Privacy policy
Last updated: 28 October 2026
ClickPlanet is a game run by Рафаел Остер ЕООД (Raphael Oester EOOD), a company registered in Bulgaria, EIK 206853249. Its registered address is БЪЛГАРИЯ, гр. София (1000), р-н Оборище, ул. Екзарх Йосиф 93, ет. партер (93 Ekzarh Yosif St., ground floor, Oborishte district, Sofia 1000, Bulgaria). On this page, "we" means that company. You can play without an account, and to play we never ask for your name, email or any other contact detail. You can choose to sign in with Google, Discord or your email address. This page says what we collect, why, and how long we keep it.
What we collect
| Data | Why | Kept for |
|---|---|---|
| Your IP address and browser user agent, in our server's access log | Security, debugging and finding bots | 14 days |
| Each tile you take: the tile, the flag, the time, and your account | Season scores, titles, and undoing cheaters | Until your account is deleted; the tile, the flag and the time then stay, with no account. A guest account is deleted 90 days after your last visit. |
| The IP address (or its /64 for IPv6) each tile was taken from | Undoing and stopping cheaters | 72 hours |
| How you click: timing and order of clicks, map reads, bonus catches, linked to your IP address | Automatic bot detection | 72 hours |
| A ban record, keyed on an IP address (or /64), if you are banned for cheating | Keeping cheaters out | Indefinitely |
A guest account: a random id, when it was created and last used, and a cookie (cp_sid)
that identifies it. We store only a hash of the cookie.
|
Knowing that the same browser is still playing | 90 days after your last visit |
| How your account came: by a player's link, by our YouTube link, or unknown; the name of the website you came from (only its name, such as www.google.com, never the page); and when. Your browser keeps these from the first page of ours you opened. | Counting which links and websites bring new players | Until your account is deleted; it then stays with no account |
| Only if you sign in with Google or Discord: the id that service gives you, your email address if the service says it is verified, and when you signed in with it. It is linked to your account. | Keeping your account on every device where you sign in, and finding the same account when you sign in with the same verified address another way | Until you delete your account |
| Only if you sign in with your email address: the address, and when you signed in with it. It is linked to your account. The code we send is kept for 10 minutes in an encrypted cookie in your browser, not on our server. To limit how many codes go to one address, our server also keeps the address in memory for up to one hour after a code is sent. | Signing you in, and keeping your account on every device where you sign in | Until you delete your account |
| Chat messages: the name you chose, the text, your flag, a random id your browser keeps, your IP address and user agent | Showing the chat, and moderating it | 30 days |
| Chat reactions: the message, the reaction, and who gave it: your account if you have a username, otherwise the short tag made from your IP address | Counting reactions, and letting you take yours off | 30 days |
| Only if you send a suggestion or report a bug: the text, the photos and videos you attach, your account, and what the page knows about itself: your browser user agent, the size and pixel density of the page, your graphics card as your browser names it, the number of processor cores and the amount of memory your browser reports, which version of the game the page runs, and whether the page had lost the server or its graphics | Reading what players ask for, and finding and fixing bugs | Your account stays on it for 90 days, or until your account is deleted. Then we remove it, and we keep the rest, photos and videos included, with nothing that says who sent it. |
| Only if you report a player, or a player reports you: the account that reports, the account reported, the reason, the text, and the chat message the report is about | Moderating the game. A report does nothing by itself: a person reads it. | 90 days, or until one of the two accounts is deleted |
| Only if you have a username and did not turn off "Show my name in clips": your username and the tiles you took in the last 12 hours, for the clips we make of the game, and which of our posts name you | Naming the top players of each clip on TikTok and YouTube, and telling you in the game that a clip names you | Which account a name in a clip is: 3 days. That a post names you: 7 days, or until your account is deleted. A posted clip stays on TikTok and YouTube. |
The text, the photos and the videos of a suggestion or a bug report stay after your account is removed from them. Do not write personal details in one, and do not show any in a photo or a video.
Tiles you hold stay on the map with their flag until someone takes them. The map records a flag per tile, not who clicked it.
The legal basis for all of this is our legitimate interest in running a fair game and keeping it safe from abuse, and, for the clips, in showing the game to new players. You can object to the clips at any time: open the menu, then Account, and turn off "Show my name in clips".
What stays in your browser
Your browser keeps some settings in local storage: the country you play for, your sound settings, and your chat name and id. They are not sent to us, except the chat name and id when you post a message. Clearing your site data removes them.
Cookies
We set one cookie, cp_sid, which holds your account. It is strictly necessary to play:
we do not use it for advertising or analytics. When you sign in, it lasts 30 days after your last visit.
While you sign in, we also set cp_oauth for 10 minutes, to check that the sign-in you finish
is the one you started. We use no tracking or analytics cookies.
Who else sees your data
- Cloudflare delivers the site and runs Turnstile, the check that you are not a bot. Cloudflare processes your IP address and browser details to do this. Cloudflare Web Analytics also counts page views, where visitors come from and how fast pages load, without cookies. If you sign in with your email address, Cloudflare also sends the email with your code, so it sees the address and the email. If you attach a photo or a video to a suggestion or a bug report, Cloudflare stores the file for us. See Cloudflare's privacy policy.
- Google Fonts serves the fonts the page uses, so your browser asks Google for them. See Google's privacy policy.
- Google and Discord, only if you sign in with them. That service sees that you sign in to ClickPlanet, and sends us the data in the table above. See Google's privacy policy and Discord's privacy policy.
- Everyone playing sees chat messages: the name, the text, the flag, and a short tag made from a salted hash of your IP address. The tag does not reveal your address. They also see how many people gave each reaction to a message, but not who.
- Everyone watching our clips on TikTok and YouTube sees the usernames of the top players of each clip and the tiles they took in it. The files a clip is made from are public on GitHub for one day: they hold the usernames of the players who took tiles in the last 12 hours and which tiles they took, never an account, an email or an IP address.
The Discord, TikTok, Instagram and Buy Me a Coffee links are plain links. Nothing is sent to those services until you click them. We do not sell your data.
Google user data
If you sign in with Google, we ask Google for two things only: the id Google gives your account, and your email address with whether Google has verified it. We do not ask for your name, photo, contacts or any other Google data.
- How we use it: the id finds your ClickPlanet account when you sign in again. The email is kept only if Google says it is verified. It finds the same account when you sign in with that address another way, with an email code or with Discord, and lets us contact you about your account if we need to.
- Who we share it with: nobody. We do not sell it, we do not use it for advertising, and we do not use it to train AI models.
- How long we keep it: until you delete your account. Deleting it removes the id and the email at once.
ClickPlanet's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Your rights
If you are in the EU, the UK or a place with similar laws, you can ask to see, correct or delete the data we hold about you, or object to how we use it. If you signed in, you can delete your account yourself: open the menu, then Account, then Delete account. For everything else we do not know who you are, so email us your IP address and roughly when you played so we can find it. You can also complain to your data protection authority.
Children
ClickPlanet is not aimed at children under 13, and we do not knowingly collect their data.
Changes
If we change what we collect, we update this page and the date at the top.
Contact
Email privacy@clickplanet.lol. You can also ask on our Discord, or message @raphael_oester on X.