Privacy Policy

In short

KRILLION is a guessing game. One game a day needs nothing from you. Beyond that you need an account, and the account is just an email address, plus the name Google or Apple sends us if you sign in through them.

The site sells no data, shows no advertising, builds no advertising profile and does not follow anyone from site to site.

• Without an account: a one-way fingerprint of your IP address counts your games for the day. The address itself is never stored.
• With an account: your email address, the name sent by Google or Apple if you use them, and a summary of the games you finish.
• Leaderboard: the next day, your best finds on the Daily Dive are published under a generated nickname, never under your email address, and never with the text you typed.
• Purchase: payment goes entirely through Stripe. No card number passes through KRILLION.
• Your games, statistics and settings stay in your browser until you create an account.
• Audience measurement: a few technical events, with no cookie and no lasting identifier, to see where the game blocks people.
• Advertising: none, on any page and for anyone. No advertising cookie is set.
• Trial offer by email: a free account that has played its games for the day may receive, about one hour later, an offer to try the subscription. Never more than one a week nor three in all, each one carries its unsubscribe link, and you can object at any time.

Who is responsible

The data controller is KRILLION LTD, publisher of krillion.to, identified on the Contact page.

For any question about your data, write to [email protected]. That address is read, and it is also how you exercise your rights.

When you play without an account

Starting a game sends a request to our server, and that request carries your IP address, as every web request does.

The server does not keep it. It computes a one-way fingerprint (HMAC-SHA256, with a secret key that never leaves the server) and stores only that fingerprint, together with today's date and the number of games started. The fingerprint cannot be turned back into the original address and is linked to no account, no name and no email address.

What it is for: enforcing the limit of one free game a day without an account, and stopping the same visitor from cycling past that limit.

Legal basis: our legitimate interest in offering a free trial without letting automation drain it. No profiling is done from this fingerprint.

What stays in your browser

Until you have an account, your games never reach our servers. They are written to your browser's local storage, on your device.

• Only you can read these entries. No third party has access and nothing is sent anywhere.
• You can erase them at any time by clearing the site's data in your browser.
• The Backup page lets you export and restore your games, statistics and sound setting, with no account and without going through our servers.

The game in progress, for one tab

During a game, the tab also keeps the game in progress in its session storage, under the key echolow:partie_en_cours:v1: a game identifier drawn at random, the mode and number of the game, the identifiers of its questions, the rounds already judged with your answers, the answer being typed and the last one refused, the launch time and the round's time limit, whether you were signed in at launch, and the game token issued then.

It is only used to resume the game if the page reloads or if you switch language midway. It is never sent as such: only the token and, when a resumed round ends, the answer being typed at that moment go to the server, as in any ordinary game.

A duplicated tab receives a copy of it, but only one of the two can carry on with the game: the one that has judged the most rounds, according to the local storage entry echolow:manches_jugees:v1 described above.

It is replaced when you start another game, and deleted when you leave the results screen with “Back to home” or “New game”, when the server refuses the token or when the game carries on in another tab. It is no longer resumed fifteen minutes after the game ends or six hours after it started, and it disappears when the tab is closed, unless the browser reopens that tab by restoring your session.

How the game measures its audience

To find out where players drop off, the site records a few events during your visit: opening a page, showing the intro screen, starting a game, being stopped by the quota, answering a round or letting it run out, finishing, abandoning or resuming a game, opening the sign-in dialog and how it ends, showing the lifetime offer and buying it, opening a pack, sharing a result. The list is closed: the server rejects any other name.

This measurement is done by us, for us, on our own domain. No third-party audience measurement tool is loaded on the site: no Google Analytics, no equivalent. These events go to krillion.to and nowhere else, and they serve only to fix and improve the game.

The site loads only three outside scripts: the Stripe payment library, as soon as the paid offer is shown on the end-of-free-games wall or on the trial page, and otherwise when you pay; and the Google and Apple sign-in modules, as soon as the sign-in button is shown. None of the three receives these events.

• Never an email address, never the text you type, never your IP address in the clear, never your name.
• No measurement cookie is set, and no lasting identifier is created for this measurement.
• The IP fingerprint is computed on the server from the request itself. Your browser neither sends it nor knows it.
• The tab identifier lives in session storage: it travels with no request, it does not survive closing the tab, and it ties you to no other visit.
• No automated decision is made from these events, and no advertising profile comes out of them.

