Privacy Policy

Last updated: October 11, 2026

This policy explains what personal data SpiritClicker ("the Game", "we", "our") collects, why, and what rights you have. It applies to everyone who plays the Game. We aim to collect as little as possible.

1. Who is responsible

The data controller is the operator of SpiritClicker (StropeVerse). For any privacy question or request, email us at StropeVerse@outlook.com (or reach us via @StropeVerse on X).

2. What we collect

Data	Why
Email address (if you sign up with email, or the email address from your Google account if you sign in with Google)	Authentication, account recovery, transactional email (sign-up confirmation, password reset).
Telegram account ID, plus your Telegram username or first name, which becomes your starting username if it fits our rules and is still free (only if you play via our Telegram Mini App — optional; you can change the username)	Authentication and to link your progress to your Telegram account.
Username + chosen avatar	To identify you in-game and on leaderboards.
Game save (your gameState: level, currencies, upgrades, codex, settings)	To persist your progress across sessions and devices.
Leaderboard entry (username, score, level, total kills)	To run the public and PvP leaderboards.
Friends list (other players you add)	To show your friends' progress.
Guild membership, invitations and requests, and the messages you send in guild chat (only if you join a guild)	To run guilds and guild chat. Chat messages are only visible to members of your guild.
Wallet address + cached NFT inventory (only if you link an Enjin wallet — optional)	To grant optional NFT-based in-game boosts, and to send you a prize in ENJ if you win one (see section 7 of the Terms). The Game is fully playable without it.
How you tap and play: the time between taps, how evenly spread your taps are, the share of touch input, and reaction times in boss fights	Detecting bots and cheating, so leaderboards and prizes stay fair.
Technical data: IP address (used transiently for rate-limiting — login, saves and error reports — and abuse prevention), and error / anti-cheat audit logs (which may include your user id, and for error reports your browser's user agent)	Security, fraud/cheat prevention, and fixing bugs.

We do not collect your real name, address, payment-card data, precise location, or browsing history. We do not run advertising, and we do not sell or share your data with advertisers.

3. Legal basis (GDPR)

Contract — to create and run your account and save your progress.
Legitimate interest — to keep the Game secure, prevent cheating, operate leaderboards, and understand how the Game is used.
Consent — linking a wallet and reading your NFT inventory is optional and only happens when you choose to connect one.

Anti-cheat and automatic decisions. If the way you tap and play looks automated, our servers can flag your account automatically. A flagged account is hidden from the leaderboards, can't win prizes and can't chat in guilds. When that happens, the game tells you what kind of pattern was found and gives you a button to appeal. A person reviews every appeal, and a person checks the leaderboard before any prize is paid. We never ban an account without a person deciding.

4. Cookies & local storage

We use only functional browser storage — no tracking or advertising cookies, so there is no consent banner to click through. Specifically: a Supabase authentication token (to keep you logged in), your game settings, a recovery copy of your latest game save (so a crash or a closed tab doesn't lose your progress), a few small counters for the Rift and seasonal events, and, inside the Telegram app, a small flag remembering your login preference. The recovery copy stays on your device after you log out. All of this lives on your device and you can clear it any time via your browser.

The page also loads Telegram's Mini App script from telegram.org, so the Game works inside Telegram. Your browser fetches it when you open the Game, also outside Telegram, so Telegram receives your IP address and browser details at that moment.

No analytics. We removed Google Analytics on August 12, 2026, and we do not use any replacement. Nothing on the site measures your visit, and no third-party analytics script runs in your browser.

5. Who we share data with

We use a small set of service providers ("processors") strictly to run the Game. We do not sell your data to anyone.

Supabase — authentication, database and hosting. Your account and save data are stored on Supabase servers in the EU (eu-west-1, Ireland).
Vercel — serves the website and static assets via its global CDN. No personal game data is stored here.
Resend — sends transactional email (confirmation / password reset) on our behalf.
Google — only if you choose "Continue with Google", Google handles the sign-in and we receive your Google account's email address to identify you. Governed by Google's own privacy policy.
Telegram — only if you play via our Telegram Mini App, Telegram provides a signed identity (your Telegram account ID) so we can log you in. Governed by Telegram's own privacy policy.
Enjin Platform — when you link a wallet, we verify ownership and read public NFT data from the Enjin Blockchain. Blockchain data is inherently public.
Enjin Multiverse Quest — if you have linked a wallet, we report your progress on the Multiverse quests to Enjin (nft.io): your wallet address, the points you earned and an internal player code. Enjin uses this to run the Multiverse Quest. Prizes we pay in ENJ are sent on the Enjin Blockchain, where every transaction is public and permanent.

6. Where your data lives

Your account and save data are stored in the European Union (Supabase, Ireland). Some providers (e.g. CDN edges, email delivery) may process technical data outside the EU under standard contractual safeguards.

7. How long we keep it

Account, save and leaderboard data: for as long as your account exists.
Save backups: a rolling copy of recent save versions is kept for about a week so we can restore your progress if it gets corrupted. Older copies are deleted every day.
Guild chat messages: deleted automatically after 30 days, or earlier when you, your guild leader or an admin deletes them. If an admin removes a message for breaking the rules, its text is kept in the audit log as evidence and pruned with it.
Security/audit logs: pruned automatically (admin/audit logs after ~90 days; login nonces within about an hour).
Tap measurements: 30 days. A daily summary of them is kept as long as your account exists.
Feedback you send, your PvP runs and your World Boss attacks: kept as part of your account until you delete it.
Accounts that were created but never used are not removed automatically. Ask us if you want one removed.
Deleting your account: you can ask for this in the game (Settings → Support & legal → Delete my account). To protect you in case someone else gets into your account, nothing happens right away. There is a 14-day waiting period in which you can cancel, and we check the request before we delete anything. Then your account is removed: your progress in every StropeVerse game, your username, your wallet link, your logins, your feedback and your store orders. All of this happens within 30 days of your request. A few things remain: a record that you asked for the deletion, an entry in our admin log (deleted after about 90 days), and your name if you were in the final top 25 of Multiverse season 1. We cannot erase what is public on a blockchain (prize payouts, NFTs) or what was already sent to Enjin. A banned account cannot use the in-game button; email us instead.

8. Your rights

Under the GDPR you have the right to access, correct, delete, export (port), restrict or object to the processing of your personal data, and to withdraw consent (e.g. by unlinking your wallet in Settings). Where we use your data based on our legitimate interest, such as anti-cheat, you can object at any time. Email us and tell us why. To exercise any of these, email us at StropeVerse@outlook.com. You can change your username in-game and manage your linked login methods (wallet, Google, Telegram) in Settings → Account at any time, and ask to delete your account in Settings → Support & legal. You also have the right to lodge a complaint with your local data protection authority — in Belgium, the Gegevensbeschermingsautoriteit.

9. Security

Data is transmitted over HTTPS and stored on Supabase with row-level security so players can only read their own account data. Passwords are hashed by Supabase Auth — we never see them. Saves and leaderboard scores are validated server-side to prevent tampering.

10. Children

SpiritClicker is not intended for children under 16. We do not knowingly collect data from anyone under 16. If you believe a child has given us data, contact us and we will delete it.

11. Changes to this policy

We may update this policy occasionally. Material changes will be announced on the login screen or in-game. The "last updated" date above always reflects the current version.