Privacy Policy

Last updated: 14 November 2026

Guezzer is a set of party games you play with friends in your browser at play.guezzer.com and in our iPhone and Android apps. This policy explains what personal data Guezzer uses, why, who else sees it, how long we keep it and what your rights are. It covers this website, the web game and the apps.

1. Who we are

Guezzer is run by Nexisia. Nexisia is the data controller for the personal data described in this policy (the “veri sorumlusu” under Turkish law).

2. What we collect

You can play without telling us your real name or email address. Depending on how you use Guezzer, we process:

• A device identifier. A random identifier created on your device or in your browser the first time you play, so we can recognise your guest account. It is generated at random and doesn't tell us who you are.
• Your profile. The display name you pick (or the random one we suggest) and your avatar colour. Other players in your room see both. We also remember your language setting.
• Sign-in details, only if you choose to sign in. With email sign-in, your email address; the one-time codes we send you are stored only in hashed form. With Google sign-in, the account identifier and email address that Google shares with us. With Sign in with Apple, the account identifier Apple shares with us and, if you choose to share it, your email address or Apple's private relay address. We never see your Google or Apple password.
• Games and results. Which games you played and when, the room language, the number of players, and your score and rank.
• Content and player reports. If you report a question or item, the report (the item, your reason and any note you add) and your account ID. If you report a player, the reason, the room code, that player's display name at the time and both of your account IDs. The list of players you block stays on your device only.
• Messages you send us. If you use the contact form on our About page: your email address, your name if you give it, the subject and your message, the page you sent it from, your browser details (user agent) and the country of your IP address. If you send feedback from the game or the app: your message, its topic, the game it is about, your email address if you add it, your account ID, your platform, browser or app build, and your country. We use these only to read and answer your message and to improve Guezzer. A copy reaches our own mailbox through our email provider.
• What you type and draw in games. Clues, guesses, in-game chat messages, custom questions and answers, drawings and song searches. They are shown only to the players in your room, used only to run that game and never published. Rooms are held in our server's memory and discarded when they close. Four games also send text to an AI provider: in Outwit the AI, the clues you write, so the AI opponent can make its move; in Off the List, the answers your team writes, so the AI can judge them; in Name Place Animal, the answers you write, so the AI referee can check them; in Hot & Cold, a guessed word that isn't in the game's own word list, so the AI can judge it (see Who we share it with).
• Usage statistics and crash reports, only if you allow them. Pages you view on this website, screens you open and events such as creating or joining a room and starting or finishing a game (the game, the number of players and your rank), your device and browser type, your approximate country and a random analytics identifier. If the app crashes, technical details about the crash (the error, device model and operating system version). If you are signed in we add your pseudonymous account ID; we never send your name or email address.
• A notification token, only if you allow notifications in the app. A token for your device and your language, so we can send you announcements.
• Your email preferences, only if you have an email address with us. Whether you asked for our game news emails, and when and where you did (at sign-in, in your profile or by unsubscribing), whether you bought the Pass after seeing that we email Pass holders, and, for each announcement email we send you, whether it was delivered, bounced or marked as spam.
• Purchases, only if you buy the Guezzer Pass. Which Pass you bought, when it started and when it ends, whether it renews, where you bought it (on the web, in the App Store or on Google Play) and the reference numbers the seller gives us, such as a Stripe customer or subscription ID. We never see your card or bank details: the seller handles the payment.
• Advertising data, in the apps only. Google AdMob, which shows the ads in our apps, collects your device's advertising ID (IDFA on iPhone, only if you allow tracking; the advertising ID on Android), the ads you see and tap, and your approximate location, worked out from your IP address. See Ads in the apps.
• Technical logs. When your device connects to our servers, they record your IP address, your browser or app details (user agent), the time and what was requested. We use these logs to keep Guezzer secure and running and to fix problems. To show Pass prices in your currency, our server also looks up the country of your IP address in a database we keep on that server (IP geolocation by DB-IP); we keep only the country, for the activity statistics in the next point.
• Activity statistics on our own servers. To see how Guezzer is used and improve the games, our servers record, linked to your account ID: the country your IP address belongs to at each visit (we keep only the country, never the IP address itself); your platform (web, iOS or Android), browser, operating system and device type, read from your user agent; the app's build number, if you play in the app; one activity record for each day you play; and events such as creating a room, starting, finishing or abandoning a game, voting for the next game, rematches, opening the Guezzer Pass screen, starting a checkout, and purchases and refunds. This data stays on our servers, only our team sees it, in our internal admin panel, and it is never sold or shared with third parties. It involves no cookies and no third-party tools.

