Your data
Privacy
What RAREFIND stores about you, why, and for how long. The short version: no ads, no analytics, no tracking cookies. We keep what the game needs to work: your games, your answers and, if you create one, your account.
Last updated: 15 October 2026
Who is responsible for your data
RAREFIND is a game by AFKGame, 30 N Gould St, Ste N, Sheridan, WY 82801, United States. AFKGame decides how your data is used for the game and is responsible for it.
For any question about your data, write to contact@afkgame.group, from the email address of your account when it is about that account. The address our game emails are sent from is not read. Full details are on the Legal notice page.
When you play
Looking at the home page stores nothing about you. When you start your first game, or open the account panel, our server gives your browser a guest cookie: a random identifier with a signature, and nothing else. It is how the server knows which games are yours, so the game cannot work without it.
For each game we store, in our database:
- the day, whether it is the daily or a bonus game, and the questions it uses;
- for each question: the country you pinned (or that time ran out), when the question opened, how long you took as measured by our server and by your browser, and the points you scored;
- whether the game was played by a guest identifier or by an account.
Your answers are checked by our server one question at a time; your browser never receives the list of valid answers before you answer. Your statistics (streak, best score, countries found) are calculated from these games.
Unlimited mode (Premium) stores each dive with your account, never with a guest identifier: when it started and ended and why, its lives, depth and score, and for each question the country you pinned (or that time ran out), when it opened, how long you took, the points you scored and the life won or lost. Your best dives are calculated from them. Dives do not count in the statistics of the daily.
Statistics everyone sees
For every question of the daily, we count how many players picked each country, and for every daily, how many players reached each score. These counts contain no identifiers. They produce the "x% of players picked it" and "Top x%" lines, which are only shown once at least 20 players have answered. No one else can see your own answers, your name or your email address.
Accounts
An account is optional. You can create one and sign in with a code or link sent to your email, with a password, or with Google. Accounts are handled by Supabase Auth, part of the database service we use. It stores your email address, the date you joined and when you last signed in, and, if you set a password, a one-way hash of it (never the password itself).
Google sign-in asks Google only for your basic profile: your name, email address and profile picture. Supabase stores them with your account. We never ask for access to your Gmail, contacts, files or anything else.
When you sign in on a browser where you played as a guest that day, that day's guest game is normally added to your account. Your account then keeps your games on all your devices.
Krillion gift
If you link a KRILLION account to get Premium at no extra charge, we email a short code to the address you enter. We store that address and a keyed hash of the code, never the code itself; the code expires after 10 minutes. Once you confirm it, we ask KRILLION's systems whether that email has an active paid subscription. We then store the link between the two accounts (the KRILLION account identifier and its email address) and check the subscription again regularly while you use RAREFIND. Unlinking ends the link. Nothing about your RAREFIND games is shared with KRILLION.
Emails
Sign-in codes and links, password resets, gift codes and account emails (for example: your trial has started, your trial ends soon, a renewal is coming, a payment failed, your subscription is cancelled, your gift is linked) are sent through Resend, an email delivery service. Your email address and the message pass through Resend to reach you. We keep a record of the account emails we send, so the same email is never sent twice. We send no newsletters and no marketing emails.
Cookies and browser storage
RAREFIND sets only these cookies, all of them needed for the site to work, sent only to rarefind.io and hidden from scripts:
| Cookie | What it holds | How long |
|---|---|---|
rarefind_guest | A random, signed guest identifier | 1 year |
rarefind_session | Your sign-in, encrypted. Only when you are signed in | 30 days, renewed while you play; deleted when you sign out |
rarefind_google | A one-time check that protects Google sign-in against forgery | 10 minutes, during Google sign-in only |
Your browser keeps your sound setting, whether you have seen the starting instructions, and the last state of today's home screen without your email address. During an Unlimited dive it keeps the dive identifier for that tab, so a reload can bring you back. During payment or Google sign-in it keeps a short reference to confirm the result when you return.
After you ask for an email sign-in code, that tab also remembers the email address and delivery times. It uses them to restore the form for up to one hour, and clears them after sign-in or sign-out. Passwords, codes and sign-in tokens are never saved in these browser-storage items.
There are no third-party cookies. The map, fonts and everything else on the page come from rarefind.io itself.
Servers and logs
Traffic to rarefind.io passes through Cloudflare, which protects the site and, like any network provider, sees your IP address. Our database runs on Supabase.
Our web server's access log records, for each request, your IP address, the time, the page or file requested without its query string, the result and your browser's user agent. It is kept for a limited time for security and troubleshooting. Sign-in links, codes and payment references are never written to it.
For sign-in and payment troubleshooting, a separate service event records the operation type, response status and time taken. It contains no email address, account identifier, code, payment reference, cookie or IP address.
IP addresses are also used, in memory only, to limit abuse such as repeated sign-in attempts. If the game hits an error in your browser, it may send us a short technical description of the error, without your IP address, so we can fix it.
What we do not do
- No advertising, no analytics, no tracking pixels and no third-party scripts.
- No selling or renting of data, and no profiling.
- No public profiles: other players never see your name or email address.
How long we keep data
- Guest games that never become part of an account are deleted after 30 days, and so is a guest identifier that has not been used for 30 days.
- Accounts, their games, their Unlimited dives and their billing records are kept while the account exists, and deleted with it.
- Statistics (the anonymous counts above) are kept to show the history of each daily.
Your choices and rights
- You can play without an account.
- Deleting this site's cookies removes the guest identifier from your browser; its games are then deleted by the 30-day clean-up.
- Signing out ends the session on this browser. Other devices stay signed in until they sign out.
- You can cancel Premium or unlink a Krillion gift at any time from your account.
Depending on where you live, laws such as the GDPR give you rights over your data, including access, correction and deletion. To exercise them, account deletion included, write to contact@afkgame.group from the email address of your account; there is no self-service way to do it yet.
When this page changes, the date at the top changes too.