Privacy Policy
This explains what SudoRush collects, why, how long we keep it, and the rights you have over it. SudoRush is the data controller.
What we collect
- Account data — email address, display name, hashed password, the country you tell us, and your payout destination (e.g. a PayPal email address).
- Play data — which puzzles you were assigned and solved, how long each took, how many hints and mistakes you used, your points, your team membership, and your payouts.
- Integrity data — for each solve, an aggregate picture of how it was played: the timing pattern of your entries as our server received them, how many mistakes you made, whether the tab kept focus, and whether keyboard or pointer input was used. We use this only to tell people apart from scripts.
- Technical data — IP address, browser user-agent and timestamps, recorded with logins and with each attempt.
- Correspondence — anything you send us through the contact form or by email.
We do not record the contents of your keystrokes, we do not use session-replay tools, and we do not sell data to anyone.
Why we use it, and our lawful basis
- To run your account and the contest — performance of a contract.
- To pay you, and to keep the financial records the law requires us to keep — contract and legal obligation.
- To detect automation and fraud, and to keep the contest fair for everyone — legitimate interests.
- To secure the service against abuse — legitimate interests.
- To send you service email (verification, password resets, payout notices) — contract. We do not send marketing email unless you ask us to.
Automated decisions
Suspected automation is scored automatically, and a high score can suspend an account and hold points immediately. No account is permanently banned and no payout is refused by software alone — a person reviews every case before it becomes final, and you can contest the outcome by writing to us.
Advertising and cookies
We use one cookie for your login session; it is strictly necessary and carries no tracking. If Google AdSense is enabled on the site it may set its own cookies and process data as an independent controller under its own policy. Directly-sold advertisements on this site carry no third-party scripts and no tracking. See our Cookie Policy.
Who we share it with
- Our payment provider, to send you money — the amount, your destination address and a reference.
- Our email provider, to deliver service email.
- Our hosting provider, which stores the database on our behalf.
- Authorities, where we are legally required to disclose.
That is the complete list. There are no advertising or analytics partners receiving your account data.
How long we keep it
- Account and play data: while your account exists, then deleted or anonymised within 90 days of closure.
- Payout records: seven years, because financial record-keeping law requires it.
- Integrity and technical logs: 12 months.
- Contact messages: 24 months.
Your rights
You can ask for a copy of your data, correct it, delete it, restrict or object to our use of it, or ask for it in a portable format. Email support@whosin.chat and we will respond within 30 days. You can delete your account yourself from your account settings.
If you are in the UK or EU and think we have handled your data badly, you can complain to your national supervisory authority.
Security
Passwords are stored using scrypt with a per-password salt and are never recoverable. Sessions are stored server-side and identified by a hash, so a copy of our database does not yield usable login credentials. Traffic is served over HTTPS.
International transfers
Our servers and providers may be outside your country. Where data leaves the UK or EEA it is protected by the standard contractual clauses or an equivalent safeguard.
Children
The service is not for anyone under 18. If we learn that an account belongs to someone younger we will close it and delete the data.