Summitummit

Last updated October 13, 2026.

Summit is made and run by one person: me :) This page says what the game collects, why, where it goes and how to have it deleted.

In short

• You can play without an account. Then nothing kept has your name on it.
• Analytics are off unless you say yes, and you can change your mind at any time.
• An account keeps your name, your email address and your climbs.
• Share links are deleted after 7 days.
• Download my data and Delete my account are in the Menu.
• Nothing is sold, and there are no ads.

Privacy choices

Analytics show me where the game is too hard, too easy or broken. They’re off unless you say yes. What they collect is under Analytics, below.

Who’s responsible

Summit (summitgame.io) is run by just me, a private individual in Estonia. There’s no company behind it. I decide what Summit collects and why, so I’m the “controller” under data protection law (the GDPR). Write to me at info@summitgame.io.

When you play

Every word you submit goes to Summit’s server to be judged. With it go your IP address and a random device id that your browser makes for Summit. The server keeps them only in its memory, for a day at most, to stop anyone flooding the game and to count each player once. They aren’t written to the database or to logs.

Summit also keeps counts that can’t be tied to anyone: how many players tried each climb, how many links finishers needed, which words summited each climb and by how many players, and the day’s scores (for “better than” on the results).

The legal basis is that this is needed to run the game you chose to play, and my legitimate interest in keeping it fair and working.

On your device

Your browser’s storage keeps your climbs, your settings (like the theme), your privacy choice and the random device id. If you sign in, it also keeps your sign-in. All of this is needed for the game to work, so it doesn’t ask first. It stays on your device: clearing Summit’s site data removes it, along with any climbs played without signing in.

If you accept analytics, PostHog also stores a random id in a cookie and in your browser’s storage. If you decline later, PostHog stops and forgets that id.

If you sign in

You sign in with Google. Google tells Summit your name, your email address, your Google account id and your profile picture. Your account then keeps:

• your name and email address, to show whose account it is,
• your climbs and each day’s results, so they follow you to any device,
• your friends and your invite link.

To keep accounts safe, Supabase, which runs the sign-in, also records when you signed in, with your IP address and browser.

The legal basis is that this is needed to give you the account you asked for.

Shares and friends

When you share your results, Summit stores them (your links and how high each word climbed, never the words) behind a share link. If you’re signed in, the share shows your first name. Share links are deleted after 7 days.

Your friends see your first name and your results. They can see today’s only once they’ve finished today themselves.

Analytics

Only if you accept. Summit then sends to EU-hosted PostHog:

• the pages you open,
• what you do in the game: the words you try and how they’re judged, climbs and days finished, Start over, shares, bug reports sent and How to play,
• your browser and device type, and a rough location (country and city) worked out from your IP address,
• a recording of 1 in 10 visits: what happens on Summit’s pages, including the words you submit. Nothing outside Summit is recorded.

If you’re signed in, this is linked to your account’s id, never to your name or email address. PostHog keeps it for 12 months.

The legal basis is your consent. You can withdraw it at any time in Privacy choices; analytics stop at once.

Bug reports and disputes

A bug report becomes an issue in Summit’s private GitHub project. It holds what you wrote, the climb and its words, the page’s address, your browser and device type, and whether you were signed in. Testers’ disputes go to ClickUp, with the same details. Neither carries your name or email address.

The legal basis is my legitimate interest in fixing what you reported.

Errors and hosting

When Summit’s server hits an error, it sends PostHog the error under a random id, never your account or device. Like any website, the services that host Summit see your IP address when your browser connects, and keep it briefly in their logs for security. The legal basis is my legitimate interest in keeping Summit running and safe.

If you write to me or buy me a coffee

If you email me, I keep your email and my reply only as long as needed to help you. If you donate to help keep Summit ad-free, Buy Me a Coffee handles the payment under its own privacy policy, and shows me your name, your email address and any message you leave.

Who handles it

These services handle data for Summit, each under a data processing agreement:

• Supabase: the database and sign-in, in Stockholm, Sweden.
• Fly.io: Summit’s server, in Stockholm, Sweden.
• Vercel: the website, from its worldwide network.
• PostHog: analytics, in the EU, only if you accept.
• GitHub: bug reports.
• ClickUp: testers’ disputes.

Google handles signing in to your Google account under its own privacy policy. Some of these are US companies, so data may reach the US. Their agreements protect it with the EU’s Standard Contractual Clauses or the EU–US Data Privacy Framework.

How long it’s kept

• Your account and its climbs: until you delete the account.
• Share links: 7 days.
• Analytics and recordings: 12 months.
• IP addresses and device ids on Summit’s server: a day at most, in memory only.
• Supabase’s record of sign-ins: up to 7 days.
• Bug reports and disputes: until they’re no longer needed to fix the game.
• Backups of the database: up to 7 days.
• What’s on your device: until you clear it.

Deleting your account

Delete my account, in the Menu, works at once. Your name, email address and Google link go, along with your friends and your invite link. Your shares lose your name. The days you played stay, with nothing that could tie them to you, so the game’s counts stay right. Your analytics, recordings included, are deleted from PostHog shortly after. Copies in backups go when the backups expire, within 7 days.

Your rights

You can ask me to:

• show you what Summit holds about you (Download my data, in the Menu, gives you your account’s data as a file),
• correct it (your name comes from Google: change it there and sign in again),
• delete it (Delete my account, in the Menu),
• stop or limit using it, or object to its use,
• stop analytics (Privacy choices, above).

For anything else, write to info@summitgame.io. I’ll answer within a month. Without an account, Summit keeps nothing with your name on it, so I may not be able to find your data: clearing Summit’s site data removes what’s on your device. If you’re not happy with how I’ve handled your data, you can also contact your data protection authority, or mine: Estonia’s Data Protection Inspectorate.

Children

Accounts are for people 16 and over. Anyone can play without an account. If you’re under 16, please ask a parent before you accept analytics.

Keeping it safe

Everything travels encrypted. Only Summit’s server can read the database, and only I can reach the services behind it. Summit never sees your Google password. If a breach puts your data at risk, I’ll tell the data protection authority within 72 hours, and you too if the risk to you is high.

Changes

If this policy changes, the date at the top changes too. If it changes how your data is used, Summit will say so in the game first. The Terms cover the rest of the rules.