Privacy policy

Escapify is designed to be used in class with as little data as possible: there are no accounts, the only cookie remembers the language you choose, and we use no analytics or advertising tools. This policy explains what data exists, where it is, how long we keep it and what you can do about it.

Summary

• Your library stays in your browser. The locks you create don't leave your device until you choose to publish one.
• Published locks are stored in the European Union and deleted once nobody has opened their link for 24 months.
• Students don't need accounts and give us no personal data.
• We don't store IP addresses or use analytics in the browser, and the only cookie remembers the language you choose.

Data controller

The controller of your data is Still to be completed: [CONTROLLER NAME] · [NIF] · [ADDRESS]. For any privacy question, write to us at contact@escapify.io.

What data we process

Your library and your preferences (only in your browser)

The locks, tags and edit keys you create are stored in your browser, as are your display, sound and print preferences. They never reach us: we can't see them or recover them. Below we explain what Escapify stores on your device.

Published locks

When you publish a lock, or print it with a QR code, we store in our database, located in the European Union:

• the lock's content: title, kind and settings, language, clue, answer and alternative answers, hints, success message and continue link;
• a fingerprint (hash) of its edit key, from which the key cannot be worked out;
• the date it was published, the date it was last changed and the last day someone opened the link.

We don't store who published the lock or where from. Anyone with the link can see the title, the clue and the instructions; hints reach them only if they ask, and the success message and continue link only after a right answer. The answer never leaves our server.

When someone plays, we check their answer on the server and discard it: we don't store what they type. We only keep totals, without IP addresses or identifiers, of how often each link is opened, how many attempts are made and how often it is solved.

Reports

If you report content, we store the reported link, the reason, your message, the date and, only if you give it to us, your email address so we can reply. We also receive an email notice with those details.

Technical data and security

As with any internet connection, your browser sends our server technical data such as your IP address. We use it only briefly, to limit how many publications, attempts and reports can be made in a row (so nobody can brute-force answers or overload the service) and for the anti-spam check. We don't store it.

If something goes wrong on the site, your browser sends us an error report with the message, the part of the site where it happened (never the full address you were visiting), the Escapify version and the browser's major version. It contains no IP address and no identifier.

Anti-spam check with Cloudflare Turnstile

When you publish or update a link and when you send a report, we use Cloudflare Turnstile to check that the request comes from a person and not an automated program. To do so, Cloudflare analyses technical data from your browser and your connection, such as the IP address. The Turnstile privacy addendum (opens in a new tab) explains how Cloudflare handles it.

If you write to us

If you email us, we use your address and your message only to reply to you.

Storage on your device

Escapify uses a single cookie, its own, to remember the language you choose, and no third-party or tracking cookies. Because that cookie is needed for what you ask it to do, we don't ask you to accept it. It also uses your browser's storage for what you ask it to do:

• One cookie, escapify-locale: the language you choose with the language switcher or the language hint (en or es), so that the home page opens in that language next time. It lasts a year. Your browser sends it to escapify.io, but our server only reads it to open the home page, and doesn't store it.
• Local storage (localStorage), three entries:
  • escapify:prefs: your display preferences (theme, contrast, text size, animations and font), whether you want sounds, your print options, whether you closed the language hint and whether you accepted the notice shown before you publish a lock.
  • escapify:library: how you view the library (as cards or as a list), whether you closed the notice that it is stored in this browser, and until when you put off the reminder to make a backup.
  • escapify:share: a fingerprint (hash) of what you last published under each link, to tell you when you have changed a lock since you published it.
• Browser database (IndexedDB), named escapify-library: your library, that is, your locks, their tags and the edit keys of the links you have published. It also keeps the date of your last backup, how many changes you have made since, and any damaged records that could not be read, so that you can download or delete them.
• Session storage (sessionStorage), two entries, deleted when the tab is closed and never stored on our server:
  • escapify:play-session: a random identifier of the tab in which a lock is played, sent with every answer to limit attempts. It doesn't reveal who is playing.
  • escapify:room-play: how far you are in a room played from one link (the lock you have reached and the proof that you opened the one before, when you started, for the countdown, and whether you hid it), so that a reload takes you back there.

None of this leaves your device, except what you publish and the language cookie, which only serves to open the home page in your language. You can delete it at any time from the library, or by clearing this site's data in your browser settings.

Escapify doesn't load fonts, scripts or images from other websites either. The only exception is Turnstile, in the cases explained above.

Why we use data and on what legal basis

• Publishing your locks and keeping their links working, because you ask us to when you publish: it is necessary to provide the service to you (Article 6(1)(b) GDPR).
• Protecting the service: usage limits, the anti-spam check and error reports, based on our legitimate interest in keeping Escapify secure and working well for everyone (Article 6(1)(f) GDPR).
• Handling reports and moderating content, to meet the obligations of a hosting service under the Digital Services Act and the Spanish Information Society Services Act, LSSI (Article 6(1)(c) GDPR).
• Answering your messages, because you ask us to (Article 6(1)(b) GDPR).

Who else processes the data

Cloudflare, Inc. hosts the website and the database, provides the Turnstile service and forwards the emails sent to our escapify.io addresses to our inbox. It acts as a processor, following our instructions.

The database is in the European Union. Because of the way its network works, Cloudflare may process technical connection data, such as the IP address, in data centres outside the European Economic Area. When it does, it applies the safeguards the GDPR requires, such as the European Commission's standard contractual clauses.

We don't sell data or pass it on to anyone, unless a law or a competent authority requires us to.

How long we keep it

• Published locks: up to 24 months after the last time someone opened the link. If you take a link down, or we block it after a report, we delete its content straight away; only a minimal record (the link's identifier and status) remains, so the link can say it is no longer available.
• Reports: 24 months.
• Moderation log: as long as needed to show that we met our legal obligations.
• Error reports: a few days, in the server logs.
• Emails you send us: as long as needed to deal with your request.
• IP addresses: we don't store them.

Children and students

Escapify is designed to be used by teachers. Students, who may be children, only play: they need no account, we ask them for no data and we don't store what they type. While they play, the only things that reach our server are their answer attempts, which we check and discard, and the technical connection data described above.

As a teacher, don't put personal data about your students or anyone else in your locks: no full names, no marks or grades, no contact or health details. Remember that anyone with the link can see what you publish.

Your rights

You can ask us for access to your data, to correct or erase it, to restrict or object to its processing, or for its portability, by writing to contact@escapify.io.

As there are no accounts, we don't know who published each lock: if your request is about a published lock, tell us its link. You can also take a link down yourself at any time from Escapify.

If you think we haven't handled your request properly, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos (opens in a new tab)).

Changes to this policy

If we change this policy, we will update this page and its date. If the change is significant, we will announce it on the site.