Privacy Policy

Last updated 2 October 2026

The short version

We collect what we need to run the designer and the game: your email address, a small profile, what you write, and what you do in the game.
Your game choices stay between you and your partner: a like is only shared once you both like the same dare, and never with anyone else. We use them only to run the game, with your permission, and give them the extra protection privacy law asks for.
No ads, no tracking cookies, and we never sell or share your data for marketing.
You can delete your account yourself at any time (Account, then Delete account), and ask us for a copy of your data through the contact form.

1. Who we are

A Little Bit of Corruption is run by an individual based in the Netherlands (“we”, “us”). We decide what personal data the service uses and why, which makes us the controller of your data under the EU General Data Protection Regulation (GDPR).

This policy covers the website, the designer and the game (together, “the service”). It explains what we collect, why, who else is involved, how long we keep it, and what your rights are. For anything about privacy, use our contact form.

2. What we collect

Your account

When you sign up or sign in, we store:

your email address;
if you sign in with Google, your Google account ID. We ask Google for your email address only: not your name, photo or contacts;
if you set a password, a scrypt hash of it (never the password itself);
your nickname and your gender (male, female or gender-expansive);
your confirmation that you’re over 18;
which version of the Terms and this policy you accepted, and when;
your role: contributor, moderator or admin;
when your account was created and when you last signed in;
a session version, which lets us sign your account out when needed: on your other devices when you change your password, and everywhere when you choose Sign out of all devices;
if we gave you a temporary password because you forgot yours, a note that you still have to choose your own;
if the Google account with your email address took over an account made with it and a password (see Security): when that happened, until the game’s part of it is done, and, until you answer, a note that you still have to say whether to keep your game progress;
if an admin suspends your account, when, which admin, and the reason they gave.

The service never emails you: no verification emails, no newsletters. We write to you only to answer a message you sent us (below).

In the designer

What you do in the designer is stored with your user ID, and shown with your nickname:

the edits you suggest and the new dares you write;
your comments, with their @mentions (and, if you’re staff, which comments you hid or pinned);
reports and feedback you send;
progress snapshots you save;
notifications for you, and markers of what you’ve already read.

For admins and moderators we also store their private “safe space” copies of dares.

When someone reports a comment, the report keeps who wrote it and a short quote of it, for the admins: if that’s you, the admins can see that your comment was reported. Once the report is resolved, the person who sent it is told, with the quote.

Moderators and admins can see your suggestions and new dares. Your comments can be seen by every signed-in user, shown with your nickname, a symbol for your gender, and your role if you’re staff. When a contribution of yours is accepted, it becomes part of the game’s content, and we credit you by nickname in the changelog.

In the game

When you play, we store:

your link code, which changes each time you link with someone, and the times of your last 10 attempts to link (we allow 10 an hour, so codes can’t be guessed);
for your couple: who the two of you are, and when you linked;
which dares each of you liked, which each of you marked done, which you completed together, and what each of you has seen;
which release notes you’ve seen;
game events, such as “your partner marked a dare done”, which your notifications are made from;
if you turn on push notifications, your browser’s push subscription (see Push notifications below).

Your partner sees your nickname and gender, the dares you both liked, and what each of you marked done. Your partner never sees a dare that only you liked: a like stays private until both of you like the same dare. We give your game choices extra protection; see section 4.

Push notifications

Push notifications are optional. If you turn them on, your browser gives us a push subscription: an address at your browser maker’s push service (Apple, Google, Mozilla or Microsoft) and the keys to send to it. Our notifications travel through that service to your device. We keep them discreet: they never include a dare’s title.

Signing out in the game turns notifications off on that device. Signing out of the designer signs you out of the game in the same browser too, but leaves its notifications on: turn them off in the game’s menu first. Changing your password removes them from your other devices, and Sign out of all devices or deleting your account removes them from all of them, this one included.

When you contact us

When you write to us through the contact form, we store what you write and what it’s about, the email address you give us so we can answer you, your name if you give it, and, if you’re signed in, your account. A privacy or account request you send from the designer’s feedback form keeps your account’s email address with it, for the same reason. We use this only to answer you and deal with your request, and we answer by email. We don’t store your IP address with it.

