Privacy
Last updated 09/08/2026
The short version: we store what the game needs to work, we don't sell it, and there's no advertising anywhere in the product.
Who runs this
Londy is operated by Londy, based in France. For data-protection purposes that makes us the data controller. You can reach us at contact@londy.app.
What we store
- Your email address — to sign you in, confirm your account and reset your password.
- Your display name — whatever you choose to be called. It's shown to your partner.
- A password hash — never the password itself.
- Your phone number, only if you enter one. It's optional and unused today.
- Your couple — who you're paired with, and your shared settings.
- Your game history — the words, your guesses, times, reactions and streaks.
- Push subscriptions, if you turn notifications on. This is an address your browser gives us, plus keys used to encrypt the message.
- Server logs — IP address, browser and requested page, kept briefly for security and debugging.
Why we're allowed to store it
Almost all of it is necessary to provide the service you signed up for — the legal basis is performance of a contract. Server logs rest on our legitimate interest in keeping the service working and secure.
Who else sees it
Only the companies that help run the service, and only what they need:
- Microsoft Azure — hosts the database (EU region).
- Hetzner — hosts the application server (Germany).
- Resend — sends account emails.
- Cloudflare — DNS.
- Google and Apple — deliver push notifications, if you enable them. They relay a message they cannot read: it's encrypted with keys only your browser holds.
- Google Analytics — tells us which parts of the app get used.
We do not sell your data, share it with advertisers, or use it to build a profile of you.
Your partner
Pairing is deliberate sharing. Once you're paired, your partner sees your display name, your results, your reactions and your shared history. They never see your email address or anything from your account settings.
Cookies
A sign-in cookie so you stay logged in, and an anti-forgery cookie that protects forms. Both are strictly necessary — without them the app can't work. Google Analytics also sets its own cookies to count visits.
Your browser additionally stores a couple of small local preferences, such as whether you've seen the rules. Those never leave your device.
How long we keep it
Your account and game history stay until you delete your account. Push subscriptions are removed automatically once a device stops accepting them. Server logs are short-lived.
Your rights
Under GDPR you can ask for a copy of your data, correct it, delete it, or object to how it's used. Two of those are self-service:
- Download your data — a machine-readable copy.
- Delete your account — permanent, and it can't be undone.
For anything else, email us. You also have the right to complain to a supervisory authority — in France that's the CNIL.
Children
Londy isn't intended for children. You need to be at least 15 to create an account.
Changes
If this page changes in a way that matters, we'll say so before it takes effect. The date at the top always reflects the current version.