Privacy policy

MYSTERY CREW is built to know as little about you as possible. This page says exactly what we process, why, and what your rights are. Last updated: 20 September 2026.

Who is responsible

mysterycrew.games is operated by AES Tech AB (org. nr 559507-2157), Stockholm, Sweden. For anything about your data, write to [email protected] — including requests to access, correct, export, or delete anything listed below.

Playing a game

No accounts, no profiles, no advertising, no tracking cookies. The name you type in a game is visible to your crew, lives in server memory only for that room, and is deleted when the room expires (at most 12 hours). Your browser keeps one small local entry so a refresh returns you to your seat; it references only the room code and expires with it. This functional storage is required for the game to work (legitimate interest, GDPR Art. 6(1)(f)); nothing in it identifies you.

Optional witness questions

In cases with AI-assisted witnesses, the host can switch AI replies on or off. When enabled, the question you submit is sent to Google Gemini with limited fictional accounts to compose and check an in-character reply. We do not attach your player name, room code, game credentials or private clue cards. Avoid including personal information in questions. Google processes submitted text under its Gemini API terms; using the prepared questions does not send text to Google.

Typed questions and generated replies are held temporarily in server memory to display the shared conversation, and are not written to our gameplay logs or room snapshots. The room retains an authored summary of the selected account and its topic for your crew's case log. With AI switched off or unavailable, prepared replies remain available and every puzzle can still be completed.

Game statistics

We record anonymous, aggregate gameplay events — rooms created, puzzles solved, task durations, wrong answers as typed into the puzzle field, and device family (for example "Android/Chrome, 390px wide") — to fix and improve the cases (legitimate interest). These events contain no names, no free-text chat or notes, and no identifiers that could follow you across visits. They cannot be linked back to you, which also means they cannot be individually deleted — there is no way to know which events were yours.

Optional case feedback

After a case, you can tell us whether you would play another and leave an optional comment. We keep these responses privately on our game server with the case, ending, content version and room code, to improve the games. A random identifier scoped to your seat in that case prevents duplicate responses; it cannot follow you into another game. Feedback is not shown to your crew or sent to our analytics provider. We also count how many phones load the feedback form. Please leave out names, email addresses and other personal details. To ask us to remove a response, contact us with the room code and approximate date.

The waitlist

We also count when a waitlist form becomes visible and whether its submission succeeds or fails, separated by the landing page and the end of a game. These statistics contain no email address, player name or submission text. A temporary random form identifier groups retries; it is not stored in your browser or reused across visits. End-of-game form events include the case attempt, so we can measure whether crews want another mystery. Actual subscription records remain with MailerLite.

If you join the waitlist you give us your email address for one purpose: emails about new MYSTERY CREW cases, including subscriber launch offers (consent, GDPR Art. 6(1)(a), given via the signup checkbox; we keep a record of when and how consent was given). Delivery runs through MailerLite (MailerLite Ltd, an EU-based processor) — your address is stored there, not on our game servers. Every email carries an unsubscribe link; unsubscribing removes you immediately, and you can also write to [email protected] to have your address deleted — including if someone entered your address without your knowledge.

Buying a case

Paid cases are sold through Polar (Polar Software Inc., USA), which is the seller and runs the checkout. Polar collects what a purchase needs — your email, name, billing country or address and payment details — and handles it under its own privacy policy, including safeguards for transfers outside the EU. We never see your card details.

Through Polar we can see your order: email, name, country, the case bought, the amount and your licence key. We use this only to deliver the purchase, answer support requests, resend a lost key and handle refunds (performance of the contract, GDPR Art. 6(1)(b)), and keep it no longer than those purposes and our legal obligations require.

When a host enters a key, our server checks it with Polar. The host's browser remembers a key that worked, only on that device, so the next game night starts with it filled in; clearing this site's data removes it. The key stays with that room on our server until the room expires (at most 12 hours), so a restart does not cost you the lobby. Separately we keep a record, identified only by a one-way hash of the key, of which nights it has used — so a crash or restart never charges your crew a second night. That record contains no name or email; once your key is used up you can ask us to delete it. Game statistics only ever see a short, irreversible fragment of that hash.

Hosting and logs

Pages, fonts, images and sounds are served from our own server; browsing the site loads nothing from third parties. Our servers keep short-lived technical logs (IP address, request time) as every web server does, for security and abuse prevention (legitimate interest). They are not combined with gameplay data and rotate automatically.

Your rights

Under the GDPR you can ask for access, correction, deletion, portability, or restriction of your personal data, object to processing based on legitimate interest, and withdraw consent at any time — email [email protected]. You also have the right to complain to your local data-protection authority.

Children

The games are family-friendly, but the waitlist is not intended for children under 16; we do not knowingly collect their emails.

Questions and feedback

Privacy matters go to [email protected]; bugs, feedback, and everything else to [email protected] — we read all of it.

Changes

If this policy changes, the date at the top changes with it. The Marlowe Hotel keeps its secrets; we would rather not keep yours.