Privacy policy

The short version

Who we are

Shorgol (shorgol.me) is run by Shorgol, Dhaka, Bangladesh. In this policy "we" means Shorgol and "you" means anyone using the website or the Android app. The app is the same website in a full-screen window, so this policy covers both.

What we keep

In every game: anonymous tallies

When a game ends, a few numbers go up: how many people played, how many picked each answer or district, how many tapped a share button. These tallies don't record who played. They're where lines like "only 6% of people remember this" come from. We don't show a percentage until at least 300 people have played.

A couple of games keep a little more, still anonymously: in "where are you from?" (কই থেকে তুমি?) you may tell us which region you're really from, and in the age guesser (বয়সচোর) you may tell us how close the guess came (such as "within a year or two"). This helps us make the games more accurate. We never ask for a date of birth.

Games played with friends through a link

In the games played through a link, such as "who knows me best?", the tour poll or the group awards, and in the pranks, someone makes a link and friends play it. To show who said what, we have to keep:

• the name the link's maker gave and their own answers;
• the names friends give (some games take no names at all), their answers and when they answered;
• a hash of a secret key that proves who made the link, and a hash of a token for each answer so whoever gave it can delete it. We don't keep the keys themselves;
• whether the link was made from another link (to see how far a game spreads).

A name can be anything; it doesn't have to be a real name. Names can't contain links or emoji, and nobody can type free text beyond names.

Pranks

In the love calculator, the link's maker sees the two names typed only after five minutes. Whoever typed them learns straight away that it's a prank and exactly what the maker will see, and can delete it within those five minutes. Every story in "Shorgol News" is written by us and is obviously silly; nobody can write their own, and the page owns up to being a prank within ten seconds.

Notifications

A link's maker can turn on notifications to hear when friends answer. Their browser then gives us a "push subscription" (an address notifications can be sent to). It's stored with that link and deleted with it. It doesn't identify you.

Reports

When someone reports a link, we keep the reason they picked, when, and a hash made with a secret key that tells one reporter from another on that link, so one person can't report it many times. Your address can't be worked out from it.

How the site is doing

To run the site we keep daily totals: pages viewed, visits, where visits came from (such as Facebook, Google, or typed in directly) and what they came on (such as Android, iPhone or a computer). We don't keep the full address of the page you came from, only that rough category.

So that a person counts once a day, your address and browser name are hashed with a random key that only ever exists in the server's memory and is replaced every day. These hashes are never written to disk and are useless the next day.

What we never keep

• Phone numbers, email addresses, dates of birth, home addresses or any government ID.
• Your photos. Share images are made on your phone and never reach our server.
• IP addresses. They're used in memory for a few minutes to stop scripts from repeating the same action thousands of times, and then forgotten.
• Your location, contacts or anything from other apps.
• Advertising IDs or other companies' trackers. The site loads no outside ads or tracking scripts, and even the fonts come from our own server.

What stays on your phone

We use no cookies for players. A few things are kept in your browser's own storage (localStorage and sessionStorage), on your phone only:

• the keys of links you made, so you can come back and see the answers;
• the tokens of answers you gave, so you can delete them;
• a mark so the same play isn't counted twice in one sitting, and one that says whether a visit is new.

Clearing your browser's data removes them. Only people who sign in to Shorgol's admin area get a sign-in cookie.

How long we keep it

A link's maker can delete the whole link at any time before it expires, and anyone can delete their own answer.

Who can see it

• A link's maker sees friends' answers, as each game's rules allow. In some games answers have no names.
• In some games, friends see a leaderboard; you choose whether your name shows on it when you play.
• Shorgol's admins see the totals. To check a reported link, they see exactly what anyone opening it sees (the maker's name and the game), not anyone's answers.
• We may have to hand over what we hold if a legal authority lawfully requires it. The less we keep, the less there is to hand over.

We don't sell anyone's data and we don't give it to advertisers.

Other services involved

• Hosting and network: the site runs on a rented server and may sit behind a content delivery network for speed. They only deliver the site.
• Notifications: notifications are delivered by your browser's own push service (Google on Android, for example). The message is encrypted.
• When you share: tapping a Facebook or WhatsApp button opens their site, where their policies apply. You decide what to share.
• The Android app: if you install it from Google Play, Google Play's own policies apply to that. Inside the app, Shorgol collects nothing extra.

Children

Shorgol is fun for everyone but isn't made for children under 13. Under 13, play with a parent or guardian. We don't knowingly collect personal information from children. If you think a child's name or details have ended up on a link, tell us and we'll delete it.

Your choices

• Delete your own answer at any time, from the link's page.
• Delete a link you made, or any answer on it, from the link's inbox.
• Turn notifications off at any time.
• If a link has your name or something about you on it and you want it gone, tap "report" at the bottom of the page or write to us.
• To ask what we hold about you, or to have something deleted, write to [email protected]. Since there are no accounts, telling us which link it is helps us find it.

Security

The whole site runs over HTTPS. Link keys and answer tokens are stored only as hashes, so even someone holding the database couldn't use them to control anyone's link. The admin area needs a password and records who changed what. Still, nothing on the internet is perfectly safe, so don't put anything very private on a link.

Changes

This page changes when games are added or something else changes, and the date at the top changes with it. If we start keeping a new kind of information, we'll say so on the site.

Contact

Questions, complaints or requests: [email protected]. More ways to reach us are on the contact page. If the English and Bangla versions ever differ, the Bangla one applies.