Privacy policy

Hookline is a daily music guessing game operated by an independent developer based in Portugal, EU. This policy covers data we collect when you play at hookline.live.

• Anonymous play. Without an account, your game state and stats stay in your browser. We never see them.
• Account email. If you sign in, we store the email you used.
• Sign-in links. When you ask to sign in, we email you a one-time link. Links expire after a short time.
• A sign-in cookie.When you're signed in, a small cookie keeps you signed in across visits.
• Practice plays.We record which past episodes you've played, so the free-tier limit is counted fairly.
• Purchases. If you buy a pack we record that you own it. Card details go straight to Stripe — we never see them.

Email and session cookies exist solely to authenticate you and link your purchases. Practice-play records exist to enforce the free quota fairly. We don't profile you, sell your data, or run targeted advertising.

• Stripe— payment processing for pack purchases. Your card details are entered on Stripe's hosted Checkout page; Stripe is the data controller for payment data.
• Resend — sending magic-link emails. Your email address is shared with Resend solely to deliver sign-in links.
• Deezer— audio previews are streamed from Deezer's public preview CDN. Your IP address is visible to Deezer when your browser fetches a preview.
• Vercel — hosting and edge delivery. Standard request logs (IP, user agent, path) are kept for short periods for operational purposes.

Under GDPR you can request access, correction, export, or deletion of your data at any time. Two of those are built in:

• Export — download a JSON copy of your data from your account page.
• Delete — wipe your account (email, entitlements, practice plays, sessions) from your account page. This action is immediate and irreversible.

For other requests, or if you can't reach the in-app controls, email hello@hookline.live.

Account data is kept while your account exists. Sign-in links expire within minutes. Stripe retains payment records on its own schedule (typically several years, as required by EU law). Hosting access logs are kept for a short period by our hosting provider.

We set one cookie when you sign in, to keep you signed in. We don't use third-party tracking cookies. We may add anonymous, cookieless analytics in the future, in which case this page will say so.

If we change this policy in any material way we'll update the “Last updated” date and, where reasonable, highlight the change on the homepage.