Privacy and cookies
Last updated: 15 September 2026
Phabetia is built to ask for as little as possible: you can play without an account, there are no ads, and no data is sold or handed to anyone. This page says plainly what is stored, where and why, both in the app and on these pages.
Who is responsible for your data
The data controller is Xose de la Paz. For anything to do with your data, write to xose@novadream.com.
What follows describes everything Phabetia does with it. There is nothing else.
Without an account: nothing leaves your device
Phabetia can be used in full without signing up. In that case your progress — levels, coins, streaks, records and settings — is kept only in your browser's local storage and is never sent to any server. Clearing the site's data in your browser deletes it.
The one exception is usage measurement, which only turns on if you accept it (see below).
With an account: what is stored and why
Creating an account is optional and serves a single purpose: keeping your progress on the server and syncing it between devices. For that, the following is processed:
- Your email address, which identifies the account and is also used to recover your password and to confirm that the address exists. Never for notices, news or anything you did not ask for.
- Your password, stored irreversibly hashed. Nobody can read it, us included.
- Your saved game: the same progress that lives on your device, as is, so it can be merged with your other devices.
- A session identifier for each device you sign in from, which expires after a year and which you can revoke by signing out of all devices.
- A public alias, only if you set one: it appears next to your Panic record in each alphabet's ranking, which anyone can see. You can change or remove it at any time from the account screen, and removing it takes you out of the rankings at once.
The legal basis is the performance of the service you request when creating the account (Article 6(1)(b) GDPR).
There is no public profile beyond that optional alias, no name, no photo, no age: nothing else is asked for.
Everyone's figures
From every saved game that is uploaded, a handful of numbers is extracted — answers, correct answers, levels passed, streak days, Panic runs and records — to compute the totals, averages and percentiles shown to all players. Only aggregates are published, with one exception you choose yourself: if you set an alias, your Panic record in each alphabet appears under that alias in the top-ten ranking, which anyone can see. Without an alias none of your figures is shown to anyone.
Those numbers are deleted together with the account.
Security: what is kept for a few minutes
To stop anyone guessing passwords blindly or flooding a mailbox, the server records the IP address of failed sign-in attempts and of email requests, for fifteen minutes at most. It is not an activity log: neither when you sign in nor what you play is recorded. The legal basis is the legitimate interest in protecting the service (Article 6(1)(f) GDPR).
Like any web server, the one hosting Phabetia also keeps a technical access log — IP address, requested address and date — for a limited time and for the same purpose.
Emails
Phabetia sends only two emails, and only when you ask for them: the password recovery one and the address confirmation one. They are plain text, with no images and no tracking. No other email is sent.
Usage measurement (Google Analytics)
To know what gets played, at which level people get stuck and where they come from, Phabetia uses Google Analytics 4, a service of Google Ireland Limited. It only turns on if you accept it in the notice shown the first time; until then nothing from Google is loaded.
If you accept, Google receives technical data about your browser and your use — screens and pages viewed, levels played, IP address, device type — and sets the cookies listed below to tell one visit from the next. Google may transfer that data to the United States under the EU-US Data Privacy Framework. The details are in Google's privacy policy.
The legal basis is your consent (Article 6(1)(a) GDPR), and you can withdraw it at any time, under “Settings” in the app or through the “Cookies” link at the bottom of this page: measurement is switched off and its cookies are deleted immediately. Your choice is kept for a year; after that you are asked again.
Cookies and local storage
Phabetia uses no cookies of its own. What it keeps in your browser is this:
| Name | Whose | Purpose | Duration |
|---|---|---|---|
| phabetia:v1 | Phabetia (local storage) | Your progress and settings | Until you delete it |
| phabetia:session | Phabetia (local storage) | Keeping your account signed in and remembering your alias | One year, or until you sign out |
| phabetia:consent | Phabetia (local storage) | Remembering whether you accepted measurement | One year |
| _ga | Google Analytics (cookie) | Telling one visitor from another | Two years |
| _ga_* | Google Analytics (cookie) | Keeping the measurement session | Two years |
The browser also keeps a copy of the app so that it works offline. It contains no personal data.
Google's cookies only exist if you accepted measurement. You can also delete and block them from your browser's settings.
How long it is kept
- Account data and the saved game: as long as the account exists. Deleting it removes the user, their sessions, their saved game and their figures.
- Password recovery links: one hour. Email confirmation links: seven days.
- Failed sign-in attempts and email requests: fifteen minutes.
Your rights
You can access your data, correct it, ask for it to be deleted, restrict or object to its processing, and take it with you. Deleting the account is done from the app itself, under “Settings → Account”, without asking anyone. For everything else, write to xose@novadream.com.
If you believe your request was not handled properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or your local supervisory authority.
Children
Phabetia does not ask for your age or any data that would reveal it. Without an account no personal data is processed; to create one you must be at least fourteen years old or have the permission of a parent or guardian.
Where it is stored
Account data is stored on the server hosting phabetia.com, at a hosting provider in Spain. Measurement data is stored on Google's servers.
Changes
If this policy changes, the date at the top changes. This page is always the version in force.