Why this measurement does not ask for your consent

Legal basis: our legitimate interest in understanding and fixing our own game, under article 6(1)(f) of the General Data Protection Regulation.

Your consent is not required because this measurement stays within the limits the French data protection authority sets for exempt audience measurement: it is strictly limited to analysing this site, it is run by the publisher for its own purposes alone, it sets no cookie and no tracker subject to consent, it produces aggregate statistics only, it follows you to no other site, it is cross-referenced with no other processing, and its data goes to nobody.

Retention: raw events are deleted after 90 days. Only counts, which identify nobody, may be kept beyond that.

Objection: you can object to this measurement by writing to [email protected]. If you have an account, the events attached to it are deleted. Without an account, nothing in those rows can find you, and that is on purpose.

When you create an account

There are three ways in: a sign-in link sent by email, the Google button or the Apple button. No password is ever created or stored.

• Email link: we process your email address, held by our authentication provider Supabase.
• Google sign-in: Google sends us your email address and, when your Google account has them, your display name and the address of your profile picture. We ask for nothing else and reach no other part of your Google account.
• Apple sign-in: Apple sends us an identifier specific to KRILLION and an email address, either yours or, if you choose to hide it, a relay address created by Apple that forwards our messages to you. On the very first sign-in only, Apple also sends us the name typed in its window. We reach no other part of your Apple account. That name is kept with the account, only used to show it in your account menu, and goes with it.
• Hidden address: an account opened with Apple's relay address is a separate account from the one opened with your real address. It does not get back the paid access or the trial taken with another method: if you already have an account, sign in again with the same method as before.
• Session: cookies set by Supabase, with names starting sb-, keep you signed in until you sign out. They are required for an account to work at all, and their lifetime is given on the Cookies page.
• History: when a game ends, a summary is stored server-side (mode, game number, score, depth reached, finish time). The twenty most recent are the ones shown to you.
• Quota: a per-account, per-day counter, of the same kind as the anonymous one.

Yesterday's Daily Dive leaderboard

The next day, the page of yesterday’s best finds shows, question by question, which player gave the best answer and what it was. It is the only place on the site where something you did in a game becomes public.

What is recorded, and only if you play the Daily Dive with an account: your account identifier, the day of the dive, the question identifier, the tier reached, the points, the wording of that answer as it is written in our question bank, and the time. One row per question and per account, the one for your best find.

What is published: a generated nickname and that wording from the question bank. Nothing else.

Legal basis: our legitimate interest in running a game that gives people a daily appointment, under article 6(1)(f) of the General Data Protection Regulation. No profile is built from it and no automated decision follows from it.

• The text you type is neither stored nor published. Only the question-bank answer your typing reached is, and it is read back from the bank before anything is displayed.
• An answer the game does not recognise is not recorded at all.
• The nickname, for example Diver A7F3C, is derived from your account identifier with HMAC-SHA256, using a key that stays on the server. It is stable, it cannot be traced back to you, and it contains neither your email address, nor your name, nor your picture.
• Without an account, nothing is recorded for this page: the leaderboard names accounts only.
• The Daily Dive currently in play never appears there: only days that are already over do.
• Retention: 90 days, then automatic deletion. Deleting your account removes these rows along with the rest.
• Objection: write to [email protected] to have your finds taken off this page and to keep your later games out of it.

Battle mode

Battle mode gathers several accounts in one room, around the same seven questions, at the same moment. It is the only place on the site where other players see a name you chose, and your score moving.

The mode needs an account: without one it cannot be played, and nothing is stored about you there.

Legal basis: performance of the service you ask for by entering a room, under article 6.1.b of the General Data Protection Regulation. No profile is built from it and no automated decision follows from it.

