The fine print

Privacy Policy

Last updated: August 2026

Whodunly is a product by Vyomio ("Vyomio", "we", "us"), a small, independent studio based in Sydney, Australia. This policy explains what we collect, what we deliberately do not collect, and the choices you have. We have tried to write it in plain language a parent or a teenager can actually read. If anything here is unclear, please contact us (see Contact at the end).

Our philosophy

We built Whodunly to be a small daily pleasure, not a data business. Our approach is simple:

• You can play the whole daily game without an account and without giving us any personal information at all.
• We collect the least we can. If a feature does not need your data, we do not take it.
• We never sell your personal information, and we never use it to target you with behavioural advertising.
• We do not store your IP address or your precise location.

Everything below is really just the detail behind those four promises.

What we collect

If you play anonymously: nothing on our servers

If you just come and play, your progress, streak, statistics and settings are saved only on your own device, in your browser's local storage. They never leave your device and we never see them. There is no account, no server record, and no personal data collected from anonymous play. This mode is open to everyone, including children.

The trade-off is that anonymous progress lives on that one browser: it will not sync to another device, and clearing your browser data will clear it.

If you create an account

You can optionally create an account (to sync across devices, keep your history safely, turn on notifications, or subscribe). To do that we use a sign-in provider (Supabase Auth) with Google or a one-time email "magic link" — we never ask you to create or store a password. When you have an account, we store:

• Your email address (used to sign you in and to send you the emails described below).
• Your sign-in method (for example, that you signed in with Google).
• Your game data: the cases you have played, how many clues you used, your results, streaks, ratings, and preferences. Each result row is tiny (about 50 bytes).
• A country code only — for example "AU" — derived from your network at the moment of a request via Cloudflare's country header, so we can show things like country leaderboards. We do not store your IP address and we do not store any location more precise than the country.
• If you subscribe, a customer ID from our payment processor and whether your subscription is active. See Payments below.
• If you turn on notifications, the technical subscription details your browser gives us so we can send the push messages you asked for. This is entirely opt-in and you can turn it off any time.

What we do not collect

To be explicit, we do not:

• store your IP address or precise/GPS location;
• see, store, or handle your card or bank details (the payment processor does that — see below);
• ask for or store passwords;
• build advertising profiles about you or track you across other websites;
• use tracking or advertising cookies;
• run behavioural ad targeting on anyone — including, especially, children.

Payments

Paid features (the Sleuth Club subscription and one-time case packs) are handled by Stripe, our payment processor. When you pay, you enter your card details directly with Stripe on Stripe's secure checkout. We never see or store your full card number. We receive only what we need to give you access and support you: a Stripe customer reference, the plan you bought, and whether payment succeeded. Stripe processes your payment information under its own privacy policy.

The third parties who help us run Whodunly

We keep our supplier list short and choose privacy-respecting providers. Each one only receives the data it needs for its job:

• Supabase — accounts, sign-in, and our database (stores your email and game data). Supabase hosts this data on Amazon Web Services (AWS).
• Stripe — payment processing for subscriptions and case packs.
• Vercel and Cloudflare — hosting and content delivery so the game loads fast and stays up. Cloudflare also gives us the country-only signal described above.
• Resend — sending you transactional emails (like your magic-link sign-in and receipts).
• A marketing email tool (Loops) — only if you opt in to our newsletter.
• Sentry — error monitoring, so we can find and fix crashes. We aim to keep personal data out of error reports.
• Web Push — delivering the notifications you opted into, through your browser's push service.

Our daily mysteries are written offline with the help of an AI model. No player data is ever sent to that model — it only writes fictional cases.

Emails and notifications

There are two kinds of email, and they are treated very differently:

• Transactional emails go to everyone with an account because they are part of the service — for example your magic sign-in link, payment receipts, and renewal or payment-problem notices. You cannot unsubscribe from these while you have an active account, because they are how the service works.
• Marketing emails (like our weekly digest) are opt-in only. The box is unticked by default when you sign up — you only get them if you actively choose to. Every marketing email has a one-click unsubscribe link, and once you unsubscribe we stop.

