Privacy policy
This page describes what rhymefor.fun actually does with your data. It is written against the code that runs the site rather than from a template, so where it says something is not collected, it is not collected.
Who is responsible
The controller of your personal data is Vladyslav Kvochkin, an individual in Switzerland, operating rhymefor.fun.
For anything on this page — access, correction, deletion, or a complaint — write to [email protected]. Mail to that address is read.
What is collected, and why
You can play in English without an account. If you do, none of the account data below exists for you — only the anonymous identifier and the rounds attached to it.
| Data | What it is | Why it is allowed | How long |
|---|---|---|---|
| Account | Your email address. If you sign in with Google, also the name and profile picture on that account. | Performance of a contract — there is no account without it. | Until you delete your account. |
| Sign-in links | A single-use token tied to your email address. | Performance of a contract. | Expires shortly after it is issued, then deleted. |
| Emails we send you | Your email address, and a record of which emails were sent to it and when. No opens or read receipts are tracked. | Legitimate interests: telling you about a service you signed up for. Every message carries a one-click unsubscribe, and unsubscribing stops all of them immediately. | Until you delete your account. |
| Subscription | Your email address, the Stripe customer and subscription identifiers, the plan, its status and its renewal date. No card details are stored here. | Performance of a contract, and legal obligations for business records. | Until you delete your account. Stripe keeps its own payment records for as long as the law requires of them. |
| Rounds you play | The beat, language, difficulty and rhyme scheme of each round, the words generated for it, and when it happened — linked to your account, or to the anonymous identifier below if you are signed out. | Legitimate interests: showing you your own history, and understanding which parts of the game work. | Until you delete your account. |
| Product events | A short record of a few significant moments — for example, being shown an upgrade prompt — linked to your account or anonymous identifier. It also records how you arrived: the page you landed on, the address of the site that linked you, and any campaign parameters in the link. | Legitimate interests: understanding whether the product works, and which ways of describing it bring people who stay. | Until you delete your account. |
| Lesson progress | Which lessons you have read and which drills you have finished, and when — linked to your account, or to the anonymous identifier below if you are signed out. | Legitimate interests: showing you where you got to. | Until you delete your account. |
| Feedback | Anything you type into a feedback form, plus what you were doing at the time. | Legitimate interests: acting on what you tell us. | Until you delete your account. |
| Time zone | The time zone your browser reports. | Legitimate interests: so a daily allowance resets at your midnight and not someone else’s. | Until you delete your account. |
| Anonymous identifier | A random identifier in a first-party cookie, so signed-out play still shows you your own history. It is not linked to a name, and it is claimed by your account if you later sign in. | Legitimate interests: making the game usable without an account. | Up to 400 days in your browser; clearing cookies ends it. |
| IP address | Your IP address is read to rate-limit abusive traffic — the sign-in endpoint in particular, after a bot flood in June 2026. | Legitimate interests: keeping the service up. | Held in memory only, for minutes, and never stored in the database. Cloudflare keeps its own logs under its policy. |
What is not collected
- No advertising, no tracking pixels, no third-party analytics, and no session recording.
- No card details. Payment happens on Stripe’s own checkout page; this site never sees a card number.
- No microphone access and no recordings. The game never listens to you — it shows words on a beat, and what you say stays in the room.
- No personal data is sent to the language models that generate rhymes. Rhymes are generated in advance into a vetted pool and served from the database, so nothing about you is in the request.
Who else sees it
Google (Sign in with Google)
Signing you in, if you choose that option.
Your email address, and the name and profile picture on your Google account.
Their privacy policyResend
Delivering the sign-in link when you use email.
Your email address and the link itself.
Their privacy policyBrevo
Delivering emails about the game — a welcome, and occasional reminders.
Your email address, and whether the message was delivered, bounced or reported as spam.
Their privacy policyStripe
Taking payment and managing subscriptions.
Your email address and your payment details, which you give to Stripe directly — they never reach this site.
Their privacy policyCloudflare
DNS, content delivery, bot protection, and forwarding mail sent to the address above.
Your IP address and request metadata, in transit.
Their privacy policyYouTube (Google)
Playing a beat you supply from YouTube. This only happens if you choose a YouTube beat; the player is embedded from YouTube and they may set their own cookies.
Whatever YouTube collects from an embedded player, under their own policy.
Their privacy policyServer hosting
Running the site and its database. The database is reachable only from the server itself.
Everything listed in the table above, at rest.
Data may be processed outside Switzerland and the EEA by the recipients above, under their own safeguards. Nothing is sold, and nothing is shared for advertising.
Your rights
You can ask for a copy of your data, ask for it to be corrected, ask for it to be deleted, object to processing based on legitimate interests, and complain to a supervisory authority — in Switzerland the FDPIC, or your local authority in the EEA.
Deletion is immediate and self-service. Open Settings and delete your account. That removes your account, sign-in records, subscription record, time zone, rounds, product events and feedback from the database — not a flag, an actual delete. Stripe keeps its own payment records for as long as the law requires of them.
Cookies
Only first-party cookies, and only functional ones: an anonymous identifier so signed-out play can show you your own history, and — if you sign in — a session cookie and a security token that prevents cross-site request forgery. There are no advertising or analytics cookies, which is why this site does not ask you to accept any.
Choosing a YouTube beat embeds a player from YouTube, which may set its own cookies under Google’s policy. Not choosing one avoids that entirely.
Children
This service is not directed at children under 16. If you believe a child has given us personal data, write to the address above and it will be deleted.
Changes
If this policy changes materially, the date at the top changes with it. Where a change affects how your data is used, it is announced in the product before it takes effect.