Cette page n'est disponible qu'en anglais.

Privacy notice

Last updated: 6 November 2026

You can play Endless Lingle without an account. This notice explains what personal data we use, why we use it and what your rights are under the EU General Data Protection Regulation (GDPR).

Who is responsible for your data

Endless Lingle is run by Bastiaan Burghardt, based in the Netherlands, who is the data controller. For any privacy question or request, email hello@endlesslingle.com.

What we use, and why

  • If you create an account: your email address, password (stored only in hashed form), username, your game in progress, and for each finished game the words solved, guesses used, language and date. We use these to provide your account, save your scores and send account emails, such as sign-up confirmations and password resets. Our legal basis is that this is necessary to provide the service you asked for (GDPR Article 6(1)(b)). We can't create an account without this data.
  • If you play as a guest: your game in progress is kept in an encrypted cookie in your browser. We don't store your scores.
  • Everyone: your IP address and basic request details are processed to deliver the site, limit abusive traffic and keep the service secure. Our legal basis is our legitimate interest in running a safe and reliable service (GDPR Article 6(1)(f)).
  • If you accept analytics cookies: Google Analytics records which pages you visit, how you use them, how you reached the site, your device and browser type, and your approximate location, such as your country or city. It tells visits apart with a random identifier in a cookie. We use this to understand how the site is used and improve it. Our legal basis is your consent (GDPR Article 6(1)(a)), which you can withdraw at any time in the . Nothing is sent to Google Analytics unless you accept. We don't link it to your account, and we've turned off Google signals and ad personalisation.

We don't sell your data, use it for advertising or make automated decisions about you that have legal or similarly significant effects. Other players can't see your username, scores or email address.

Cookies and local storage

Necessary cookies and local storage are needed for features you use, so under EU rules they don't need your consent. Analytics cookies only run if you accept them. We don't use advertising cookies. If that changes, we'll list them here and ask you again.

NecessaryAlways on

Needed for the site to work, so they're always on.

  • ew_gameCookieSaves a guest's game in progress.Kept: 30 days
  • sb-…-auth-tokenCookieKeeps you logged in.Kept: Until you log out, at most 400 days
  • sb-…-auth-token-code-verifierCookieSecures the links in sign-up and password reset emails.Kept: Until the link is used, at most 400 days
  • ew-langCookieRemembers your language.Kept: 12 months
  • ew-theme, ew-contrastLocal storageRemember your dark mode and contrast choices.Kept: Until you clear them
  • ew-cookie-consentLocal storageRemembers your cookie choice.Kept: 12 months

AnalyticsWith consent

Google Analytics shows us which pages are visited and how, so we can improve the game. Only with your consent.

  • _ga, _ga_<id>CookieGoogle Analytics: tells visits apart, to count visitors and pages.Kept: 2 years

AdvertisingNot used yet

Used to show and measure ads. Only with your consent.

You can change or withdraw your choice at any time in the . You can also delete cookies and local storage in your browser settings, but you'll be logged out and a guest game in progress will be lost.

Who processes your data for us

  • Supabase, Inc. stores account and score data and sends account emails.
  • Vercel, Inc. hosts the site and may keep IP addresses in short-lived server logs.
  • Google Ireland Limited provides Google Analytics, only if you accept analytics cookies. Google LLC in the United States may process this data too. It is certified under the EU-US Data Privacy Framework.

These companies act on our instructions. Supabase and Vercel are based in the United States, so your data may be processed outside the European Economic Area. Where that happens, it is protected by safeguards the GDPR recognises, such as an adequacy decision or the European Commission's Standard Contractual Clauses. Email us for more information about these safeguards. We only share data with others if the law requires it.

How long we keep it

We keep your account data until you delete your account, which you can do at any time on your profile page. That removes your account, game in progress and all your scores from our database straight away. Copies may remain in our providers' backups and logs for a limited time until they are overwritten. IP addresses used to limit traffic are held only briefly in memory. Google Analytics data is deleted after 2 months. If you withdraw consent, we stop collecting it and remove its cookies from your browser.

Your rights

You have the right to access your data, correct it, delete it, restrict how we use it, receive a copy in a portable format, and object to processing based on legitimate interests. You can change your username and delete your account on your profile page. For anything else, email us and we'll respond within one month.

You can also complain to a data protection authority, such as the one where you live or the Dutch Autoriteit Persoonsgegevens.

Children

You must be at least 16 to create an account. Guests of any age can play without giving us personal details.

Changes to this notice

If we change this notice, we'll update it here and change the date at the top. If a change significantly affects how we use your data, we'll also tell account holders by email.