On your device

Your browser’s local storage keeps the designer’s settings (such as view settings), which dares you’ve marked done there, and the game’s own settings. This stays on your device and isn’t sent to us, except when you choose to save your progress to the server. Clearing your browser’s data for the site removes it.

Cookies

We set only the cookies needed to sign you in, keep you signed in and keep bots out:

a session cookie: a signed token that keeps you signed in for up to 30 days;
a short-lived cookie (10 minutes) remembering that you started signing in from the game, so you go back there;
cookies from our sign-in software that protect sign-in against forged requests (CSRF) and remember where to send you afterwards;
security cookies set by the bot check (Vercel BotID, below), which help it tell people from bots;
for admins only, a cookie remembering which test account they’re viewing the designer as.

We don’t use advertising or tracking cookies, and our analytics don’t use cookies at all.

When you visit

Server logs. Our host, Vercel, logs the requests your browser makes, including your IP address, and keeps these logs for about an hour. We use them to keep the service running and to fix problems.
Error log. When something goes wrong (a server error, a page that crashes, a notification a push service refuses, or a sign-in that fails on our side), we keep a short technical note: when it happened, what kind of problem it was, the page or address it happened on (cut short, without anything after a “?”), a cleaned-up error message (for a push, only the push service’s status code; for a sign-in, only the type or code of the error) and the error’s reference number. It never holds your account, email address, nickname, IP address or the names of dares.
Analytics. Vercel Web Analytics counts page views without cookies. We see only aggregated statistics, such as how many people visited a page, not individual visitors.
Bot check. Vercel BotID runs an invisible check in your browser on this site and, when you sign in, sign up or send the contact form, sends signals about your browser to Vercel, to tell people from bots. It may set its own security cookies.

3. Why we use it, and our legal basis

The GDPR only allows us to use personal data when we have a legal basis for it. Here’s what we use, why, and on what basis.

Purpose	Data	Legal basis
Create your account, sign you in and keep you signed in	Account data, cookies	Contract (GDPR art. 6(1)(b)): we need it to provide the service you signed up for
Run the designer: store, show, review, discuss and credit contributions, and notify you	Designer data, nickname, gender, role	Contract (art. 6(1)(b))
Run the game: link you with your partner, find the dares you both liked, keep track of your progress, show each of you your part of a dare, and notify you	Game data, nickname, gender	Your explicit consent (art. 9(2)(a)) for data about your sex life, and contract (art. 6(1)(b)). See section 4.
Send push notifications	Push subscription	Your consent (art. 6(1)(a)): you turn them on, and can turn them off
Answer your messages and requests	Contact messages	Our legal obligation when you exercise your rights (art. 6(1)(c)); otherwise our legitimate interest in answering you (art. 6(1)(f))
Keep the service secure and free of abuse: stop bots, limit link attempts, moderate content, suspend accounts that break the rules, fix problems	Server logs, the error log, bot-check signals, link attempts, reports, suspensions	Our legitimate interest in a secure service that’s safe to use (art. 6(1)(f))
Keep backups, so that data lost by mistake or a failure can be put back	Everything we store (see how long we keep backups below)	The same basis as the data itself had, and our legitimate interest in not losing it (art. 6(1)(f))
Understand how the site is used	Aggregated page views	Our legitimate interest in improving the site (art. 6(1)(f))
Keep the service adults-only, and be able to show what you agreed to	Your 18+ confirmation, the version and date you accepted	Our legal obligation to be able to show your consent (art. 6(1)(c) with art. 7(1)), and our legitimate interest in keeping minors out (art. 6(1)(f))
Meet legal obligations, and establish or defend legal claims	Whatever is relevant to the case	Legal obligation (art. 6(1)(c)) and legitimate interest (art. 6(1)(f))

Where we rely on our legitimate interests, you can object (see your rights).

4. Extra protection for your game choices

The dares you like and play are personal. Privacy law (the GDPR, article 9) gives information about someone’s intimate life extra protection, and we give it to your game choices:

Only with your permission. You give it when you accept the Terms and this policy, with the checkbox when you sign up or in the one-time prompt after signing in. The game needs it to work: a dare can only unlock if we know you both liked it.
Kept private. Your likes are hidden from your partner until you’ve both liked the same dare. A one-sided like is never shown to your partner or to any other user.
Used only for the game. No advertising, no selling, and no profiling beyond the game’s own rules for what to unlock.
You can withdraw your consent at any time. Unlinking from your partner ends your couple and deletes its data for both of you (below). You can also delete your account (see your rights). Withdrawing doesn’t affect what we did before, but without your consent you can’t play.

