Privacy policy
Last updated: 5 October 2026
The short version
- You can play Quintet without an account. Your progress then stays on your own device.
- If you create an account, we store your email address and your game progress so you can play on every device.
- No ads, no tracking, no analytics, and we never sell your data.
- If you buy Premium or sparks, Stripe handles the payment. We never see your card or bank details.
- You can delete your account and all your progress yourself, at any time, inside the game.
1. Who we are
Quintet (playquintet.com and the Quintet app) is run by Bart van de Loo, trading as Quintet, registered with the Dutch Chamber of Commerce (KvK) under number [KvK number], [business address], the Netherlands. We are the controller of your personal data under the GDPR (in Dutch: AVG).
Questions, requests or complaints: playquintet@gmail.com.
2. Playing without an account
Your results, streak, notes, sparks, levels and settings are saved in your browser's local storage (or the app's storage) on your own device. We don't receive this data. If you clear your browser data, it's gone.
We don't use tracking cookies, analytics or advertising. The fonts, maps and code are served from our own website, so no third parties receive requests while you play.
3. Your account
Creating an account is optional. Depending on how you sign up, we process:
| What | Why |
|---|---|
| Email address | To identify your account, let you log in and send you service emails (see section 4). |
| Password (only when you sign up with email) | To log you in. It is stored as a secure hash; we never see your password. |
| From Google (only when you use "Continue with Google"): name, email address, profile picture link and Google account ID | To create and log in to your account. We don't post anything to your Google account and don't get access to your other Google data. |
| Game data: results per day, streak, notes, sparks, levels, settings and your Premium status | To save your progress and let you continue on another device. |
| Scores and friends: your notes per game (linked to a random device code, and to your account if you have one), your leaderboard name and friend code, and who you added as a friend | To show how everyone did on a puzzle, and to show you and your friends each other's scores and streaks. |
| Leagues: the leagues you create or join (name, invite code, who is in it) and, for the other members, your leaderboard name and notes in that league | To show the league tables you take part in. Only members of a league can see its table. |
| Feedback you send us, and an email address if you add one | To fix mistakes and answer you. |
| Technical data: IP address, browser/device type and the time of logins and requests | To keep accounts secure, prevent abuse and fix problems. These logs are kept briefly and then deleted automatically. |
To stay logged in, the game keeps a login token in your device's local storage. That is strictly necessary for the account to work.
Password check: when you choose a password, the game checks whether it appears in known data breaches, using the free service Have I Been Pwned. Your password never leaves your device: only the first 5 characters of a scrambled code (a SHA-1 hash) are sent, which match hundreds of different passwords. Nothing is stored.
4. Emails
We only send emails you need: a code to confirm your email address, a code to reset your password, and a confirmation if you withdraw from a purchase. Stripe emails you receipts and invoices. We don't send newsletters or marketing.
5. Legal basis
- Performance of a contract (Art. 6(1)(b) GDPR): running your account, saving your progress and providing Premium.
- Legal obligation (Art. 6(1)(c) GDPR): keeping our payment and tax records.
- Legitimate interest (Art. 6(1)(f) GDPR): security, preventing abuse and technical logs needed to run the website.
6. Who helps us (processors)
| Service | What for |
|---|---|
| Supabase Inc. | Database and login (your account and game progress) |
| Netlify Inc. | Hosting of the website (receives your IP address when you load a page) |
| Google LLC / Google Ireland | "Continue with Google" sign-in and sending our service emails |
Payments: Stripe Payments Europe, Ltd. (Ireland) processes your payments. For that, Stripe is itself responsible for your payment data and follows its own privacy policy. We receive your name, email address, what you bought, the amount and the payment status — never your full card or bank account number.
These companies only process data on our behalf. Some of them are based in the United States. Transfers outside the European Economic Area are protected by the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses.
7. Purchases
When you buy Premium or sparks we store your Stripe customer number, your subscription status and end date, and which spark packs you bought, linked to your account. If you withdraw from a purchase, we keep your withdrawal statement (name, email, contract, date and time) as proof.
8. How long we keep your data
- Account and game data: until you delete your account.
- Technical logs: a short period, then deleted automatically.
- Scores: as long as the game runs; scores without an account can't be traced back to you.
- Payment records, invoices and withdrawal statements: 7 years, because Dutch tax law requires it — also after you delete your account.
- Emails and feedback you send us: as long as needed to answer or fix it.
When you delete your account, your account and progress are removed from our database straight away. Copies in backups disappear automatically within 30 days.
9. Your rights
You can ask to see, correct, delete or receive a copy of your data, and you can object to or ask us to limit how we use it. Email playquintet@gmail.com. We reply within one month.
Delete your account yourself: open the game, tap the flame icon at the top, go to Account and choose Delete account.
Not happy with how we handle your data? You can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.
10. Children
Anyone can play without an account. To create an account you must be 16 or older, or have permission from a parent or guardian.
11. Security
All traffic is encrypted (HTTPS). Passwords are stored as secure hashes. The database is set up so every player can only read and change their own data.
12. Changes
If we change this policy, we'll update the date at the top. For important changes we'll tell account holders by email or in the game.