The plain-language version is the only version. We collect as little as we can, we don't sell or rent your data, and we never use it to advertise to you.
The Elephant is operated by Bonjour Hat LLC, the data controller for the information described below.
What we collect
Your email address, a hashed password (we never store the real one), your handle and optional display name, your plays and guesses, your comments, and brief server logs (IP address, browser) kept a short while for security and rate-limiting. Anonymous players get a random cookie so their one free game works; it identifies a browser, not a person.
What we do with it
Run the game: your record, your streaks, the leader board, and the discussion. Aggregate puzzle stats (completion rates, popular wrong answers) are computed across all players and never identify you.
Only account verification, password resets, and material changes to the terms. No newsletters, no marketing. Signing in requires a verified email. Every email has an unsubscribe link; unsubscribing stops everything except letters you request yourself — sign-in verification and password resets.
Measurement
We count visits with a self-hosted, cookieless analytics tool (umami) running on our own server. It records pages viewed, the referring site, browser type, and country — never your identity. It sets no cookies, builds no profiles, and shares nothing with anyone.
What we don't do
No selling, renting, or sharing of your data. No ads, no third-party trackers, no third-party cookies — just the strictly-necessary session and CSRF cookies, which need no consent banner.
Third parties
Hetzner hosts the server; Resend delivers account email; Stripe processes payments if you buy a membership (we never see your full card details). That's the list.
Security
Passwords are hashed, traffic is TLS-encrypted, and the database is backed up nightly on a short cycle.
Retention & deletion
We keep your data while your account exists. Email us to delete your account — that removes your email, password hash, plays, and comments.
Your rights (GDPR)
Legal basis: performance of contract (Art. 6(1)(b)) for account data; legitimate interest (Art. 6(1)(f)) for short-lived security logs. No profiling, no automated decisions. You can access, correct, export, or delete your data, restrict or object to processing, and complain to a supervisory authority. We answer within 30 days.
Age
The Elephant is not intended for children under 16.
Changes
If this policy changes, the date above changes with it; material changes get an email.
Contact
