercel serves them from data centres around the world.
• Oracle Cloud runs our game server (the API) and its Redis cache, in Ashburn, Virginia, USA.
• Supabase hosts our database, on Amazon Web Services in us-east-1 (Northern Virginia, USA).
• Google and Discord handle sign-in when you choose them.
• Gmail (Google) holds the emails you send us.
• Razorpay (India) will process payments once Premium launches.

Your data is stored outside India, in the USA. The DPDP Act allows personal data to be transferred outside India, except to countries the Government of India restricts by notification. No country is restricted today. If that changes, we will follow the restriction.

We may also disclose data when Indian law requires it, for example to a court or a government agency with lawful authority.

We have data processing agreements with Vercel, Supabase and Oracle that require them to protect your data and use it only on our instructions.

Google and Discord sign-in data

From Google we ask only for your basic profile and email (the openid, email and profile scopes). From Discord we ask only for your basic account details (the identify scope, and email to match accounts). We use this data only to sign you in and run your account, as described above.

We never send your Google or Discord data to advertising networks or data brokers, and we never sell it. You can unlink Google or Discord from the Me page, or delete your account, and we delete the data that came from that provider.

How long we keep data

• Account and game history: until you delete your account. Deletion removes your account and play history at once, and from our backups within 30 days.
• Guest play: a guest and their rounds are deleted after 12 months without a visit.
• An account nobody can sign in to any more (for example, one left behind when its sign-in moves to another account): deleted after 30 days.
• Expired sessions: deleted once they expire.
• Rate-limiting records: minutes to hours.
• Server security logs: one year, and then deleted. This covers the 180 days India's cybersecurity rules (CERT-In) require and the one year the DPDP Rules require.
• Payment records (once paid features launch): 8 years, as tax and accounting law requires.
• Support emails and grievance records: 2 years.

How we protect your data

All traffic is encrypted with HTTPS. We store session tokens and email addresses only as one-way hashes, and IP addresses in our rate limiter only as salted hashes. The database and the server disks are encrypted at rest, and so are our backups. Only the co-founders can access the production systems.

If a personal data breach happens, we will tell the people affected and the Data Protection Board of India without delay, and report it to CERT-In, as the law requires.

Your rights

Under the DPDP Act you have the right to:

• Access a summary of your data and how it is processed: use Download my data on the Me page, or email us.
• Correct or update your data: change your handle on the Me page, or email us.
• Erase your data: use Delete account on the Me page, or email us.
• Withdraw consent, as described above.
• Nominate someone to use these rights for you if you die or become unable to.
• Have your grievance resolved by us, and then complain to the Data Protection Board of India if you are not satisfied.

To make a request, email guessthedistrict@gmail.com with the handle or display name on your account and the sign-in method you use (Google or Discord), so we can find it. We may ask you to confirm the request while signed in. We aim to acknowledge requests within 24 hours and resolve them within 15 days, and always within the 90 days the DPDP Rules allow.

Children

Guess the District is a geography game that many students enjoy. Under the DPDP Act, anyone under 18 is a child.

How it works today. Players of any age can create an account. We ask for a birth year once and keep only the age group. We show no ads, use no third-party analytics and do not track or profile anyone, of any age.

What is coming. The DPDP Act and its Rules require verifiable consent from a parent or lawful guardian before an online service processes a child's personal data. This duty applies from 13 May 2027, and we are building a parental consent flow before then. When it is ready, we will ask for a parent's consent for existing accounts of players under 18. Without a parent's consent, the account moves to a limited mode: the player can keep playing, but we store only the minimum data needed to run the game, and show no ads and no personalisation.

When ads arrive, players under 18, and players whose age we don't know, will see only non-personalised ads. We will never track children or show them targeted advertising.

Parents and guardians can email us at guessthedistrict@gmail.com at any time to see or delete a child's data.

The Discord Activity, once launched, will follow Discord's minimum age of 13.

Cookies and similar technologies

Cookies we set. They are all needed for the site to work:

• zila_sid: keeps you signed in and links your rounds to you. It is set by our game server, cannot be read by scripts on the page, and lasts up to one year.
• zila_lang: remembers whether you chose English or Hindi. It lasts up to one year.
• A short-lived cookie during sign-in, which protects against forged sign-in requests and is removed when sign-in finishes.

Storage on your device. Your browser's local storage keeps your preferences: the day or night theme, whether sound is on, layout and practice filters, and whether you have dismissed the install prompt or the age question, and your choice about ad cookies (zila_consent). This stays on your device; we never receive it.

Advertising cookies (planned). When we turn on Google AdSense, Google and its partners may place and read cookies, use web beacons and collect IP addresses to show and measure ads. A banner asks for your consent before any advertising cookie is set, and the game works the same if you decline. You can change your choice at any time with Ad choices in the footer. Ads are not personalised to you. See how Google uses data from sites that use its services.

You can block or delete cookies in your browser's settings. If you delete zila_sid, you will be signed out, and a guest's rounds can no longer be linked to them.

Changes to this policy

When we change this policy, we update the date at the top of the page. For a significant change, such as a new purpose for your data, we will tell you in the game and ask for your consent again where the law requires it.

Change log: 1 November 2026: first version.