We don't ask for your real name, age, precise location, contacts or photos, and we never receive your payment card details.

Where it comes from. You give us most of this directly: your name, your email address and what you type. Your device creates the identifier, and logs and activity statistics are generated automatically when you use Guezzer. If you sign in with Google or Apple, that company sends us your account details. Usage statistics and crash reports, if you allowed them, are generated automatically while you use Guezzer. Advertising data is collected by Google's AdMob software in the apps.

3. Why we use it

We use personal data only for the purposes below. For each one we give our legal basis under the UK GDPR and the EU GDPR (Article 6) and, for users in Türkiye, under the Turkish Personal Data Protection Law No. 6698, known as KVKK (Article 5).

• Running the games: creating your account, putting you in rooms, showing your name to other players, keeping score, saving results and signing you in. Performing our contract with you, meaning our Terms of Use (GDPR 6(1)(b); KVKK 5(2)(c)).
• Sending sign-in codes by email. Performing our contract with you (GDPR 6(1)(b); KVKK 5(2)(c)).
• Sending game news emails about new and updated games, only to people who asked for them or bought the Pass. Your consent, if you ticked “Keep me posted” at sign-in or in your profile (GDPR 6(1)(a); KVKK 5(1)). If you bought the Pass and didn’t refuse these emails when you bought it, our legitimate interest in telling our customers about our similar services, as the UK’s Privacy and Electronic Communications Regulations (PECR) allow (GDPR 6(1)(f); KVKK 5(2)(f)). Every email has a one-click unsubscribe link, and you can switch them off in your profile at any time.
• Sending service emails about your account or your Pass, for example when a game included in the Pass is about to be removed. They never contain advertising. Performing our contract with you (GDPR 6(1)(b); KVKK 5(2)(c)).
• Keeping Guezzer safe and working: preventing abuse, cheating and spam, investigating problems, fixing bugs and reviewing content reports. Our legitimate interest in running a secure and fair service (GDPR 6(1)(f); KVKK 5(2)(f)).
• Understanding how Guezzer is used and improving the games, for example how many games are played and finished, which games people enjoy, which countries and devices they play from and how the Guezzer Pass is doing, using the activity statistics and anonymised results on our own servers. Our legitimate interest in improving Guezzer (GDPR 6(1)(f); KVKK 5(2)(f)).
• Usage statistics and crash reports (Google Analytics through Google Tag Manager, Firebase Crashlytics): seeing how people find this website, which games they enjoy and where the app crashes. Your consent (GDPR 6(1)(a); KVKK 5(1)). We ask on your first visit to guezzer.com or the first time you play, and one answer covers both; if you say no, no analytics cookies are set and these tools collect nothing. In the apps, the same answer also covers personalised ads. You can withdraw consent at any time with “Cookie settings” in the footer of this website or in your profile in the game.
• Showing ads in the apps to keep Guezzer free to play (non-personalised ads). Our legitimate interest in funding a free service (GDPR 6(1)(f); KVKK 5(2)(f)). Where the law requires consent to store or read information on your device, as in the European Economic Area and the UK, Google's consent form asks for it.
• Personalised ads in the apps. Your consent (GDPR 6(1)(a); KVKK 5(1)), given with the same switch as usage statistics, on iPhone also through Apple's tracking prompt, and in the European Economic Area and the UK also through Google's consent form. You can withdraw it at any time in your profile.
• Sending announcement notifications (apps only). Your consent (GDPR 6(1)(a); KVKK 5(1)), given through your phone's notification permission, which you can turn off in its settings.
• Answering your messages and requests, including privacy requests. Our legal obligation where the law requires an answer, otherwise our legitimate interest in helping you (GDPR 6(1)(c) and (f); KVKK 5(2)(ç) and (f)).
• Selling and providing the Guezzer Pass: checking whether your Pass is active, showing prices in your currency, and handling cancellations, refunds and questions about a purchase. Performing our contract with you (GDPR 6(1)(b); KVKK 5(2)(c)).
• Keeping purchase records as tax and accounting law requires. Our legal obligations (GDPR 6(1)(c); KVKK 5(2)(ç)).
• Complying with the law and handling legal claims. Our legal obligations, and establishing, exercising or defending legal claims (GDPR 6(1)(c) and (f); KVKK 5(2)(ç) and (e)).

