Privacy policy

Hookline is a daily music guessing game at hookline.live. This policy covers data we collect when you use the service. Hookline acts as the data controller for that data — your rights under EU law, and how to lodge a complaint with the Portuguese DPA, are summarised in the Your rights section below.

• Anonymous play. Without an account, your detailed game state and personal stats stay in your browser. We also record daily totals for visits and game outcomes, without linking those counters to an account.
• Account email. If you sign in, we store the email you used. You can also choose a display name and whether to appear on the public leaderboard. Public entries show that name and your game results, not your email.
• Sign-in emails. When you ask to sign in, we email you a one-time 6-digit code. Codes expire after 15 minutes. We store the code hash, request and expiry times, failed-attempt count, and whether the code was consumed or invalidated.
• A sign-in cookie. When you're signed in, a cookie and a server-side session record keep you signed in across visits for up to 30 days.
• Signed-in game data. Your daily play results and running stats (games played, score, streak) are saved on our servers so they follow you across devices. We also save which songs you have played in each pack.
• Practice usage. We track how much of the free practice quota you've used, so the limit is counted fairly.
• Purchases. If you buy a pack we record that you own it, along with payment-system customer and event references. Card details are processed by Stripe.

Email and session cookies exist solely to authenticate you and link your purchases. Practice-play records exist to enforce the free quota fairly. We don't profile you, sell your data, or run targeted advertising.

Under GDPR Art. 6, the lawful bases we rely on are:

• Contract — to deliver the sign-in service and pack purchases you've requested. This covers your email, the session cookie, and your ownership records.
• Legitimate interest — to enforce the free-tier practice quota fairly.

The sign-in cookie is strictly necessary for the service to function, so no consent prompt is required under ePrivacy.

• Stripe — payment processing for pack purchases. Your card details are entered on Stripe's hosted Checkout page; Stripe is the data controller for payment data.
• Resend — sending sign-in emails. Your email is shared with Resend only to deliver them.
• Vercel — our hosting provider. Their systems process requests and operational logs.
• Turso — hosts the database containing account, authentication, ownership, and game records.
• Sentry — when error monitoring is enabled, receives diagnostic errors and performance information to help us investigate failures.

Some of these processors operate outside the EU/EEA — Stripe and Resend run infrastructure in the United States. Transfers rely on Standard Contractual Clauses approved by the European Commission, which provide GDPR-equivalent safeguards.

Under GDPR you can request access, correction, export, or deletion of your data at any time. Hookline is built so you can exercise these rights yourself, from your account page:

• Access & export — download a JSON copy of your profile, pack access, practice usage, daily results, stats, pack progress, and sign-in metadata. Authentication secrets and hashes are excluded. The file does not include records held separately by payment or hosting providers.
• Delete — wipe your account (email, session, ownership records, game data). This action is irreversible. Anonymous totals are not linked to your account and remain. Deleting here does not delete records held separately by our providers or refund purchases.
• Correction — edit your display name and public leaderboard preference from your account. There is no email-change feature. A different email creates a separate account and does not transfer pack purchases.

If you believe Hookline has handled your data improperly, you have the right to lodge a complaint with the Portuguese data protection authority — CNPD (www.cnpd.pt).

Account data is kept while your account exists. Code expiry prevents sign-in; it does not automatically delete the sign-in request record. Account deletion removes matching sign-in requests and account records from the application database. Providers manage their own payment records, logs, and backups under their respective retention policies.

The hookline-session cookie keeps you signed in for up to 30 days. The hookline-counted and hookline-visited cookies contain a date and last up to 26 hours; they reduce repeat counting of daily results and visits. Browser storage also holds game state, pack-play history, volume, and onboarding preferences. Signing out or deleting your account clears player history in the current browser; volume and onboarding preferences remain.

If we change this policy in any material way we'll update the “Last updated” date and, where reasonable, highlight the change on the homepage.