CLUE XI
PRIVACY NOTICE

Your data. No guesswork.

Effective 5 September 2026. This notice explains the personal information Clue XI uses for its website and apps. The iPhone/iPad app stores only whether a player confirms they are 16 or over before any advertising-consent flow; it does not collect a date of birth, and under-16 players receive no ad request. Free website players and eligible iPhone/iPad users may receive Google advertising after consent. The Android app does not currently load native advertising. Clue XI does not track activity across other companies’ apps or websites.

1. Controller and contact

Clue XI is operated by Tazz Studio Limited, registered in England and Wales under company number 16384638. For privacy or support enquiries, email support@cluexi.co.uk.

2. Information we use

  • An essential random device identifier that recognises your Clue XI profile on this device.
  • Your chosen public username and country.
  • If you create an email login: your private email address, a salted one-way password hash, hashed session tokens and login-security records. Clue XI never stores your password in readable form.
  • Short-lived, one-use hashed tokens used for email verification, password reset and reminder unsubscribe links.
  • If you deliberately enable it, your Daily XI email-reminder preference, time zone and last delivery date. Reminders are off by default and can be disabled from your profile or any reminder.
  • Friend requests and accepted friend connections between registered profiles.
  • Quiz scores, total points, achievements, streaks, skill rating, wins, losses, draws, daily-attempt status and leaderboard position.
  • Room codes, match participants, question order, scores and completion state for online 1v1 games.
  • If you buy Pro: Stripe customer, subscription, price, renewal, cancellation and payment-status identifiers linked to your Clue XI profile. Stripe collects payment-card and billing details directly; Clue XI does not receive or store full card numbers.
  • Any football-data error report you submit, including its category and optional description.
  • Daily totals for broad product events, such as quizzes started, registration steps completed or quizzes finished. These totals do not contain a player, device, IP address or browser identifier, or any email address.
  • A short-lived last-active time linked to the essential device or profile identifier, used only to show the owner an aggregate estimate of players online.
  • Device-local preferences such as language, guest-game count, install state and the essential storage notice choice.
  • Security, error and hosting logs needed to operate and protect the service.
  • For free website players and supported iPhone/iPad builds where advertising is enabled: the consent choice and advertising-related device, browser or app, approximate location, IP, delivery, view and interaction information may be processed by Google and its approved partners. Clue XI may receive aggregated advertising reports.

3. Why we use it and our lawful bases

We process profile, gameplay, multiplayer and subscription-status information to perform our contract with you and provide the features you request. We rely on legitimate interests to secure the service, prevent cheating and abuse, investigate errors, answer support requests and improve reliability through anonymous daily totals; we balance those interests against player rights. We retain financial records where tax, accounting, consumer or legal duties require it. Consent is the basis for optional advertising. Google-certified privacy choices are presented before advertising is used and can be reopened in supported iPhone/iPad builds when required. Optional Google advertising technology is not used for Pro members or in the current Android app. These first-party totals remain separate from advertising-provider reports. Refusing consent will not prevent essential gameplay.

4. Public information and leaderboard choice

Your username and selected country flag may appear where you deliberately use social features such as friend lists and rooms. During registration, you must explicitly choose whether to join public leaderboards or keep your scores private; neither option is selected for you. If you opt in, Clue XI uploads and displays your username, country flag, quiz points and competitive record on its servers and worldwide rankings. You can change that choice in your profile; opting out removes your scores from public leaderboard results. Do not put your real name, email address or other sensitive information in a username.

5. Service providers, remote media and transfers

Clue XI uses OpenAI Sites and Cloudflare to host and protect the service, Google Play and Apple’s App Store to distribute the apps, and Stripe for secure website checkout, recurring billing and payment management. Club badges, player images and source material may be requested from TheSportsDB or Wikimedia-hosted services; those remote providers may receive the requesting IP address, browser or app user agent, requested file and request time. These providers process information under their own privacy terms and may use approved international-transfer safeguards where data is handled outside the UK. Google AdSense, Google AdMob and Google’s certified consent platform may process advertising and consent information for eligible free players. The privacy-choice panel identifies approved partners, purposes and transfer information before optional advertising is used.

6. Retention and deletion

Profile, achievement, friendship, reminder preference and ranking data is kept while the account is active and deleted when you delete the profile. Verification links expire after 24 hours, password-reset links after 30 minutes, and used or expired tokens are routinely removed. Online-presence records expire within 24 hours and the owner sees only the aggregate count. Sync codes are replaced when a new one is generated and removed with the profile. Waiting matches are removed and completed-room records are anonymised so they no longer identify the deleted player. Football-data reports and support correspondence are kept only while needed to investigate, respond, protect the service or establish legal claims. Subscription identifiers and transaction records may be retained after deletion for the period required for accounting, tax, chargebacks, fraud prevention or legal claims. Anonymous daily event totals may be kept because they cannot identify a player. Hosting and security providers keep operational logs under their published retention controls. If advertising launches, the consent panel will state its own retention periods before consent is requested.

7. Your choices and rights

Depending on where you live, you may have rights to access, correct, erase, restrict, object to or receive a copy of your data. You can edit your username and country in the game and delete your profile immediately through the Account Deletion page. If you no longer have the original device, request deletion from any device at support@cluexi.co.uk. Profile deletion is not conditional on cancelling billing, although recurring billing must be cancelled separately with the relevant store or provider. UK users may also complain to the Information Commissioner’s Office. If advertising launches, you will be able to reopen Privacy choices from the Cookie Notice and site footer, refuse or withdraw optional advertising consent and continue using essential gameplay.

8. Children

Clue XI is not designed to collect data from children below the minimum digital-consent age applicable in their country. A parent or guardian should supervise younger players. We will remove information that we learn was collected without the required permission.

9. Security and changes

We use access controls, encrypted connections, salted slow password hashing, hashed session tokens, login rate limits and limited data collection to reduce risk. No online service can guarantee absolute security. Material changes to this notice will be dated and shown clearly before they take effect.