Nothing here
identifies you.
1. What is not collected
UPIN (“the site”) has no sign-up. No name, email, phone number, date of birth or address is collected — nothing that identifies a person. There is one optional Google sign-in, for people who want their record and purchases tied to an account, and even then no name, email or profile picture is taken (section 4).
2. Stored in your browser
Progress and which items you've already played are kept in your browser's localStorage. By default that stays on your device and disappears when you clear site data. Your Me record is the exception — a copy of it is also held on the server (section 3).
3. Stored on the server
Results are stored in two ways. One is aggregate. Only the chosen item, a region code inferred from browser language, and a timestamp are kept, with no identifier attached, so an individual's history cannot be reconstructed. It is used solely for statistics such as “what percentage picked what.” The other is your Me record. What you picked, the trait scores computed from it, and the age band, device and country described in section 5 are stored against an identifier issued to your browser. That identifier is either a random string generated by the server (when you are not signed in) or an irreversible hash of your Google account identifier (when you are). Neither is linked to a name, email or phone number. This record serves two purposes only: restoring your Me when you switch devices, and counting “how people like you answered.” The latter is not shown at all when fewer than 30 people match the same conditions.
4. Google sign-in
Signing in with Google exists for one reason: so your Me record and your purchases can move between devices. Everything on the site works without it. When you sign in, the only thing stored is the account identifier Google issues, hashed so it cannot be reversed. Your name, email and profile picture are never requested, never put in the session, and never stored. Signing in moves whatever you built up while signed out onto that hash. From then on, signing in from another device opens the same record and the reports you already bought. Clear history on the MY screen removes the server copy immediately, and you can revoke the site from your Google account settings at any time.
5. Region and device data
The region attached to results is inferred from the Accept-Language header your browser sends. For visitor counting and the Me record described in section 3, your IP is matched against an offline country list bundled with the server, and just the country code (e.g. KR, US) is kept. The lookup happens entirely on our server — your IP is never sent to a third party and the raw IP is not stored. Precise location such as GPS is never collected, and nothing finer than country is determined. The Me record also keeps your device type. Only which of iOS, Android or desktop it is gets determined from what your browser sends; the raw string is not stored. An age band is stored only if you choose one yourself, in ten-year steps — never your date of birth.
6. Access logs
The web server automatically records access logs (IP address, time, requested path, browser type) for operation and troubleshooting. They are not used for any other purpose and are deleted after their retention period.
7. Visitor counting
To count daily visitors, your IP address and browser information are hashed together with a value that is only valid for that day, producing an unreadable string. The original IP is never stored, and because the value changes daily, the same person appears as a different visitor tomorrow. Tracking across days is not possible.
8. Cookies
The site currently uses no advertising or analytics cookies. Visitor counting works without cookies. Signed-in players do get one cookie that keeps them signed in; it goes when you sign out. One further cookie is issued so that a player who is not signed in can be recognised as the same person. It is a random string, unreadable from JavaScript, and is used to reopen a report you paid for and for the Me record in section 3. Clearing site data in your browser removes it. If advertising or an external analytics tool is introduced later, this document will be updated first, naming each cookie and its purpose.
9. Third parties
Nothing the site holds is shared or sold. If you use the Google sign-in, the authentication itself happens at Google and is covered by their privacy policy. All the site gets back is an account identifier, and it is hashed before being stored.
10. Your rights
You can clear browser-stored data yourself. The Me record in section 3 is deleted from the server too, immediately, via Clear history on the MY screen. Aggregate statistics are a different matter: they carry no identifier, so picking out and correcting or deleting one individual's entries is technically impossible.
11. History
Village saves section removed 8 September 2026 when the village game ended · Server-stored Me records, age band and device added 5 September 2026 · Google sign-in added 22 August 2026 · First published 29 July 2026 · Region section added the same day for the global release · 31 July 2026: country lookup for visitor counting (offline IP matching) documented