GIOTTO

WHO WE ARE

The controller for GIOTTO is Michael McEwan, United Kingdom. Service: giotto-game.com. Contact: hello@giotto-game.com. A data protection officer has not been appointed; use the same contact for privacy requests.

PLAYING WITHOUT AN ACCOUNT

Anyone may play GIOTTO without creating an account. Guest gameplay state is stored only on your device (browser local storage) for the challenge lifecycle. It is not registered GIOTTO history and is not uploaded as account history.

ACCOUNTS (16+)

Account registration is for people aged 16 or over only. Creating an account requires an email address, password, first name, surname, a chosen display name, and your confirmation that you are 16 or over. If you do not provide those, you cannot register, but you can still play as a guest.

First name and surname are private account details. Your display name is the public identity used if you later choose to appear on The 100% Club Honour Roll. We do not publish your first name, surname or email on the Honour Roll.

When you register or sign in, we process account credentials and session data so you can use a registered GIOTTO account. When you complete a challenge while signed in, we store registered challenge history (including challenge identifiers, scores, attempts used, and related result data needed for history and streaks) so that history can follow your account.

Registered history only counts when you are authenticated at completion. Completing as a guest does not later become registered history if you sign up or log in afterwards.

Lawful basis (UK GDPR): contract — to provide the registered GIOTTO service you request. Retention: while the account exists. At launch, deletion requests go to hello@giotto-game.com.

THE 100% CLUB AND HONOUR ROLL

A genuine 100% on a registered, account-bound challenge makes you eligible for The 100% Club. Eligibility alone does not publish your identity.

Appearing on the public Honour Roll requires your explicit opt-in. If you opt in, GIOTTO publishes only your display name, the date of the result, and the challenge name. First name, surname, email, user identifiers and private scores are not published on the Honour Roll.

You may hide a public Honour Roll entry later. Hiding an entry does not delete your private gameplay result or account history. Guest completions are not eligible for Honour Roll publication.

Lawful basis (UK GDPR): consent for optional public Honour Roll publication. You may withdraw that publication consent by hiding the entry (or by requesting account deletion).

NECESSARY LOCAL STORAGE AND COOKIES

GIOTTO uses first-party browser storage that is necessary for the game and accounts to work:

• Local storage keys under giotto:yearone:v1: — current challenge attempt state on your device (necessary gameplay).
• First-party cookies named like sb-…-auth-token (and related PKCE / chunk cookies used by Supabase Auth) — signed-in session (necessary authentication).
• Local storage key giotto:analytics:consent:v1 — your optional Google Analytics preference (preference).
• Local storage key giotto:audience:measurement:v1 — your Vercel audience-measurement preference (preference; default on, opt-out available).

Necessary gameplay and account technologies work whether or not you allow optional Google Analytics or audience measurement.

AUDIENCE MEASUREMENT (VERCEL WEB ANALYTICS)

GIOTTO uses Vercel Web Analytics for aggregate statistical measurement of how the site is used, including by guest players. This covers visits, pages and routes, referrers, and general device, browser and location dimensions supplied by Vercel's standard product. It does not create registered GIOTTO account history and is not used to recognise a GIOTTO player across days.

According to Vercel's current documentation, Web Analytics does not use conventional analytics cookies for visitor identification. Visitors are distinguished using a hash derived from the incoming request; that visitor identifier resets after 24 hours. GIOTTO does not claim that a Vercel visitor equals a unique human being, that Vercel never processes personal data, or that measurement cannot be blocked by browser tools.

GIOTTO uses this measurement only for aggregate audience and service-improvement statistics. It is not used for advertising, behavioural profiling, cross-site tracking, or linking guest activity to a GIOTTO account. GIOTTO does not send account identifiers, email, names, challenge scores, attempts, or gameplay metrics to Vercel Web Analytics.

PECR: GIOTTO relies on the statistical-purposes exception for this narrowly configured aggregate audience measurement, with transparency and a free objection mechanism. You can opt out at any time using Audience measurement in Privacy Preferences below (available to guests and signed-in players). UK GDPR: legitimate interests in understanding aggregate use of GIOTTO in order to improve the service, balanced against your rights; you may object as described above. This notice is not a substitute for a controller DPIA record.

OPTIONAL GOOGLE ANALYTICS

GIOTTO does not use Google Analytics for guest players. Optional Google Analytics 4 (GA4) is available only for signed-in registered players who choose to permit it. Lawful basis: consent. Signed-in players can accept or reject analytics, and withdraw consent later via the preferences on this page (when signed in) or the PRIVACY entry in the menu. Analytics are never required for gameplay. Rejecting or withdrawing Google Analytics does not change your Vercel audience-measurement preference, and does not remove access to play, accounts, scores, or history.

If you are signed in and accept, GA4 may set first-party cookies such as _ga and _ga_<measurement-id> (analytics). Session storage keys under giotto:analytics:once:v1: are used only to avoid duplicate event sends. If you reject, or while you play as a guest, GIOTTO does not load GA measurement and does not send optional analytics events.

Events we send when a signed-in player has consented are limited to product measurement such as play started, challenge completed, and login/signup success signals, with parameters such as challenge and family identifiers, calendar day, guest/registered player state, attempts used, and score. We do not send email, name, account or user IDs, passwords, form contents, raw gesture coordinates, or raw result metrics to analytics. This version of GIOTTO does not introduce advertising analytics, Google Ads, AdSense, remarketing, or GA User-ID.

GA4 user/event data retention is set to 14 months for this property.

WHO PROCESSES DATA FOR US

We use the following providers by function:

• Supabase — authentication and registered history storage.
• Vercel — hosting and delivery of the GIOTTO website, and aggregate audience measurement via Vercel Web Analytics when you have not opted out.
• Google Analytics — optional behavioural measurement for signed-in players who consent.

INTERNATIONAL PROCESSING

Personal data processed through these providers may be processed outside the United Kingdom, including in the United States and in other countries where the provider or its subprocessors operate. This notice does not claim that GIOTTO data is stored only in the UK, EU, or any other single region.

According to each provider's current published terms: Vercel states that its primary processing facilities are in the United States and that transfers may rely on mechanisms such as the UK International Data Transfer Addendum with EU Standard Contractual Clauses, and (where applicable) Data Privacy Framework certification; Supabase provides a Data Processing Addendum that incorporates Standard Contractual Clauses and a UK Addendum for relevant transfers; Google's measurement / data-processing terms provide for international processing with frameworks such as the Data Privacy Framework and/or Standard Contractual Clauses where required. Copies of applicable safeguards may be requested via hello@giotto-game.com.

YOUR RIGHTS

Depending on the lawful basis and your circumstances, you may have rights under UK GDPR including access, rectification, erasure, restriction, and data portability. For aggregate audience measurement, you may object free of charge using Audience measurement in Privacy Preferences below (available without signing in). For optional Google Analytics processing based on consent, signed-in players may withdraw consent at any time using the Google Analytics preferences below (or the PRIVACY menu entry when signed in); withdrawal is as easy as giving consent and does not affect the lawfulness of processing before withdrawal.

You may lodge a complaint with the UK Information Commissioner's Office (ICO): ico.org.uk.

GIOTTO does not use solely automated decision-making, including profiling, that produces legal or similarly significant effects about you.