Push notifications (such as a streak reminder) are always opt-in and are never requested on your first visit. You can turn them off in your settings or in your browser at any time.

Children's privacy

Whodunly is a cozy mystery game with mild themes, and children are welcome to play. We take their privacy seriously, so please read this section carefully.

Anyone, including a child of any age, can play the full daily game anonymously with no personal information collected — as described above, anonymous play keeps everything on the device and creates zero records on our servers. This is the mode we recommend for children.

Accounts have a minimum age of 13. You must be at least 13 years old (or older where your country requires it) to create an account or subscribe. Where local law sets a higher age for consenting to online services — for example up to 16 in parts of the EU and UK — that higher age applies. Younger children do not get accounts; they are welcome to play as guests, anonymously, with no personal data collected. Any payment must be made by an adult — a 13-to-17-year-old generally cannot enter into a subscription contract, so a parent or guardian must be the one who pays.

We do not knowingly allow anyone under 13 to create an account, and we do not knowingly collect personal information from anyone under 13. Because under-13s play only as anonymous guests, there is nothing for a child to hand over to enjoy the game. If we learn that someone under 13 has created an account, we delete that account and its data. This approach is why we do not need the verifiable-parental-consent machinery that the US Children's Online Privacy Protection Act (COPPA) requires for under-13s — we simply do not collect their data. It also reflects the "GDPR-K" children's provisions of the EU/UK GDPR (which set a digital-consent age between 13 and 16 depending on the country) and the Australian Privacy Act 1988 (Cth) and its Australian Privacy Principles.

Parents and guardians: if you believe your child under 13 has somehow created an account, contact us (see Contact) and we will delete it. For an account held by someone aged 13 or over, you can also ask us to review or delete the personal information it holds. Because we do not use passwords, the simplest path is usually to sign in to the account and use the in-app delete option, or to contact us and we will help. Deletion is a full hard-delete, completed within 30 days (see Your rights).

A note on content: the game is cozy-noir — think classic detective fiction. Any death happens off-page, and there is no gore. We consider it suitable for a general or family audience with mild mystery themes, and we suggest parental discretion for younger children.

If you believe a child under 13 has given us personal information, please contact us and we will delete it promptly.

Your rights

Whatever country you are in, we want you to be in control of your data. If you have an account you can:

• Access and export your data — ask us and we will provide a copy of the personal information we hold about you.
• Correct information that is wrong.
• Delete your account and data. When you delete your account, we perform a hard delete of your rows — your account, results, push subscriptions, and email records — within 30 days, cascading across our systems. (Deleted data may persist briefly in encrypted backups until those backups rotate out, after which it is gone.)
• Opt out of marketing at any time via the unsubscribe link, without affecting your account.

Depending on where you live (for example under the Australian Privacy Act 1988 (Cth) and its Australian Privacy Principles, the EU/UK GDPR, or similar laws) you may also have the right to object to or restrict certain processing, and to complain to your local data-protection authority. We are happy to help you exercise any of these rights — just contact us.

International transfers

We are based in Australia and use the trusted providers listed above, some of which operate servers in other countries. That means your data may be processed outside the country you live in. Where that happens, we rely on our providers' safeguards (such as standard contractual clauses) to keep your data protected to a comparable standard.

Data retention

• Anonymous play: nothing is stored on our servers, so there is nothing for us to retain.
• Account data: we keep your account and game history for as long as your account exists, because your streaks and stats depend on it. When you delete your account, we delete this data as described in Your rights.
• Backups: we keep encrypted, rotating backups for disaster recovery; deleted data ages out of these on the backup rotation schedule.

Changes to this policy

If we change this policy we will update the "Last updated" date above, and for significant changes we will give you clear notice (for example, in-app or by email). Continuing to use Whodunly after a change means you accept the updated policy.

Contact

Questions, requests, or privacy concerns? Contact us at support@whodunly.com. Whodunly is operated by Vyomio, based in Sydney, New South Wales, Australia.