Privacy Policy
Version of 8 November 2026. This is an English translation for convenience. The Russian version is the governing text; if the two differ, the Russian version prevails.
1. Who is responsible for your data
Oksana Aleksandrovna Ivanova, a self-employed person registered in the Russian Federation (taxpayer ID / INN 773182181654), acts as the data operator (controller). Contact for any privacy request: hello@notthat.pro.
2. What we collect and why
| Data | Purpose | Legal basis |
|---|---|---|
| A random identifier in a cookie, game progress, daily streaks | Keep your progress without registration | Performance of the user agreement |
| Login, password hash, recovery-key hash | Sign-in and account recovery | Performance of the contract |
| Nickname (a random one is given automatically) | Shown in your profile and, only if you choose, in the public table | Contract; publication in the table only with your separate consent |
| Texts of notes and reports about them | Moderation and display on the shared sign | Contract |
| Messages sent through “Report a problem” and the contact you leave, if any | Fix the problem and reply to you | Your request and the consent given by sending it |
| Order data: what was bought, amount, status, time | Delivering purchases, refunds, tax records | Contract and legal obligation |
| Browser error reports: the error text, where in the code it happened, the page, browser name and version | Finding and fixing failures on players’ devices | Legitimate interest of the operator |
| A salted hash of your IP address (the IP itself is not stored) | Protection against password guessing and bots | Legitimate interest of the operator |
| Yandex Advertising Network data: cookies and anonymised device data when you watch an ad for a hint | Showing the ad you asked for and confirming it was watched | Consent: the ad loads only after you press “Hint for an ad” |
| Yandex Metrica data: anonymised information about visits, device and in-game actions | Statistics and improving the game | Consent, which you can withdraw at any time |
Your real name, phone number or e-mail are not needed to play. The e-mail or phone for a receipt is entered on the payment provider’s page; the site does not receive it.
3. Who receives data
- Robokassa — to process payments.
- The Russian Federal Tax Service via the “My Tax” app — income information for the receipt (none of your game data).
- Yandex LLC — Yandex Metrica data if you allowed analytics, and Yandex Advertising Network data when you start an ad for a hint yourself.
- Timeweb Cloud — hosting; data is stored on a server in Moscow.
We do not share data with anyone else except where required by law. We do not sell data.
4. Where and how long data is kept
All data is stored on a server in Russia. If you play from outside Russia (for example, from the European Union), your data is processed in Russia, which may offer a different level of data protection than your country. We collect as little as possible to keep this risk small: you can play without an account, without real name and without e-mail.
- A guest who never started a room — deleted after one day.
- A guest profile without an account — deleted after 180 days without visits.
- An account — until you delete it or ask us to. A sign-in session lasts 30 days.
- Notes and reports — up to 30 days.
- Feedback messages — up to 180 days.
- Browser error reports — up to 30 days.
- Order data — 5 years for tax records and disputes.
- Backups — up to 30 days.
5. Public table
Your nickname and results appear in the public table only if you switch this on in your profile. We publish the nickname, the number of rooms solved, the streak and the solving time. You can switch it off at any time in your profile, and your entry disappears from the table.
Table rules: three oddities, five guesses. Only the first successful attempt without hints counts for the speed ranking; time runs from “Start searching” with no pause. A streak grows when you solve the room of the day on consecutive game days (noon to noon, Moscow time). There are no cash prizes.
7. Your rights
In your profile you can download your data and delete your profile. You can also write to the e-mail in section 1 to ask what data we hold, to correct or delete it, to restrict or object to processing, to receive your data in a portable format, or to withdraw consent. We reply within 10 working days. Order records that the law requires us to keep are retained until that period ends, even after your profile is deleted.
If you live in the European Union or the United Kingdom, you may also lodge a complaint with your local data protection authority. We would appreciate the chance to resolve your concern first — just write to us.
8. Security
The connection is encrypted (HTTPS). Passwords and keys are stored only as hashes. Access to the server and the admin area is restricted. Request limits protect against guessing. Backups are kept. In case of a data incident, the operator notifies the Russian data protection authority (Roskomnadzor) within the time limits set by law.
9. Children
The game is rated 12+. Purchases may be made by adults, or by minors with the consent of their parents or legal guardians.
10. Changes
A new version is published on this page with its date. Your consents to analytics and to the public table do not change without your action.