Privacy Policy

What we collect

Account: your email address, used to sign you in with one-time codes.

Your content: projects, plans you paste or upload, guesses, results, notes and what you changed, and the history of edits.

Teams: the teams you belong to, your role, and invitations (including the email address of anyone you invite).

Technical: a session token that keeps you signed in, your language choice, whether a change came from the web or the app, and basic server logs (such as IP address and time of request) kept by our hosting providers for security and troubleshooting.

Referrals: if you arrive through a share link, the referral code, so we can credit the person who shared it.

Voice input on mobile is turned into text by your phone's own speech recognition (Apple or Google). We receive only the resulting text you choose to save.

Cookies

We use only cookies needed for the service: gb_session (keeps you signed in), gb_lang (your language), gb_ref (a referral code, 30 days) and gb_shell (a small display hint so pages appear without flicker). No analytics or advertising cookies.

How we use it

To provide the service: store your content, show it to you and your teammates, send sign-in codes and team invitations, keep accounts secure, and answer support requests.

For users in the EU, UK and similar regions, our legal bases are performing our contract with you and our legitimate interest in running a secure, working service.

AI features

Some features can suggest guesses from a plan. They run only when you ask. The plan text is then sent to our AI provider to generate suggestions, and nothing is added to your project until you choose. Our provider is not permitted to use your content to train its models. If AI features are not available in your version, nothing is sent.

Who can see your content

Members of a team can see and edit that team's projects. The team owner can invite and remove members.

Service providers that process data for us under contract: our database host, our email provider (Zoho), our cloud hosting provider, our AI provider when you use AI features, and, once paid plans launch, payment processors (Apple, Google or Stripe). They may only use the data to provide their service to us.

Authorities, when the law requires it.

Where data is processed

Our providers may store and process data outside your country, including in Hong Kong, the United States and the European Union. We rely on contractual safeguards for these transfers.

How long we keep it

Your content is kept while your account exists. Projects you delete stay in the trash for 30 days, then are deleted for good.

When you delete your account, your account and sessions are deleted at once. Teams you own pass to another member, or are deleted with their projects if you were the only member. Copies in backups are overwritten within a limited period.

Your rights

You can see and correct your content in the app, export a project as Markdown, and delete your account from the account menu (web) or Settings (app).

You can also ask us for a copy of your personal data, to correct or delete it, or to object to how we use it, by writing to support@guessbook.net. We answer within 30 days. Under Hong Kong's Personal Data (Privacy) Ordinance you may make data access and correction requests; if you are in the EU or UK you also have rights under the GDPR, including complaining to your local data protection authority.

Children

Guessbook is for work teams and isn't directed at children under 16. We don't knowingly collect their data.

Security

Sign-in codes and session tokens are stored only as hashes, connections are encrypted, and access to your data is checked on every request. No system is perfectly secure; tell us at once if you suspect a problem.

Changes and contact

We'll post changes here and, for significant ones, tell you in the app or by email. Questions: support@guessbook.net, PHOTRA LIMITED, Hong Kong.