Privacy

Who is responsible

YearLens is published by AFKGame. AFKGame is responsible for how personal data is used to provide YearLens.

For account or privacy requests, contact [email protected]. Write from the email address linked to your account when possible, so we can verify ownership. Do not send your password, payment card details or a sign-in code.

Playing with or without an account

You can start a game without creating an account. When a guest starts a server-issued game, we assign a signed random browser identifier. It connects that browser to game starts and the daily allowance; it does not contain your email address.

Game records can include the mode and date, selected photographs, year and map guesses, round results, timing information, scores and completion state. Account games are associated with an account identifier. Your display name, selected theme and custom photo collections are also saved when you use those features.

Your browser separately keeps settings, language, local game history and unfinished progress so you can return to a game on that device. Server-saved games and local browser history are separate records.

Accounts and security

Supabase Auth handles email confirmation, password sign-in, email sign-in links and password recovery. Account information includes your email address, account identifier, confirmation state and sign-in information. Passwords are processed by the authentication service; YearLens does not store readable passwords.

YearLens currently offers email authentication. Google and Apple sign-in are not enabled. Account and recovery links are verified by the authentication service before a session is created.

What other players can see

Your display name and ranked scores can appear on the leaderboard. Leaderboard records also include game counts and an account identifier. In a multiplayer room, participants can see player display names, room progress, guesses and results as the game reveals them.

Your email address and payment information are not shown in the leaderboard. Choose a display name that you are comfortable sharing with other players, and keep private information out of collection names and descriptions.

Premium and payments

Stripe processes Premium checkout and subscription management on its pages. Payment card details are entered with Stripe and are not stored by YearLens. YearLens keeps the references needed to associate a Stripe customer and subscription with your account, the plan and subscription status, period dates, trial eligibility and payment-related events.

Stripe receives the information you submit during checkout and billing management. The currency, amount and billing dates displayed at checkout apply to that purchase. See the Terms for the YearLens plans and cancellation behaviour.

Linking Krillion

Linking is optional. YearLens uses your confirmed account email after a recent sign-in to check whether the same email has eligible paid access in Krillion. A server-side verification service checks the Krillion account and its current eligibility; you do not give YearLens your Krillion password.

YearLens stores the linked Krillion account identifier, eligibility, verification time and any expiry returned by the service. Eligibility is checked again while you use Premium. Linking or unlinking does not change your Krillion subscription, and your YearLens guesses and game history are not sent to Krillion.

Account emails and optional reminders

Authentication emails and application messages are delivered through Resend. Your email address and the message content pass through that provider. Account messages may concern confirmation, recovery, a subscription, payment status or a linked Krillion benefit. Delivery records and event identifiers help process messages reliably and prevent repeated notifications for the same event.

Optional return-to-game reminders require your explicit permission. If you enable them, we record your choice and the reminder preferences you provide. You can withdraw permission through the message’s unsubscribe link or the available email preferences. Turning off optional reminders does not disable essential account and billing messages.

Cookies and browser storage

YearLens uses first-party cookies for the guest allowance and secure account sessions. In production these cookies are restricted to this site, sent over HTTPS and hidden from JavaScript. They are needed for the corresponding game or sign-in feature.

Signing out clears this browser’s account session cookies. Clearing site storage removes local settings and progress; it does not itself delete server-side account records or cancel a subscription.

Maps, hosting and network requests

The application and its interface fonts are served by YearLens. Interactive maps use OpenFreeMap and OpenStreetMap data. Your browser requests map tiles, map labels and related map resources from those services; an OpenStreetMap tile service is also used as a fallback. Those providers receive the network information needed to answer a request, including your IP address.

Website traffic passes through Cloudflare for content delivery and security. Cloudflare receives the network information needed to process those requests, including your IP address.

YearLens runs on a hosted server, with account and game data stored in Supabase. Stripe handles payments and Resend handles email delivery. These providers process the information needed for their respective roles and may operate outside your country.

Web server access logs include an IP address, request time, requested path, response status and browser user agent. The YearLens access-log format omits query strings and the Referer header. IP-derived rate-limit information is also used in memory to limit abuse.

The current YearLens application does not load advertising or analytics trackers. Map, authentication, payment and email services still process the necessary information described above.

How long information remains

Local browser data remains until it is replaced or you clear it. Account profiles, saved games, collections and subscription records are kept to provide the account and its features. Guest game-start records support the allowance and operation of the service; we do not promise a fixed automatic deletion period for them.

Security, delivery and billing records may need to remain for troubleshooting, preventing repeat processing, accounting, disputes or legal obligations. Deleting an account does not necessarily erase records that a payment provider must independently retain.

Your choices and requests

You can play without an account, change your display name, sign out, unlink Krillion, manage Premium and withdraw optional reminder permission. For access, correction, export or deletion of account data, write to [email protected]. We may need to verify that the account belongs to you.

Depending on your location, you may also have rights to restrict or object to processing, portability, or a complaint to a relevant data-protection authority. We use data to provide the service you request, protect its security, meet applicable obligations and, where you opt in, send optional reminders. This page’s update date changes when these practices change.