• Stored for your account: a nickname, a fish number, and the date it was last changed. Neither your email address, nor your real name, nor your picture.
• Stored for a room: your account identifier, the nickname and fish chosen on the way in, the time you joined and the time you were last seen.
• Stored for each round: the tier reached, the points, and the answer as it is written in our question bank. The text you type is neither stored nor shown to the others.
• Who sees what: the other players in that same room, and nobody else. They see your nickname, your fish and your depth. They see your answer only once the round is over, never before. A room holds up to 50 players.
• The nickname is text you write and others read. Its length and character set are bounded, addresses and links are refused, and it is checked again at the moment of display: a nickname the check refuses becomes an anonymous diver code instead, on the end-of-game picture too.
• The end-of-game picture is produced by our server when you ask for it. It carries the nicknames and depths of that room. We publish it nowhere and keep no copy: saving it and sharing it is your decision.
• Retention: a finished room is deleted after 7 days, a room abandoned mid-dive after three hours. Deleting your account removes these rows along with the rest.
• Objection: write to [email protected] to have your nickname reset to its original value and your rooms erased. Simply not playing Battle mode is enough for nothing to be stored there.

Measuring answers

The game counts what players answer, for two reasons: to find the valid answers its catalogue is missing, and to observe which answers are genuinely common rather than deciding it by hand.

This measurement does not identify you, and could not: nothing it records is tied to an account, an address or a session.

Legal basis: our legitimate interest in fixing and balancing the game, under Article 6(1)(f) of the General Data Protection Regulation. No profile is built from it and no automated decision follows from it.

• When an answer is not recognised, the game keeps its normalised form, lower case, without accents or punctuation, and a counter. Neither the text as you typed it, nor who typed it.
• An entry that does not look like a game answer, because it is too long, forms a sentence or contains an address, is discarded before anything is recorded.
• A form seen only once appears nowhere: only what comes back several times counts as a lead.
• When an answer is recognised, the game counts one more distinct player on that answer. The player is a one-way fingerprint (HMAC-SHA256) computed with a key that stays on the server, and replaying the same answer does not count twice.
• Retention: 90 days, then automatic deletion.

The special case of the sign-in link

A link received by email is very often opened on a different device from the one that asked for it. So the verification token is parked on our server until the link claims it.

That record holds a one-way fingerprint of your email address, a one-way fingerprint of your IP address (never the values themselves), the technical token and an expiry time. It lasts one hour at most, can be used once, and is deleted automatically.

The fingerprints also limit how many links can be requested per hour, for one address and from one network, so nobody can use the site to flood a mailbox.

The email itself is delivered by Resend, our sending provider, from infrastructure located in the European Union. It contains only the sign-in link, and never any advertising.

A sign-in email is not an announcement. Announcements about the game are a separate mailing, described in the next section, with an unsubscribe link in every one of them.

Announcement emails

A KRILLION account can receive announcements about the game: a new question pack, a new mode, a change worth telling you about. They are rare, they come from us alone, and they are delivered by Resend, like the sign-in emails.

The mailing list holds nothing but KRILLION accounts whose address has been confirmed. It is never bought, never traded, never fed from another website, and an address typed into the sign-in screen without ever being confirmed does not enter it.

What the list holds: your email address, the language you read the site in, the date the account was created, how many announcements it has received and when the last one left. These emails carry no tracker: no open pixel, no click measurement link.

Legal basis: our legitimate interest in keeping our own players informed about what the game becomes, under article 6.1.f of the General Data Protection Regulation. No announcement is sent on behalf of a third party, and the list never leaves KRILLION.

Leaving: every announcement carries an unsubscribe link that takes your address off the list in one click, and the site’s Account window offers the same stop. The address then goes onto a refusal list, kept with no time limit, whose only job is to guarantee that nothing goes back to it, even if you open a new account later.

Leaving the announcements cuts neither the sign-in links nor the payment receipts: those are not announcements. A message to [email protected] has the same effect as the link, and deleting your account takes your address off the list at the same time.

The trial offer sent after the day’s games

When a free account has played its free games for the day, KRILLION may send it, about one hour later, an email offering the free trial of the yearly plan. It is a commercial offer: its subject line says so, and its terms (length of the trial, price afterwards with all taxes included, cancellation) are written in the message. It leaves between 8:00 and 22:00, local time in the time zone your browser reports, within the two hours that follow that one-hour wait, and on the same UTC day as the games. If that is not possible (at night, or after midnight UTC, when the free games are back), nothing leaves that day. If your browser reports no time zone, nothing leaves either.