When either of you unlinks, or deletes their account, we delete your couple’s data right away, for both of you: your likes, the dares you marked done and completed, what each of you has seen, and your game events about it. It can’t be recovered, and linking again, even with the same partner, starts from the beginning. Your partner is only told that you unlinked (after a deleted account, without your nickname).

A note for contributors: you don’t need to share anything about your own sex life to write dares, and please never share anyone else’s.

5. Who else is involved

Our service providers

These companies process data for us, under their data processing terms, only to provide their service:

Vercel Inc. (USA) hosts the site, runs its server functions, delivers its pages through a global network, keeps the short-lived request logs, and provides Web Analytics and the BotID bot check.
MongoDB, Inc. (USA) provides MongoDB Atlas, the database where accounts, contributions and game data are stored, in a cloud region operated by MongoDB Atlas.

Services you choose to use

Google LLC (USA), only if you choose “Sign in with Google”. Google handles that sign-in under its own privacy policy, and tells us your email address and your Google account ID.
Your browser’s push service (Apple, Google, Mozilla or Microsoft), only if you turn on push notifications, to deliver them to your device.

Other people using the service

your partner, as described in section 2;
other signed-in users, who see your comments with your nickname, gender symbol and, if you’re staff, your role;
moderators and admins, who see your suggestions, new dares and reports;
admins, who see who wrote a comment someone reported;
admins, who read the messages you send through the contact form;
other signed-in users, who see in the changelog, by your nickname, the contributions of yours that were accepted.

Nobody else

We don’t sell your data, don’t share it for advertising or marketing, and don’t show ads. We only give data to authorities when the law requires us to.

6. Transfers outside the EU

Vercel, MongoDB and Google are US companies, so your data may be processed in the United States, and push services may deliver notifications from outside the EU. These transfers are covered by the EU–US Data Privacy Framework, for companies certified under it, and/or by the European Commission’s Standard Contractual Clauses. You can ask us for more about these safeguards.

7. How long we keep it

Data	How long
Your account and profile	As long as your account exists. When you delete it yourself (Account, then Delete account), it’s deleted at once; when you ask us to, within 30 days. All that stays is an empty record named “Deleted user”, without your email address, Google account ID, password, gender or anything else about you, only when the account was created, last signed in and was deleted, so that what others wrote that refers to it still reads.
Game data	As long as you’re linked. Deleted for both of you as soon as either of you unlinks or deletes their account. Your link code and your game events are deleted with your account.
Your comments	As long as your account exists. When it’s deleted, each of your comments is deleted, unless someone else wrote after it in the same conversation: then it stays, shown as by “Deleted user”, so the conversation still makes sense. A report about one of your comments keeps a short quote of it (its first 140 characters) even after the comment is deleted: in the report, until an admin deletes it, and in the notification its sender got when it was resolved.
Suggestions and new dares not accepted into the game, notifications, saved progress, safe space copies	As long as your account exists. Deleted with your account.
Reports, feedback and contact messages you sent	Until an admin deletes them, once they’ve been dealt with. If you sent one signed in and your account is deleted later, it stays, shown as from “Deleted user”, without the email address and name you gave us.
Contributions accepted into the game	They’re part of the game’s content and stay. When your account is deleted, they’re shown as by “Deleted user”.
Your nickname in other people’s records (the changelog, reviews, moderation)	Replaced by “Deleted user” when your account is deleted. Comments other people wrote that @mention you keep your old nickname as they wrote it.
A suspension of your account	While it lasts. Removed when an admin lifts it, or with your account.
Push subscription	Until you turn notifications off, or sign out in the game, on that device; the push service tells us it’s no longer valid; you change your password (for your other devices); you choose Sign out of all devices (for every device); or your account is deleted.
Link attempts	The times of your last 10 attempts; older ones drop off as you try again. Deleted with your account.
Server logs at Vercel	About an hour.
Error log	Until newer notes push it out: we keep only the newest, about 1 MB of notes about errors and 256 KB of reports of crashed pages (or 30 days, if a log ever can’t be limited by size). It isn’t included in backups.
Backups	We back up the whole database by hand now and then, and keep the backups on an encrypted disk. A backup holds everything as it was when it was taken, including an account deleted since, until we delete that backup; we delete old backups regularly. We’d restore one only to put back data lost by mistake or a failure, and a restore can bring back what was deleted after the backup was taken: an account deleted since, a deleted user’s comments or their nickname in the credits, or a couple that has unlinked since. If it does, we delete that again, by hand. Separate copies of the game’s content (the dares, with their credits) may be kept longer.
A copy of your data you asked us for	Deleted once we’ve sent it to you.
Data in your browser	Until you clear it.

