Privacy Policy
Last updated: 28 August 2026
This policy explains what 52! (factorial52.com) collects, why, and what you can do about it. It describes what the game actually does — not a generic template.
The short version
- You can play without an account and without giving us anything.
- We do not ask for your name, address, phone number or date of birth.
- We do not sell or rent your data.
- The game is funded by advertising. In the EU, EEA, UK and Switzerland we ask your permission first, and you can say no and carry on playing.
- If you sign in with Google, we store your email — that is the only way we can reach you if you win a prize.
What we collect, and why
| Data | When | Why |
|---|---|---|
A random username (e.g. LuckyPanda42) and an account identifier |
Automatically, the first time you open the game | So your plays, streaks and rankings belong to something. Generated by us — it is not your real name. |
| A secret access token | Same moment | It identifies your device to the server. We store only a cryptographic hash of it, never the token itself. |
| Your plays: number of attempts, longest streak, matching cards, date and time | Each round you play | Counters, personal statistics, leaderboards and prize standings. |
Country code (2 letters, e.g. PT) |
When the account is created | The regional leaderboard. Derived from your connection by Cloudflare. We do not store your city, coordinates or anything more precise. |
| Email address and a Google account identifier | Only if you choose “Sign in with Google” | To keep your progress across devices, and to contact you if you win a prize. We receive these from Google; we never see your Google password. |
| IP address and the full details of a round | Only when a round is flagged as a win (all 52 cards correct) | Fraud review. Guessing all 52 is astronomically improbable, so such a round is checked manually before it counts. |
| Server logs kept by our hosting provider | Every request, as with any website | Security, abuse prevention and debugging. |
Stored on your device (not sent to us)
We use your browser’s local storage — not tracking cookies — to remember your access token and username, your chosen game mode, whether sound is on, and whether you have already seen the “tap to play” hint. Google’s consent banner separately stores your advertising choice, so that you are asked once and not on every visit. You can clear all of it at any time through your browser settings. Note that clearing it on an anonymous account means we can no longer link you to your history, and it cannot be recovered. Signing in with Google is what protects against that.
Legal basis (GDPR)
- Contract — the account, your plays and the leaderboards: without them there is no game to provide.
- Legitimate interests — keeping the game working and fair: anti-bot checks, rate limiting and fraud review.
- Consent — signing in with Google, and (when they exist) advertising cookies. You can withdraw consent at any time.
Who else is involved
- Cloudflare — hosting, database and the anti-bot check (Turnstile) that runs when an account is created. Turnstile is designed to work without tracking cookies.
- Google — for advertising (see below), and, if you use “Sign in with Google”, for that sign-in.
Your public username and score may appear on public leaderboards, the live feed and prize standings. Your email is never shown publicly.
Advertising
52! is funded by advertising, supplied by Google AdSense (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). We load Google’s advertising script on every page.
If you are in the EU, EEA, UK or Switzerland, a consent banner appears before any personalised advertising happens, and nothing is set until you choose. You may refuse — the button is right there next to “Consent”, not hidden behind a submenu — and the game works exactly the same either way. Refusing means you see non-personalised ads instead of none at all. You can change your mind at any time through the privacy settings link in the banner.
For advertising, Google acts as an independent controller of the data it collects, under Google’s own privacy terms. It may set cookies or read device identifiers to measure and target ads. We never send Google your email address, your username or your game history.
We plan to add optional rewarded video: watching a short ad to speed up automatic play. That is always a choice you make by pressing a button — never something that happens to you — and refusing it costs you nothing but time.
How long we keep things
- Your account and its totals: while the account exists.
- Individual round records: about 7 days, then automatically deleted. Rounds flagged for fraud review are kept as evidence.
- Prize standings: while the promotion runs and for a reasonable period afterwards, so a prize can be awarded and disputes settled.
Your rights
You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, or to receive it in a portable format. Write to privacy@factorial52.com. If you signed in with Google, tell us the email you used; for an anonymous account, tell us your in-game username — it is the only handle we have.
If you think we have handled your data badly, you can complain to your local data protection authority. In Portugal that is the CNPD.
Children
52! is not directed at children under 13, and we do not knowingly collect their data. Prize promotions have their own age requirement — see the Terms. If you believe a child has given us data, contact us and we will delete it.
Changes
If we change this policy we will update the date above. Significant changes — such as introducing advertising — will be announced in the game before they take effect.