Privacy policy.

Who is responsible?

Meso at playmeso.com is operated by Conor Dalgarno, trading as Dustlight, who is the controller responsible for the personal information described here.

For privacy questions, a copy of your information or an account-deletion request, email hello@playmeso.com.

Information we use

Your game and journal

Meso saves expedition dates, guesses, clues revealed, results, discoveries, dated Daily stamps, roster choices and related save timestamps. Guest progress stays in your browser. When you sign in, your journal is linked to your account identifier and saved online. Games you play while signed in can then resume on another device.

Your account

Supabase provides our account and sign-in service. It handles your email, account identifier, sign-in method, session information and authentication records. For email/password accounts, passwords are submitted to and managed by Supabase Auth; they are not stored in Meso’s journal database. Account confirmation, recovery and email-change messages are service emails.

Signing in with Google

If you choose Google, Google supplies an account identifier, email and basic profile information, which can include your name and profile picture, to Supabase for authentication and account linking. Meso uses the resulting account identity to sign you in and connect your journal. We do not receive your Google password or request access to your Gmail messages, contacts or Drive files.

Google also processes your sign-in under its own privacy policy. You can remove Meso’s access in your Google account settings; removing that access does not by itself delete your saved Meso account or journal.

Reports, suggestions and contact messages

We receive the text and type of your report, its submission time and reference, and an optional reply email. A report includes limited context: roster and puzzle mode, game status, guess and clue counts, selected branch or journal entry, game version, browser information and screen size. The report form does not automatically attach your full journal, account identifier, sign-in tokens, typed guess draft or the hidden answer. Information you type into the message is part of the report.

To limit repeated reports, we derive a day-specific rate-limiting key from the request’s IP address. Meso’s report table stores that key rather than the raw IP address.

Technical requests

Hosting and authentication providers process information needed to deliver and secure the service, such as IP addresses, request times, browser details and security or authentication logs. This also applies when you browse or play without an account.

Why we use it

We use account and journal information to provide the game and account-saving service you request. Our lawful basis is performance of that service contract, including steps you ask us to take to create an account.

We use reports, correspondence and proportionate technical or security information for our legitimate interests in answering players, correcting the game, keeping it reliable and preventing abuse. We consider players’ rights when using this basis. We may also retain or disclose limited information where necessary to comply with a legal obligation.

You can play without creating an account. An email or supported sign-in identity is needed to provide an account; a reply email is optional when sending a report. We do not use your information to make automated decisions with legal or similarly significant effects. Automated puzzle feedback and discovery records are game features.

Browser storage

Meso uses browser local storage to remember your guest journal, game preferences, account-specific journal copies and sign-in session. This allows progress to survive a refresh and lets signed-in saving recover after a connection problem. Local storage is covered by storage and access rules just as cookies are.

These uses provide the game, settings and sign-in functions you request. Hosting providers may also use necessary security technologies. Meso does not currently use advertising or marketing tracking; we will provide appropriate controls before introducing storage that requires consent.

Signing out ends the current sign-in but can leave device copies of progress. Clearing this site’s browser data removes those copies and your remembered sign-in. It does not delete progress already saved to your account. You can block browser storage, but saved progress and sign-in may then fail to work.

Who receives information?

• Supabase: account identity, authentication, session management and related account services.
• Cloudflare: hosting, delivery and security, and the databases holding account-linked journals and private player reports.
• Google: when you choose Google sign-in.
• Namecheap Private Email: our support mailbox receives and stores correspondence, including your email address and message when you contact hello@playmeso.com.
• Resend, when enabled: delivers service emails and report notifications. Report notifications contain your report, limited game/browser context and an optional reply address; account emails contain the address and information needed for the account action.
• Wikimedia: some illustrated entries and groups load images from Wikimedia servers. Your browser sends the request information needed to fetch those images, which can include your IP address and browser details.

Account information, journals and report messages are not published as public player profiles or a public report list. Access is limited to operating, supporting and securing Meso, and to providers processing information for those services. We may disclose information where legally required or necessary to protect rights and security.

If you follow a research link to another website, that site’s own privacy practices apply.

International processing

Our providers operate internationally, so information can be processed outside the UK, including in the United States and Singapore. Supabase hosts core authentication data in the region selected for our project; support and operational processing can occur elsewhere. Cloudflare uses a global network.

Where restricted transfers require safeguards, the providers’ data-processing terms include standard contractual clauses and the UK addendum where applicable. Their current terms and processing information are available from Supabase, Cloudflare, Namecheap and Resend. Information about the email providers is available from Namecheap and Resend. Email us if you would like details or a copy of the safeguards relevant to your information.

How long information stays

• Browser copies: remain until you clear them, your browser removes them, or they are replaced as you play.
• Account and journal: kept to maintain the account and discovery history you choose to keep, until you request deletion. Accounts do not currently expire automatically through inactivity.
• Reports and correspondence: kept while needed to investigate, respond, record a resolution or handle related security issues. This includes copies in our support mailbox and email delivery services when used. We review the need for identifying details when that purpose ends. Reports have no automatic expiry in the current version.
• Logs and backups: follow the relevant providers’ retention settings and deletion cycles. Limited copies can remain in backups until those cycles complete; they are not used as an active player journal after deletion.

We may keep limited information longer where required by law or necessary to deal with an unresolved dispute or security incident.

Your choices and rights

You can play as a guest, sign out, change your email or password where supported, and clear local browser data. To request access, correction, deletion, restriction or a portable copy of information, contact hello@playmeso.com. These rights depend on the circumstances and applicable law; we may need proportionate information to verify the request. Account deletion requests are handled through this contact address rather than a self-service button.

You can object to uses based on our legitimate interests. Email us to explain the circumstances you want us to consider. If a future optional feature uses consent, you will be able to withdraw that consent without affecting earlier lawful use.

A parent or guardian can contact us about a younger player’s information. Please include only the information needed to explain your request.

You can also complain to the UK Information Commissioner’s Office, or the relevant data-protection authority where you live.

Changes to this policy

We will update this page when Meso’s practices change and keep the date above current. Material changes will be explained before new uses begin. Future games, advertising or premium features may need additional information; this policy describes Meso’s current service.