Apart from the ads in our apps (see Ads in the apps) and our own game news emails, which you get only if you asked for them or bought the Pass, we don't use your data for advertising. We don't sell it, and we don't make decisions about you based solely on automated processing that have legal or similarly significant effects. Where we rely on legitimate interests, you can object at any time (see Your rights).

4. Who we share it with

We never sell your personal data. We share it only with:

• Other players in your room, who see your display name, avatar colour, scores and what you type or draw during the game.
• Our hosting provider, whose servers run Guezzer and store its database on our behalf.
• Our email delivery provider, Resend, which sends sign-in codes and, if you get them, our game news and service emails. It receives your email address and the content of each email, and tells us whether it was delivered, bounced or marked as spam.
• Our AI provider. In Outwit the AI, Off the List, Name Place Animal and Hot & Cold, the AI's part of the game comes from a language model reached through OpenRouter: the AI opponent's guesses in Outwit the AI, in Off the List the sealed list of obvious answers and the ruling on each team's answers, in Name Place Animal the ruling on each answer (whether it fits its category), and in Hot & Cold the ruling on an unusual guess (whether it is a real word and how close it is to the secret word). The model only receives the text needed to run the game: in Outwit the AI, the clues written in that game and the game's own word board; in Off the List, the answers written in that game and the game's own category; in Name Place Animal, the answers written in that round with the round's letter and categories; in Hot & Cold, only that one guessed word, and only when it isn't in the game's own word list. Your name, account identifier and other room details (including team chat and who wrote which answer) are never sent. We only use providers that neither store this text nor train models on it, and we discard it ourselves when the room closes. If you don't play these games, none of your text goes to an AI provider.
• Google, if you use Google sign-in. Google handles the sign-in under its own privacy policy and tells us your account identifier and email address. Both guezzer.com and play.guezzer.com load Google Tag Manager, which only loads Google tags that respect your consent choice. If you allow them, we also use Google Analytics and Firebase Crashlytics for usage statistics and crash reports, and Firebase Cloud Messaging for app notifications; Google processes this data on our behalf, and we keep Google Analytics data sharing for advertising switched off. In the apps, Google AdMob shows ads (see Ads in the apps).
• Link (Stripe), if you buy the Pass on the web. Link, a service of Stripe, sells the Pass to you as the merchant of record: it takes the payment, charges any tax and sends your receipts. It receives your Guezzer account ID and, if you signed in with email, Google or Apple, your email address, so the purchase is linked to your account. You give your payment details to Link directly, and it handles them under its own privacy policy (link.com/privacy). Link tells us whether your payment and subscription are active.
• Apple, Google and RevenueCat, if you buy the Pass in our apps. The App Store or Google Play takes the payment under its own terms. RevenueCat, the provider that manages in-app purchases for us, receives your Guezzer account ID and the store's records of your purchase, and tells us whether your Pass is active.
• Apple, if you use Sign in with Apple, which Apple handles under its own privacy policy, and for notifications to iPhones, which are delivered through Apple's push notification service (APNs). Also in Song Battles. Your song searches go to Apple's iTunes search service, and music previews stream straight from Apple's servers, so Apple can see your IP address.
• Third-party content networks. Some images and previews, such as artist pictures from Spotify or product photos from retailers like Trendyol, Hepsiburada and Amazon, load directly from those companies' content delivery networks (CDNs). Like any server your browser loads content from, they can see your IP address and browser details.
• Cloudflare, for the contact form on this website. Cloudflare Turnstile checks that the form is sent by a person and not a bot. It runs only on that page and receives your IP address and browser details, which Cloudflare handles under its own privacy policy (cloudflare.com/privacypolicy).
• Authorities, when the law requires it, or when it is needed to protect our users, Guezzer or others.
• A new owner, if Guezzer or Nexisia is ever sold or merged. They would have to keep to this policy.

