Privacy Policy

Superglue Games (playsuperglue.com) is operated by Munde Group Kft. (company no. 13-09-219738), registered at Váci út 49, VI. emelet, 1134 Budapest, Hungary. We are the data controller for personal data collected through this website.

Contact: contact@superglue.games

When you create an account. You can sign in with Google or with an email sign-in link. We store your email address, and — if you sign in with Google — your name and profile picture as provided by Google. We never see or store a password.

When you buy a game session. We store your email address, the game you bought, the session title and scheduled date you chose, and the amount paid. Your billing address, tax ID (if provided) and payment details are collected directly by Stripe during checkout; your card number never reaches our servers. See Stripe's Privacy Policy.

When you subscribe to a plan. We store your plan, your Stripe customer and subscription references, and a ledger of any credits you receive and spend.

When a game session is started. We keep a record of each access code we issue — which game, when, and who requested it (your email address, or your Slack username if started from Slack). The code label, which can include your email address, is also sent to the game server that runs your session; all game servers are operated by us.

If you link Slack (Team). We store your Slack workspace ID and name, and the Slack username and user ID of whoever runs the /superglue command.

If you book a game master or request a hosted event. We store the game, the date, the number of rooms and any notes you include with the booking.

When you browse the site. We use PostHog (EU-hosted) for product analytics: page views, clicks and errors. For visitors who are not signed in, analytics data is kept only for the duration of your browser tab and no tracking cookies are set. When you sign in, analytics are linked to your account (see section 5).

When you play a game. Our games (on playsuperglue.com subdomains and playaligned.com) report gameplay events to the same PostHog project: loading time, when play starts and stops, which puzzles, levels or rounds are started and completed, hints used, and how the game ended. The game servers report room facts such as the number of players and the result. These events carry no email address, player name, chat or typed answer.

When your team finishes an escape room. The game keeps a result of each run for the team scorecard and the results archive: the player names typed when joining, the team name (if the team chose one), the session code and title, the time taken, the hints used and how the game ended. The scorecard can be shared by link; the shared page and image show first names only and are not indexed by search engines. A team appears on the public leaderboard only if it opts in on its scorecard, and then only with its team name, never with player names.

Your IP address is used transiently for rate limiting (for example, on email sign-in requests) and is not stored in our database.

• To deliver what you bought: creating game sessions, issuing access codes, sending the confirmation email with your join link, and managing your plan and credits (performance of a contract).
• To send transactional email: order confirmations, sign-in links and session-related messages via Resend.
• To send our newsletter: a weekly email about new games, updates and offers, sent to account holders, to players who entered their email on a game's end screen, and to players who signed up on our earlier game platform (legitimate interest / consent). Every newsletter has a one-click unsubscribe link, and you can also ask us to remove you at any time. Unsubscribing does not affect transactional email.
• To respond to you: support requests and hosted-event bookings (performance of a contract / legitimate interest).
• To show team scorecards and the leaderboard: keeping game results so teams can share their scorecard and hosts can find past sessions (performance of a contract / legitimate interest), and listing teams that opt in on the public leaderboard (consent).
• To improve the product: understanding how the site is used through analytics (legitimate interest).
• To prevent abuse and comply with the law: keeping records of issued codes and payments, including for tax and accounting purposes (legal obligation / legitimate interest).

We do not sell your personal data, and we do not share it with third parties for their own marketing.

The following service providers process data on our behalf:

• Stripe — payment processing, invoicing and tax calculation. Privacy Policy
• Resend — transactional email and our newsletter. Privacy Policy
• Google — sign-in with Google (only if you choose it). Privacy Policy
• PostHog — product analytics, hosted in the EU. Privacy Policy
• Railway — application and database hosting. Privacy Policy
• Cloudflare — DNS. Privacy Policy
• Slack — only if you link a workspace. Privacy Policy

Team insights by superglue.team (reporting) is delivered through our own meeting-analysis product (teambuildingbot); your reporting page is provisioned by us and shared only with you.

Some providers (such as Railway and Stripe) are based in the United States. Where data leaves the EEA, transfers rely on safeguards such as the EU–US Data Privacy Framework or Standard Contractual Clauses.

We keep this deliberately minimal. The site sets:

• sg_user — keeps you signed in for 30 days (essential, set at sign-in).
• sg_host — staff and game-host sign-in, 7 days (essential, staff only).
• sg_oauth_state / sg_oauth_next — short-lived security cookies used only during Google sign-in (essential, deleted after ten minutes).

Analytics without tracking cookies. While you are not signed in, PostHog runs with session-only storage: nothing persists after you close the tab, and no analytics cookies are written. If you sign in, analytics switch to persistent first-party storage linked to your account so we can support you and understand how the product is used; this stops (and local analytics data is cleared) when you sign out.

Because we set no persistent tracking cookies for visitors, the site does not show a cookie banner. Essential sign-in cookies are exempt from consent requirements.

Arriving from superglue.games. Our marketing site adds its own session-only analytics identifier to links that point here, so a visit there and the session that follows count as one person rather than two. We adopt that identifier only when you have no identifier here yet, and it is removed from the address bar on arrival. Visitors who switch off analytics on superglue.games are not given one.

Where your visit came from. On the first page you open here, we note in the same session-only storage the website that sent you (its name only, such as google.com), the page you landed on and any campaign tags in the link. superglue.games passes on the website that sent you there. If you create an account, we keep this with your account so we know which channels bring new users. We keep no full web addresses, so no search queries or browsing history, and we set no cookie for this.

In our games. Game analytics follow the same rule: session-only storage and no cookies, whether or not you have an account. When you start a game from this site, the link that opens it in your browser carries your analytics identifier and a one-time session id, so the game counts as part of the same visit; both are removed from the address bar as soon as the game loads. Links you share with your group do not carry them, so players who join by link stay anonymous. If session recordings are enabled for a game, all text inputs are masked.

Your account and its data are kept while the account exists. Payment and order records are retained as long as required by tax and accounting law. Records of issued game codes are kept for audit and abuse-prevention purposes. Player names in game results are deleted 12 months after the game; the team name and the numbers stay. If you ask us to delete your account (see section 7), we remove your personal data except what we must keep to meet legal obligations.

Under the General Data Protection Regulation (GDPR), you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to or restrict processing of your data
• Data portability
• Lodge a complaint with a supervisory authority (in Hungary: the NAIH, naih.hu)

To exercise any of these rights — including deleting your account — email contact@superglue.games. We respond within 30 days.

All traffic is encrypted (HTTPS). Session cookies are signed and inaccessible to scripts. Payment data is handled exclusively by Stripe, a PCI-DSS-compliant processor. Credentials used to operate game servers are stored encrypted. Access to customer data is limited to staff who need it.

Superglue Games is a service for teams and workplaces and is not directed at children. We do not knowingly collect personal data from anyone under 16.

When we update this policy we update the “Last updated” date at the top of this page. If a change meaningfully affects how we handle your data, we will notify account holders by email.

Questions about this policy or our data practices: contact@superglue.games