8. Your rights

Under the GDPR you have the right to:

access the personal data we hold about you, and get a copy;
correct it if it’s wrong or incomplete;
have it erased;
restrict how we use it;
receive it in a structured, machine-readable format, and have it passed on to someone else (portability);
object to what we do based on our legitimate interests;
withdraw your consent at any time, without affecting what we did before.

Some of this you can do yourself, in Account: in the game’s menu, or in the designer’s account menu. There you can change your nickname and your password, sign out of all your devices, and delete your account.

For anything else, use the contact form, signed in or giving your account’s email address so we can tell it’s you. We may ask for more to confirm who you are. We’ll reply within one month; if a request is complex we may need up to two months more, and we’ll tell you if so.

A copy of your data. Ask us through the contact form, and we’ll send you what we store about you as a file in a structured, machine-readable format (JSON): your account (without your password), your game data as the game shows it to you, what you wrote and did in the designer, and the messages you sent us while signed in. It never includes the likes your partner hasn’t shared with you.

Deleting your account. In Account, choose Delete account and type DELETE to confirm. It’s done at once, and it can’t be undone. If you’re linked, you’re unlinked first, which deletes your couple’s data for both of you. Your account, profile and game data are deleted, your notifications stop, and you’re signed out everywhere. What you wrote in the designer is deleted or anonymised, and dares accepted into the game stay without your name (see how long we keep it for each). Your email address, or your Google account, can then make a new account. If deleting stops partway, you’re signed out either way, and the page asks you to tell us through the contact form so we can finish it. You can also ask us to delete your account through the contact form, and we’ll do it within 30 days. To delete only your game data, just unlink.

Complaints. You can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the authority in the country where you live or work. We’d appreciate the chance to put things right first, so please contact us too.

9. Security

Passwords are stored only as scrypt hashes.
Everything between your browser and the service travels over HTTPS.
Your session is a signed token that can’t be altered without us noticing.
Changing your password signs you out on your other devices and stops the game’s notifications there. Choosing Sign out of all devices does the same on every device, this one included.
An account made with an email address and a password belongs to whoever owns that email address. If the Google account with that address signs in, it takes the account over: the password and profile are dropped, every session is signed out, and in the game the account’s notifications are turned off on every device and its link code is replaced. If the account is linked with a partner in the game, its owner is then asked whether to keep that couple’s progress or delete it; deleting it unlinks the couple, which deletes its data for both partners. Until the owner answers, the couple stays linked and the game goes on as before.
Your link code works for one link only: when you link, you and your partner both get a new one.
Direct access to the data is limited to the operator. Staff in the designer see only what their role allows.
Backups of the database are kept on an encrypted disk, and the error log never says who an error happened to.

No system is perfectly secure. If a breach puts your data at risk, we’ll inform the data protection authority and you, as the law requires.

10. Adults only

The service is only for adults (18+). We don’t knowingly collect data from anyone under 18, and if we learn that an account belongs to someone under 18, we delete it. If you think a minor is using the service, please tell us through the contact form.

11. Automated decisions

We don’t make decisions about you based only on automated processing that have legal or similarly significant effects. Two things are automatic: the game’s own rules, which decide which dares you see and unlock from what the two of you liked and completed; and the bot check, which can block a sign-in, or a message sent through the contact form, that it takes for a bot. If that happens to you, tell us through the contact form, or email us at info@alittlebitofcorruption.com if the bot check stops that too.

12. Changes to this policy

We’ll update this policy as the service changes, along with the date at the top. If a change matters, for example a new use of your data, we’ll ask you to accept the new version in the app.

13. Contact

Questions, requests or complaints about your data: use our contact form, or write to info@alittlebitofcorruption.com. The rules for using the service are in the Terms of Service.