Our hosting, email and AI providers, RevenueCat, and Google's analytics, crash reporting and messaging services, process the data only on our instructions and only to provide their service to us. For the ads in our apps, Google acts as an independent controller under its own privacy policy.

5. Ads in the apps

The Guezzer apps for iPhone and Android show ads from Google AdMob, which help keep Guezzer free. This website and the web game at play.guezzer.com show no ads.

• Where ads appear. A banner in the lobby and on the results screen, and now and then a full-screen ad after a game ends. Never during a game, and never in rooms whose host has the Guezzer Pass.
• What Google receives. To choose and show ads, measure them and prevent fraud, the AdMob software in the app sends Google your device's advertising ID (IDFA on iPhone, the advertising ID on Android), information about the ads you see and tap, your device and app details, and your IP address, from which Google works out your approximate location. We never give Google your name, email address, account ID or anything you type or draw in games.
• Personalised ads, only if you agree. The first time you open the app, we ask whether you agree to usage statistics and ads that suit you; one switch covers both. On iPhone, if you agree, Apple's App Tracking Transparency prompt then asks whether the app may track you, and Google gets the IDFA only if you allow it. In the European Economic Area and the United Kingdom, Google's consent form (Google User Messaging Platform, using the IAB Transparency & Consent Framework) also asks for your choices about ads and the ad partners Google works with. If you say no at any step, you see only non-personalised ads, chosen from things like the app and your approximate location rather than from a profile of you.
• Changing your mind. Turn “Usage stats & tailored ads” off in your profile in the app. In the European Economic Area and the UK, you can reopen Google's consent form at any time with Profile → Ad privacy choices. On iPhone you can also turn tracking off in Settings → Privacy & Security → Tracking; on Android you can reset or delete your advertising ID in your phone's settings.
• Google's role. For ads, Google is an independent controller. You can read how Google uses data from apps that show its ads at policies.google.com/technologies/partner-sites, and manage the ads Google shows you at myadcenter.google.com.

6. Cookies and local storage

• This website, guezzer.com. The first time you visit, we ask whether you agree to analytics cookies. We remember your answer (granted or denied) in a cookie called gz_consent, set on .guezzer.com so that this website and the game at play.guezzer.com share it and one answer covers both. It lasts 12 months and is strictly necessary to remember your choice, so it needs no consent. Google Tag Manager loads on every page with every kind of storage denied by default; analytics cookies are set only if you agree.
• Strictly necessary items. The game keeps a few items on your device: entries in your browser's local storage (or the app's own storage), including your consent choice, and a small cookie that remembers your language. We use them only to keep you signed in and remember your settings. They are strictly necessary for the game to work, so we don't ask for consent.
• Our own statistics. The activity statistics on our servers set no cookies of their own and involve no third-party cookies; they are kept on our servers, linked to your Guezzer account.
• Analytics cookies, only with your consent. If you choose “Sure” in the cookie banner on guezzer.com or play.guezzer.com, Google Analytics sets the _ga and _ga_… cookies to tell visits apart (for up to 2 years). In the apps, an analytics identifier in the app's own storage does the same job. If you say no, these cookies are never set; if you turn analytics off later, we delete them.
• Advertising, apps only. This website and the web game show no ads and set no advertising cookies. In the apps, Google's ad software uses your device's advertising ID and keeps your ad consent choices (including the consent string of the IAB framework) in the app's own storage (see Ads in the apps).

