Privacy Policy
Last updated: 3 May 2026
This policy explains what personal data Speedle collects, why, and what your rights are. Speedle is a small, free multiplayer word game. We collect only what we need to sign you in and keep your gameplay stats — nothing else, and we don't sell or share your data with anyone for marketing.
1. Who we are
Speedle ("the site", "we", "us") is operated by Tom Pedley as a personal project.
- Site:https://www.speedle.co.uk
- Contact for privacy questions:admin@speedle.co.uk
We are the data controller for the personal data described below.
2. What we collect and why
We only collect the minimum needed to run the site:
| Data | When | Why |
|---|---|---|
| Display name | When you enter one to start playing | So other players can see who's in your game. |
| Google account ID and email | When you sign in with Google | To link your stats to your account across devices. |
| In-game activity and stats | While you play | To show your stats, streaks, and word records. |
speedle.auth cookie | When you sign in | To keep you signed in (HttpOnly, Secure, expires after 30 days). |
| IP address and basic request data | Whenever you visit | Logged transiently by our hosting provider for security and reliability. |
| Anonymous usage analytics | Only if you accept analytics cookies | To understand how the site is used and improve it. |
We do not collect or process any special-category data (health, political views, etc.), and we don't profile you or use your data for automated decision-making.
3. Legal bases (UK GDPR)
| Purpose | Legal basis |
|---|---|
| Letting you play the game | Contract — you've asked us to provide the service. |
| Keeping you signed in | Contract — necessary to deliver the sign-in feature you used. |
| Recording your gameplay stats | Legitimate interests — providing the core stats feature. |
| Server logs / security | Legitimate interests — keeping the site secure and reliable. |
| Analytics | Consent — only if you've accepted analytics cookies. |
You can withdraw consent for analytics at any time from the cookie icon in the bottom-left of the page. Withdrawing consent does not affect any processing that happened before you withdrew it.
4. Cookies and similar storage
Speedle uses a small number of cookies and browser-storage entries:
Strictly necessary (always on):
speedle.auth— keeps you signed in. HttpOnly, Secure, 30-day sliding expiry.- Browser localStorage keys (
speedle.theme,speedle.botDifficulty,speedle.signInToastDismissed, etc.) — remember small preferences (theme, last-used bot difficulty, dismissed prompts). These never leave your browser.
Analytics (only with your consent):
- Google Analytics cookies (
_ga,_ga_*) — see Google's section below.
You can change your cookie preferences at any time using the cookie icon at the bottom-left of the page.
5. Who we share data with
We don't sell your data and we don't share it with anyone for marketing. The only third parties that necessarily process your data when you use Speedle are:
- Google — when you sign in with Google, Google handles the authentication. We receive your Google account ID, email, and (if you set one in Google) your profile name. See Google's Privacy Policy.
- Google Analytics — only if you accept analytics cookies, Google Analytics receives anonymous usage data (pages visited, rough device info). We've enabled IP anonymisation where Google supports it.
- Our hosting provider — processes server requests and stores the database. They do not have any independent right to use your data.
- jsDelivr (CDN) — serves the cookie consent banner script. They see the request your browser makes for the script (your IP and user-agent) but no Speedle data.
6. International transfers
Google operates from the United States. When you use Google Sign-in or Analytics, your data is transferred to the US. Google relies on the EU-US Data Privacy Framework and Standard Contractual Clauses for these transfers.
7. How long we keep data
- Sign-in account & linked stats — kept while your account exists. You can ask us to delete your account at any time (see Section 9) and we will delete your account, stats, and game history.
speedle.authcookie — up to 30 days from your last activity.- Server / security logs — retained for up to 30 days, then deleted automatically.
- Google Analytics data — retained according to the Google Analytics account configuration (currently: 14 months).
8. Where data is stored
- Account and stats data is stored in our database, hosted in France.
- Analytics data is held by Google.
9. Your rights
Under UK GDPR you have the right to:
- Access — ask for a copy of the personal data we hold about you.
- Rectification — ask us to correct anything that's wrong.
- Erasure — ask us to delete your account and associated data.
- Restriction — ask us to stop processing your data in certain cases.
- Portability — receive your data in a machine-readable format.
- Object — object to processing based on legitimate interests.
- Withdraw consent — for any processing based on consent (e.g. analytics).
To exercise any of these, email admin@speedle.co.uk. We aim to respond within 30 days.
10. Complaints
If you're not happy with how we've handled your data, you can complain to the UK Information Commissioner's Office:
- Website: https://ico.org.uk/make-a-complaint/
- Helpline: 0303 123 1113
You're welcome to come to us first — we'd rather resolve it directly.
11. Children
Speedle is not aimed at children under 13. If you believe a child has provided personal data to us, please contact us and we'll delete it.
12. Changes to this policy
If we materially change this policy, we'll update the "Last updated" date at the top and, where appropriate, surface the change in the app.