Privacy Policy
Version 1.0 · Last updated 8 August 2026
Araknet Labs Limited, a company incorporated in Kenya, of 13 Jacaranda Avenue, Lavington, Nairobi, is the data controller for personal data processed through GuessOff. We handle your data in accordance with the Kenya Data Protection Act, 2019.
1. What we collect
- Account — your email address, and if you sign in with Google, the account identifier Google returns.
- Profile — your handle, rating, and match record.
- Gameplay — every move in every match, with its timestamp. This is how the engine stays auditable and how we investigate disputes.
- Payments — your mobile-money number and the transaction records required to move money and to satisfy Kenyan record-keeping law.
- Identity — where we need to verify a payout, documents confirming who you are and that the number is yours.
- Technical — device, IP address and connection information needed to deliver the game and detect abuse.
- Responsible-play settings — deposit limits and any self-exclusion you set, which we must keep in order to enforce them.
2. Why we process it, and on what basis
Under the Data Protection Act 2019 we rely on the following:
- Performance of a contract — running your account, matching you with opponents, settling matches, and moving money in and out.
- Legal obligation — financial and tax record-keeping, and responding to lawful requests.
- Legitimate interests — keeping the game fair and secure: detecting automated play, collusion and multiple accounts, and enforcing self-exclusion. We think a player has a strong interest in these too, since each of them protects the value of their own matches.
- Consent — where we ask for it specifically, which you may withdraw at any time.
3. What we deliberately do not do
- We do not show your real name to other players. We assign you a random handle precisely so that signing in with Google does not publish your name.
- We do not sell your personal data.
- We do not use your data for advertising profiles.
4. Who sees what
Your handle, rating, league and match record are public — they appear on leaderboards and to opponents. Your email address, balance, payment details and secret words are not, and are never included in the data streamed to another player's device.
5. Who we share with
- Google Firebase — authentication and database infrastructure.
- Vercel — application hosting, plus privacy-friendly audience and performance measurement (see section 8).
- Paystack — payment processing for M-PESA deposits and payouts. Paystack handles your payment credentials directly; we never see or store a card number or M-PESA PIN.
- Regulators, tax authorities and law enforcement — where we are legally required to.
6. Transfers outside Kenya
Firebase and Vercel operate infrastructure outside Kenya, so running GuessOff involves transferring personal data abroad. We use established providers with recognised security standards and contractual data-protection terms, as the Act requires for cross-border transfers.
7. How long we keep it
| Data | Retained for |
|---|---|
| Financial and transaction records | 7 years (tax and audit) |
| Match and move history | 7 years (audit trail, dispute resolution) |
| Account and profile | While your account is open, then anonymised on closure |
| Identity-verification documents | 7 years from the payout they relate to |
| Self-exclusion records | Kept after closure, so an exclusion cannot be escaped by re-registering |
| Technical and abuse-detection logs | 12 months |
On account closure we anonymise your profile and gameplay records and delete your contact details, keeping only what the law requires. Past matches remain visible to the opponents who played them, without your name attached.
8. Cookies, local storage and analytics
We do not use advertising or tracking cookies, and we do not sell your data or share it with advertisers. GuessOff stores data on your device for the app to work at all: your signed-in session, your settings (sound, haptics, reduced motion), and a cached copy of the word list so practice works offline. Clearing your browser's site data removes all of it and signs you out.
To understand which parts of GuessOff people actually use, we measure page views using Vercel Web Analytics. It sets no cookies and stores nothing on your device. It records the page visited, the site you arrived from, and coarse technical details — country, device type, operating system and browser — and counts returning visits using a value that is rebuilt daily and cannot be used to identify you, follow you across other websites, or link back to your GuessOff account. We use this on the lawful basis of our legitimate interest in knowing whether the product works.
We also measure how quickly pages load and respond, using Vercel Speed Insights. This records timing measurements from a sample of visits — how long a page took to become visible and usable, and how smoothly it responded — together with the page, country, device type and connection type. It sets no cookies, and the measurements are about the page rather than about you. Because a duel is decided on a 30-second clock, a slow screen costs a real player a real match, which is why we measure this at all.
9. Your rights
Under the Data Protection Act 2019 you may request access to your personal data, ask us to correct it, ask us to delete it (subject to the retention obligations above), object to or restrict processing, and ask for a copy in a portable form. Write to privacy@guessoff.com and we will respond within 30 days.
You also have the right to complain to the Office of the Data Protection Commissioner — info@odpc.go.ke, www.odpc.go.ke.
10. Children
GuessOff is for adults. You must be 18 or older to hold an account and we ask you to confirm it before you can play. We do not knowingly collect data from anyone under 18; if we learn that we have, we close the account, refund the balance, and delete the data.
11. Security
Secret words are stored where no client can read them, and every write to a balance goes through our servers rather than from a player's device. No system is perfectly secure, but the architecture is built so that a compromised client cannot read another player's word, alter a result, or change a balance.
12. Changes
We may update this policy. Material changes will be notified in the app before they take effect.
13. Contact
Araknet Labs Limited, 13 Jacaranda Avenue, Lavington, Nairobi, Kenya — data controller.
Privacy and data-protection requests: privacy@guessoff.com