7. How long we keep it

• Guest accounts: deleted automatically after 12 months of inactivity, together with the device identifier and display name.
• Accounts with email, Google or Apple sign-in: until you delete them.
• Game results: linked to your account while it exists. Once the account is deleted, we keep results only in anonymised form, with no link to you.
• Technical logs: 30 days.
• Usage statistics: user-level data in Google Analytics is deleted after 2 months; reports keep only aggregated counts.
• Activity statistics on our servers: 13 months, then deleted.
• Crash reports: 90 days.
• Consent choice: 12 months, then we ask again.
• Advertising data: Google keeps it under its own retention rules (policies.google.com/technologies/retention). Your ad consent choices stay on your device until you change them or delete the app.
• Notification tokens: until you turn notifications off or delete the app; unused tokens expire on their own.
• Email preferences and delivery records: while your account exists. If an email to you bounces for good or is marked as spam, we keep the address on a do-not-email list, even after your account is deleted, only to make sure we never send it game news again.
• What you type and draw in games: only while the room is open.
• Sign-in codes: they expire shortly after we send them.
• Purchases: while your account exists. When you delete your account, we delete them too and cancel any web subscription. Link and the app stores keep their own records of the payment, as tax law requires.
• Content reports, contact form messages, feedback and emails to us: as long as we need them to deal with the matter.

You can delete your account at any time: see Delete your account.

8. Your rights

Under the UK GDPR and the EU GDPR you can ask us to:

• give you a copy of your personal data;
• correct data that is wrong or incomplete;
• delete your data;
• restrict how we use it, or stop using it where we rely on legitimate interests;
• give you your data in a portable format, or send it to another service.

If you are in Türkiye, Article 11 of KVKK also lets you find out whether we process your data, for what purpose and whether it is used for that purpose, and which third parties in Türkiye or abroad receive it; ask us to tell those third parties about a correction or deletion; object to a result against you that comes solely from automated analysis; and claim compensation if unlawful processing causes you harm.

Withdrawing consent. You can turn off usage statistics, crash reports and personalised ads in your profile in the game or the app, or with “Cookie settings” in the footer of this website, at any time. In the European Economic Area and the UK you can also change your ad choices with Profile → Ad privacy choices in the app, and you can turn off notifications, and on iPhone tracking, in your phone's settings. Withdrawing doesn't affect processing that happened before.

Game news emails. Use the unsubscribe link at the bottom of any of these emails, or switch “Game news (email)” off in your profile. Your sign-in codes still arrive after you unsubscribe.

How to use your rights. Email [email protected], from the address linked to your account if you have one. It's free. We reply within one month (within 30 days under KVKK) and may ask for details to confirm the account is yours.

Complaints. Please contact us first so we can try to put things right. You can also complain to a data protection authority:

• United Kingdom: the Information Commissioner's Office (ICO), ico.org.uk/make-a-complaint.
• European Union: the data protection authority in the country where you live or work.
• Türkiye: the Personal Data Protection Authority (KVKK), kvkk.gov.tr. Under KVKK you apply to us first. If we reject your request, you find our answer insufficient or we don't answer within 30 days, you can complain to the Personal Data Protection Board within 30 days of learning our answer, and in any case within 60 days of your request.

9. Children

Guezzer is not directed at children under 13, or under 16 where the law of their country sets a higher age. We don't knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.

10. International transfers

Nexisia is based in the United Kingdom, and our providers (hosting, email delivery, AI, payments and purchases, Google, including for ads, Apple and the content networks above) may process data in other countries, including the United States. When personal data leaves the UK or the European Economic Area for a country without an adequacy decision, the transfer is protected by safeguards recognised by law, such as the UK International Data Transfer Agreement or Addendum, the EU Standard Contractual Clauses, or the provider's certification under the EU-US Data Privacy Framework and its UK Extension.

If you use Guezzer from Türkiye, your data is transferred abroad, because our servers and providers are located outside Türkiye. We make these transfers under the conditions of Article 9 of KVKK.

11. Security

We use HTTPS encryption, restrict access to our systems and keep as little data as we can. Sign-in codes are stored only in hashed form. No system is perfectly secure, but if a breach affects your data we will tell you and the authorities where the law requires.

12. Changes to this policy

We will update this policy as Guezzer changes, for example when we add new features or apps. The date at the top shows the current version. If a change is significant, we will announce it on this website or in the game before it takes effect.

13. Contact us

Questions or requests about your data: [email protected]. By post: Nexisia, Flat 52 Windsor House, 4 Fairfield Avenue, Staines-Upon-Thames, TW18 4JW, United Kingdom.