Who receives it: any account whose email address is confirmed, whatever its country and whenever it was opened, which is on the announcement list described in the previous section, has not objected, has no subscription, no lifetime access and no current or past trial, and has itself played all of its free games that day. Everything is checked again just before sending. Never more than one email a week, nor more than three in all for the same account.

What is kept for this: the account identifier, the day concerned, the time the free games ran out and the time of the sending, the language and currency of the page at that moment, the time zone reported by your browser (for example “Europe/Paris”), and the state of the sending. That time zone travels with every game start and every entry into a Battle room, but it is only kept when the offer is being prepared, and its only use is to pick the time of sending. The country of connection only picks the currency: it is not kept. The email address is not copied: it is read from the announcement list when the message leaves.

Measurement: no open pixel, no per-recipient tracking link. The button in the message leads to the trial page with the same marker for everyone, which identifies nobody. If you reach the trial page through that button, the checkout session that page opens at Stripe, as soon as it is shown when you are signed in (see the part on payment), carries a note of that origin, the same for everyone, so we can count the trials these emails open. The exact price, depending on the country of connection, shows on the trial page before any payment.

Legal basis: our legitimate interest in presenting our offer to our own players, under article 6.1.f of the General Data Protection Regulation. You can object to these emails at any time, free of charge and without giving a reason (article 21 of the same regulation).

Objecting: every message carries a link to a page where a single click takes you off these offers and the announcements, and mail apps that support it also show their own unsubscribe button, which acts at once. The site’s Account window offers the same stop, and a message to [email protected] has the same effect. Your address then joins the refusal list described in the previous section, and no offer or announcement goes to it again. Sign-in links and payment receipts keep arriving.

Retention: the record of a message that left, or whose outcome stayed unknown (the provider did not answer), is kept as long as the account exists, to hold the limits of one a week and three in all, and goes with it. A row that led to no message is deleted after seven days.

When you buy lifetime access

Lifetime access costs $29.90, paid once. Payment is handled by Stripe, in a form supplied and served by Stripe.

Your card number, expiry date and security code never pass through KRILLION and are never visible to us.

We send Stripe your email address and an internal account identifier, so the payment attaches to the right access.

On the end-of-free-games wall and on the trial page, the checkout session is prepared at Stripe as soon as the offer is shown, so the card form opens without a wait. If you are signed in, your email address and your account identifier are therefore sent to Stripe at that moment, before any click. Nothing is charged until you confirm the payment.

After payment we keep, on our side, the Stripe identifiers of the checkout session, the payment and the customer, plus the amount, currency and date. No card number is kept. For a free trial, only a one-way fingerprint of the card fingerprint Stripe gives us is kept, as described in the next section.

Legal basis: performance of the contract you enter into by buying, then our accounting obligations for keeping records.

The free trial and your address

The free trial is granted only once per email address. To hold to that, we keep a one-way fingerprint (HMAC-SHA256, with a key that never leaves the server) of the address of every trial granted, with the Stripe identifiers of its subscription. That record outlives the account: its only job is to stop a trial being taken again by recreating an account. A trial stopped before anyone ever claimed it releases it.

From the game, the trial can be requested before you have an account. The address you give then serves three purposes: checking that it has never had a trial, a subscription or an access, by comparing it with that register, with pending purchases and with existing accounts; being passed to Stripe, which enforces it at payment; and receiving the sign-in code and link, which create your account at that address. KRILLION stores it nowhere in plain text before payment.

So that nobody can use this check to test a list of addresses, each request leaves a one-way fingerprint of the address and of the IP address, deleted after one day. Those fingerprints only limit how many requests can be made per hour: per address, per network and overall.

To measure trials that come back with the same card, we keep a one-way fingerprint of the card fingerprint Stripe provides, with a counter: no card number, no address, no account. It is deleted thirteen months after the last trial opened with that card, and is never used to turn anyone away.

Legal basis: performance of the contract you ask for, and our legitimate interest in offering the trial only once per person, under article 6.1.f of the General Data Protection Regulation.

When you cancel or withdraw

Both exit forms ask for a first name, a last name, an email or postal address, a contract reference and a date. That is not a collection of our own choosing: decree D. 215-2 of the French Consumer Code sets the list, and article L. 221-13 requires us to be able to prove what was declared.

