What Stopover stores about you and why. Last updated 1 November 2026.
Stopover (playstopover.me, including the full game at /world) is a free game run by Finn and Luka. We are the controller of your data under Art. 4(7) GDPR. Write to us at support@playstopover.me (players, accounts and anything about your data) or hello@playstopover.me (everything else). There is no data protection officer.
You can play the daily game without any account; it keeps your results in your own browser. If you sign in, your username, your progress and your scores are stored on our server, and some of them (never your email) are visible to other players. We use a handful of services to run the site, find errors and count visits. We never sell data or show ads.
This is the daily game at playstopover.me.
stopover- (the table in section 7). They never leave your device unless you sign in. Legal basis: § 25(2) no. 2 TDDDG (strictly necessary for the game you asked for) and Art. 6(1)(f) GDPR.?vs=…&ref=share. ref=share only says which kind of link brought you; it is not tied to you, and it stays in the address bar where the visit counter can see it. vs carries the sharing player’s date, stops and points (no name) so the page can say “a friend scored …”. Your browser reads it once, uses it only if it is for today’s trip, and removes it from the address bar. It is kept in memory for the visit only: not stored, not sent to our server and never scored.When you open the full game without logging in, we create a guest player with a random name and number (for example LimeMango42). Everything you play is saved on our server under that guest so you can keep going while the tab is open. The guest key is kept in your tab only; closing the tab ends the guest, and a guest we have not heard from for 6 hours is deleted together with everything it saved. Guests are not listed on leaderboards. Basis: Art. 6(1)(b) GDPR (providing the game you are playing).
You may create an account to keep your progress across devices and to appear on boards. We store:
Basis: Art. 6(1)(b) GDPR (your account agreement with us); for the email, Art. 6(1)(b) and (a).
What other players see. Anyone who opens the full game (including guests) can see your public profile and the boards: your username or display name, icon, flag, title, cover, rank, league, rating, flag and stamp collections, places visited, recent trips (destination, vehicle, distance, date), recent expeditions, achievements, your daily streak, race results, the date you joined and when you were last seen. Your email, password, coins balance, followed list and settings are never public.
In a race lobby, the other players in that lobby see your name, icon and look and your live progress (current town, distance, points) over a live connection to our server. Results (who finished where) are kept on the server as your race history. A lobby’s own state is deleted within 15 minutes after the last player leaves. Basis: Art. 6(1)(b) GDPR.
Friends, online status, public races and quick chat.
Once a day our server posts the day’s route and the name (display name or username) of yesterday’s best finisher to our public Discord server; once an hour it updates a statistics message there naming the current daily and weekly leaders, the top five by rating and by flags and the crown holders. These posts are made to Discord Inc. (USA) and can be read by anyone on that server. Basis: Art. 6(1)(f) GDPR (the community side of a competitive game). A player who does not want to appear can ask us at support@playstopover.me or choose not to post scores.
We send email only to confirm an address you add (the link is valid 48 hours) and to reset your password when you ask (the link is valid 30 minutes and works once). When the address on an account changes, we tell the old address. They are sent from noreply@playstopover.me through Resend, Inc. (USA). Your address is never shown to other players. We never send newsletters.
| Name | Kind | Set when | Purpose | Lifetime |
|---|---|---|---|---|
sid | cookie (HttpOnly, Secure, SameSite=Lax) | you log in or create an account | keeps you logged in | 60 days, or until you log out |
stopover-guest | sessionStorage | you play the full game as a guest | your guest key for this tab | until the tab closes |
stopover-mini:* | localStorage | you play the daily game | your results, streak, trip in progress, preferences | until you clear site data |
stopover-look, stopover-lang, stopover-wx-daily, stopover-announce-seen, stopover-checkin-seen, stopover-restore-seen, stopover-redeem and other stopover-… keys | localStorage / sessionStorage | as you use the game | look, language, today’s route, which banners you have seen, a code typed before login | until you clear site data (session keys: until the tab closes) |
No advertising or tracking cookies are used. Simple Analytics sets no cookies.
| Service | Company | Role | Region |
|---|---|---|---|
| Hosting, server, database, logs | Cloudflare, Inc., San Francisco, USA (and Cloudflare Germany GmbH) | hosts the site and runs our code on its global network; our database lives in a Cloudflare data centre that we have not pinned to a region | worldwide; transfers covered by Cloudflare’s data processing agreement with Standard Contractual Clauses |
| Error reporting | Functional Software, Inc. (Sentry), San Francisco, USA | stores error reports in its EU region (Germany) | EU storage; US company, data processing agreement and Standard Contractual Clauses |
| Visit counting | Simple Analytics B.V., Netherlands | cookieless statistics | EU |
| Feature switches | ConfigCat Kft., Budapest, Hungary | serves one settings file | EU company, global content network |
| Resend, Inc., San Francisco, USA | sends address-confirmation and password-reset emails | USA; data processing agreement and Standard Contractual Clauses | |
| Community posts | Discord Inc., San Francisco, USA | receives the daily and hourly posts (a recipient, not a processor) | USA |
Browser data: until you clear it. Guest: 6 hours after last contact. Account data: until you delete the account. Login sessions: 60 days or logout. Password-reset and confirmation links: 30 minutes / 48 hours. Board scores: daily 120 days, weekly 2 years, then deleted. Daily quests: 7 days. Friend requests: 30 days unless answered. Online status: only while you are connected. Missed race invites: 30 minutes. Public race listings: 15 minutes after they stop being listed. Quick chat: not stored. Rate-limit entries (which hold your IP address or email for abuse prevention): 24 hours. Server logs: up to 7 days. Error reports: about 90 days. Suspension and report records: for as long as the account exists. Race results and code redemptions: kept (see section 10).
In the full game: Profile → Account → Delete account → type your password → “Delete my account forever”. This removes the account, your saves, statistics, scores, quests, bounties you posted, reports, suspensions, rewards, friends, friend requests, blocks, friend settings and sessions at once. What stays: the record that a redeem code was used (an internal number, the code and the coins), race result rows (your username and placing in past races) and bounties you claimed (an internal number); past Discord posts; log and error entries until they expire as above. If you want these removed too, write to support@playstopover.me. You can also remove just your email address from Account.
You have the right to access your data (Art. 15), to have it corrected (16) or erased (17), to restrict processing (18), to receive it in a portable form (20), to object to processing based on our legitimate interests (21), and to withdraw any consent at any time. Write to support@playstopover.me; we reply within a month. Until a download button exists, access and portability requests are answered by email with the JSON of your save. You may complain to the data protection authority where you live or work.
The game is not aimed at children under 16 and asks for no personal details beyond an optional email. We ask that players under 16 do not create an account without a parent’s agreement. There is no age check in the game.
We update this notice when the game or its services change; the date at the top says when. Material changes are announced in What’s new.