Privacy policy

Last updated: 12 November 2026

Chrono is a free daily timeline game at playchrono.online. We collect as little as we can: enough to give you one fair round a day, keep your streak if you sign in, and keep the statistics honest.

Who is responsible

Kviq Innovation AS (organisation number 992 900 555), Konditorveien 14, 1619 Fredrikstad, Norway, is the data controller. Contact us at post@kviq-innovation.no.

What we store and why

When you play (no account needed)

A random player ID, stored in a cookie called chrono_pid (lasts two years) and mirrored in your browser’s local storage as chrono_player. It lets us keep your round if you reload the page and stop the same round being played twice. It is not used for advertising or tracking across sites.
Your rounds: the puzzle date, the order of the cards, your attempts, your score and when you played. These make the game work and feed the anonymous statistics (“better than 68% of players”). Other players only ever see percentages, never your rounds.
A daily device signal: a one-way hash of your IP address, browser (user agent) and language settings, salted with a secret that changes every day. We use it only to stop the same device from playing the same day’s round again in a private window. We also keep a separate daily hash of your IP address to limit how many rounds from one network count in the statistics. We never store your IP address itself.

Legal basis: our legitimate interest in providing a fair game with reliable statistics (GDPR Article 6(1)(f)), and providing the service you ask for (Article 6(1)(b)). The cookie and local storage are strictly necessary for the game, so they don’t require consent.

If you sign in (optional)

Your email address and, if you sign in with Google, your Google account ID. We don’t keep your name, profile picture or Google access tokens.
A session cookie (chrono.session_token) that keeps you signed in for up to 60 days. Sessions are stored without your IP address or browser details.
Sign-in links sent by email are valid for 15 minutes and stored only as a one-way hash.
When you sign in, the rounds played in that browser are linked to your account, so your streak follows you between devices.

Legal basis: providing the account you asked for (Article 6(1)(b)).

If you report a problem

We store which card you reported, the reason and any text you write (up to 500 characters), linked to your player ID or account so each card can be reported once per day. Report text may be forwarded to the team’s internal alert channel, without your ID. Legal basis: our legitimate interest in correcting mistakes (Article 6(1)(f)).

Analytics and advertising

Chrono currently uses no analytics or advertising cookies. If we add them, we will ask for your consent first, and nothing of that kind will run until you agree. This page will be updated before that happens.

How long we keep it

The player ID cookie expires after two years without a visit.
Sign-in sessions expire after 60 days; sign-in links after 15 minutes.
Your account is kept until you delete it. You can delete it at any time under Account → Delete my account.
Rounds and reports are kept for as long as Chrono runs, because the daily statistics and the archive depend on them. When you delete your account, your rounds and reports stay in the statistics but are separated from you: each gets a new random owner, so they can’t be linked to you or to each other.
The daily device and IP hashes can’t be linked to you after the day they were made, because the secret salt changes daily.

Who processes data for us

Cloudflare hosts the site, the database and the images. Like any web host, it handles your IP address to deliver pages and protect the site from abuse.
Resend sends the sign-in emails (your email address).
Google, only if you choose “Continue with Google”: Google tells us your email address and account ID.
Slack receives our internal alerts, which may include report text but no player IDs or email addresses.

Some of these companies may process data outside the EEA, including in the United States. Such transfers rely on the safeguards the GDPR requires, such as the EU–U.S. Data Privacy Framework or the EU’s standard contractual clauses.

The puzzles themselves are built from Wikidata and Wikimedia Commons and written with the help of an AI model. None of your data is sent to those services.

Your rights

You can ask to see the data we hold about you, have it corrected or deleted, object to how we use it, or receive a copy. Signed-in players can delete their account themselves. For anything else, email post@kviq-innovation.no. Without an account we can only find your data if you give us your player ID, which you can read in your browser’s storage.

If you think we handle your data wrongly, you can complain to the Norwegian Data Protection Authority (Datatilsynet).

Children

Anyone can play without an account. You must be at least 13 years old to create an account.

Changes

If we change how we handle data, we update this page and the date at the top.