No account is needed to fill these forms in, and none is created along the way. Decree D. 215-1 forbids requiring one at the point of notification.

These requests, and the boxes ticked before a payment, are kept for 3 years, then deleted. That is how long a dispute over the contract can still be taken to court: beyond it, the proof protects nobody.

Legal basis: performance of the contract, and compliance with legal obligations that bind us.

No advertising, no advertising cookies

KRILLION shows no advertising, on any page and to anyone, with or without an account, subscriber or not. No ad code is loaded, no ad network receives anything, and no cookie is set for advertising purposes.

The site's content pages loaded the Google AdSense network's code until 2 October 2026, while Google reviewed the site. That code sent Google your IP address and the address of the page you were reading. It has been removed: since then, nothing is requested from Google's servers for advertising. On the evening of 31 August 2026, the code of another ad network, Monetag, was also loaded on the site's pages, then removed.

The game is funded by paid access, which stays optional. Should advertising ever return, this page would say so before the first ad, not after.

Since no advertising storage is used, no advertising consent is asked for, in the European Union or anywhere else.

• If the Google AdSense network, while it was in place, or its consent window set cookies on krillion.to, those cookies may still sit in a browser until they expire, as may any that the Monetag network set on 31 August 2026. The site makes no use of them and no longer renews them. Clearing them from the browser changes nothing in the game.

Who else receives this data

KRILLION neither sells nor rents data. The only third-party recipients are the providers the site cannot run without.

Transfers outside the European Union

The server running the game is hosted in France. The database and authentication are hosted in the European Union by Supabase, and the site's emails leave from Resend infrastructure located in the European Union.

Stripe, Cloudflare and Google, by contrast, are companies established in the United States, so part of the processing happens outside the European Union.

Those transfers rely on the EU-US Data Privacy Framework, which these companies have joined, and where relevant on the European Commission's standard contractual clauses.

For the European Union, signing in with Apple falls under Apple Distribution International Ltd., established in Ireland. According to Apple's privacy policy, the transfers Apple makes outside the European Union, notably to Apple Inc. in the United States, rely on the European Commission's standard contractual clauses.

How long this data is kept

Record of processing: audience measurement

The GDPR requires a record of processing activities. Here is the entry for audience measurement, published as it stands so you can read it without having to ask.

Your rights

The General Data Protection Regulation gives you rights over data about you.

• Access: obtain a copy of the data we hold about you.
• Rectification: have inaccurate data corrected.
• Erasure: have your account and everything attached to it deleted.
• Portability: receive your data in a machine-readable format.
• Objection: object to processing based on our legitimate interest.
• Restriction: ask for processing to be frozen while a dispute is resolved.

In practice

Write to [email protected], from your account address or naming the address concerned. We answer within one month.

Account deletion: the game has no dedicated button yet. A request to that address is enough. Deleting the account also erases, automatically, the game history, the counters attached to the account and the access right that goes with it.

Objecting to audience measurement: the same address is enough. You do not have to justify yourself.

If our answer does not satisfy you, you may complain to your national data protection authority. In France that is the CNIL: 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.

Age of players

KRILLION is not aimed at children, is not directed to them and does not try to attract them. We do not knowingly collect data about people under fifteen, and the site shows advertising to no one.

If you believe a child has sent us data, write to [email protected] and it will be deleted.

Security

The site is served over HTTPS only, any plain request is redirected, and browsers are told never to call it any other way for a year.

IP addresses and email addresses used to count games and limit sending are stored only as one-way fingerprints, computed with a key that stays on the server.

The tables holding your data are reachable by no browser client: only the server reaches them, through dedicated functions that check on every call who owns the row being asked for.

• The site refuses to be displayed in a frame on another site, which closes a classic click-hijacking route.
• The content type the server announces cannot be reinterpreted by the browser.
• The referring address is only passed to third-party sites in reduced form.
• Camera, microphone and location access are denied for the whole page.

Changes to this page

The last revision date is shown at the top of this page. If a change affects what we collect, why, or who receives it, it will be announced on the site rather than slipped quietly into the text.

Cancel or withdraw from your contract

Cancelling a subscription and withdrawing from a purchase are done online, free of charge and with no account.

• Cancel your contract
• Withdraw from your contract here