Privacy policy

Introduction

Heritap ("the service") is provided by Wisdam (individually operated; "the operator"). The operator keeps as little information about you as possible, and handles it as follows.

Playing without signing in

Your game records, collection and settings (language, units and so on) are stored only in your own browser (localStorage) and are never sent to our servers, except for error reports (see "Error reports" below). You can erase them at any time with "Erase all records" in Settings, or by clearing this site's data in your browser.

What we store if you sign in

You can sign in with Google, Apple or X. We store only:

Which service you signed in with, and the account ID that service gives us (so you can sign in to the same account again)

Your results (puzzles, scores and dates), the sites in your collection, and the country you chose for the ranking

Session data that keeps you signed in (it expires)

We do not store your email address, name, profile picture, IP address or device information (user agent), nor any access token from the sign-in service.

Other settings, such as units, stay in your browser even after you sign in.

Error reports

When you send a report with "Report an error" in Learn, what you send (the site, the field, the display language and your message) is stored on our servers, whether or not you are signed in, and used only to check and correct the content.

Reports are stored without anything that identifies the sender (no account, no IP address) and are deleted automatically after 180 days. Please do not put your name, contact details or other personal information in the message.

To stop floods of requests, we keep a one-way hash made from your IP address for at most one hour. The same applies when the Records screen loads everyone's results.

If you buy Heritap Plus

Plus payments are handled by our payment provider, Stripe. Your card or other payment details, and the email address you enter at checkout, go directly to Stripe and are never sent to or stored on our servers.

We store only what we need to decide whether you have Plus: your Stripe customer ID, your plan (monthly or yearly), the subscription's status and the end of the current period.

Deleting your account deletes this information and your Stripe customer record (which cancels the subscription at once).

Deleting your account

"Delete account" in Settings immediately deletes your account and every record stored with it. Expired sessions and similar data are deleted automatically on a schedule.

Third-party services

To display and run the service, your browser or our servers connect to the following services, which receive technical information such as your IP address and browser type:

Vercel (hosting; keeps access logs)

Our database host (stores the information above for signed-in users)

Google, Apple or X (only the one you choose to sign in with)

Where the ISS at? (the live position of the International Space Station)

Stripe (Plus payments; only if you buy or manage Plus)

Please see each service's own privacy policy for how they handle this information.

Providers outside Japan

For signed-in users, the information listed under "What we store if you sign in" is stored and processed on the servers of these US companies:

Neon (database; a Databricks, Inc. service; data centre in Ohio, USA)

Vercel (hosting; Vercel Inc., USA)

Stripe (payments; Stripe, Inc. and affiliates, USA; payment details and email address if you buy Plus)

The United States has no comprehensive federal law equivalent to Japan's Act on the Protection of Personal Information, but these providers commit to security measures in their terms and data processing agreements.

How we protect your data

We keep only the information listed above, and protect it with encrypted connections (HTTPS), a database account limited to what the app needs with row-level access control, careful handling of administrative credentials, and rate limits.

Cookies and analytics

We use only a cookie that keeps you signed in and one that remembers the display language you chose (NEXT_LOCALE). There are no analytics tools, advertising or tracking. If we ever add analytics, it will be cookieless and anonymous, and we will update this policy first.

When you contact us

If you email us, we use your address and message only to reply and to improve the service, and we do not share them with third parties unless required by law.

Requests about your data

To ask us to disclose, correct, stop using or delete the information we hold about you, email the address below. We will respond without delay once we have confirmed it is you. You can also delete your account and records at any time from Settings → Delete account. We will give the operator's address without delay on request.

Changes

We may update this policy and will post the new version here. Before we change what information we use or why, we will explain it here.