Your data, in plain words

Last updated: November 13, 2026

What we collect

When you create an account, we save your email address, your language, how you found us (for example, a link on TikTok) and when you signed up. If you choose a detective name, we save it with your account. While you play, we save your progress: chapters, answers, hints, score, play time and your case board, including the notes you write. In a team room, we also save the members, their votes and the chat messages, which the other members of that room can read. If you joined our earlier waitlist, we also keep that signup. If you sign in with Google, Google shares your name, email address and profile picture with us, and we keep them with your account. Some cookies are needed to keep you signed in and remember your language. Statistics cookies (PostHog) are used only if you accept them in the cookie notice. We use no advertising pixels.

Visitor statistics

We count visits with Vercel Web Analytics, which uses no cookies and cannot identify you. If you accept statistics cookies, we also use PostHog (servers in the United States) to see how the site is used: pages viewed, clicks, where you came from, your browser and device, and steps such as creating an account or opening the checkout. This can include recordings of how you move through pages, with everything you type hidden. If you are signed in, this is linked to your account number (not your email). If you refuse, PostHog is not loaded. You can change your choice at any time with “Cookie settings” at the bottom of every page.

Why we collect it

To run your account and your game, to send your sign-in links, and to tell you about new cases and news about Exhibit Nine. To stop receiving news, email hello@exhibit9.com.

Payments

If you buy a plan, Paddle, our reseller, takes your payment and billing details (name, card, address for tax) under its own privacy policy at paddle.com. We never see your card. Paddle tells us which plan you bought, its status and renewal date, and your Paddle customer number, and we save these with your account.

Where it is stored

Your data is stored by Supabase, our database provider. Sign-in emails are sent through Resend. Sign-in with Google is provided by Google. The website is hosted by Vercel. Visitor statistics are processed by PostHog in the United States, under standard contractual clauses for data protection. Payments go through Paddle. Each processes data under its own security and privacy terms. We never sell your data, and we share it with no one else.

How long we keep it

Until you ask us to delete your account, which also deletes your progress. Earlier waitlist signups are kept until you unsubscribe or ask us to delete them.

Your rights

You can ask to see, correct or delete your data at any time. Email hello@exhibit9.com and we will do it within 30 days. If you are in the EU or UK, you can also complain to your local data protection authority.