Privacy policy

Last updated: 27 October 2026

WikiChallenge is a game played on Wikipedia through a Chrome extension and a website. This policy describes exactly what the extension and the website collect, why, and for how long. WikiChallenge is not affiliated with the Wikimedia Foundation.

What the extension collects

Only while you are in a game, and only in the tab the game runs in:

The title, URL and page id of each Wikipedia page you open in the game tab, with a timestamp and whether it was reached by a link click or the back button.
Navigation events that break a rule (typed address, search box, language switch, new tab, leaving Wikipedia), used to disqualify the move.
A heartbeat every few seconds while the game runs, so your opponent can tell whether you are still connected.

Outside a game the extension reads nothing. It never reads the content of those pages, and it never sees the pages you visit in other tabs. If you grant the optional “read all sites” permission, it is used for two things only: showing a 60-second reconnect countdown on your open tabs after you close the game tab, and showing the verdict on the page you landed on when a move takes you out of wikipedia.org and ends your game. Nothing from those pages is read or sent anywhere.

Notifications

When you are signed in, the extension registers with Chrome's push service so that an invitation to a race or a friend request can reach you while the side panel is closed. What we store is the address Chrome gives for your browser (an opaque endpoint and its encryption keys), linked to your account. The message itself carries only the inviter's username and the game's code: never a page you visited. The address is deleted when you sign out or delete your account, and you can stop invitations entirely with "Who can invite me".

What the website collects

Your email address and the username you choose, to create and sign in to your account.
Your games and their moves, so you and your opponent can see the result and, if you make a replay public, anyone with its link.
Your friends list, the requests you send and receive, the players you block, and your “who can invite me” setting.
If you register interest in Premium: your email address, only to tell you when it launches.
If you send yourself the link from a phone: your email address, to send it and create your account. Only if you tick the box, one reminder three days later if you have not installed the extension yet; nothing else is ever sent under that consent. Each reminder carries an unsubscribe link, and the “Emails” card of your account page turns it off.
If the team offers you Premium by email: your address, kept until the invitation is used, cancelled or expired, with the team's message.

Audience measurement

The website and the extension send usage statistics to PostHog, hosted in the European Union:

On the website: the pages viewed, a few actions (sign-in link sent, account creation steps, button clicked, Premium waiting list joined, replay shared, friend request…), the reason and comment of the uninstall form if you fill it in, and technical errors, with the type of browser and device.
In the extension: game events (game created, joined, started and finished, with the outcome, the number of clicks, the distance covered and the duration; a broken rule or a blocked link, by type only), disconnections and reconnections, invitations and friend requests sent and your answers, notifications received and opened, the account and Premium suggestions shown and your answers, the daily reminders shown and clicked, and technical errors.
On our servers: the moment an account is created (and whether it started as a guest), the moment a friendship is accepted, and the sending of the phone link's reminder and its unsubscription.

When you are signed in, these events are tied to your account id, and so are whether it is a guest account and its plan (free or Premium), never your username or your email address. They never contain the title or the address of a Wikipedia page. On the website, measurement uses no cookie and no local storage: nothing is kept in your browser from one page to the next. Your sessions are not recorded and your clicks are not captured automatically.

Where it is stored

Data is stored with Supabase in the European Union (Paris region). Sign-in emails are sent through our email provider. We use no advertising trackers.

Service providers

Supabase: database and accounts, in the European Union (Paris region).
Vercel: hosting of the website.
Resend: sending of the sign-in emails.
PostHog: audience measurement and technical errors, in the European Union.
Cloudflare Turnstile: the anti-robot check on the sign-in and sign-up pages, and before playing as a guest.
Google: Chrome's push service, which carries invitations to your browser while the side panel is closed.
ImprovMX: forwarding of the messages sent to hello@wikichallenge.org.
Stripe (Link), when Premium opens: payment, receipts and VAT, as the merchant of record. We receive the status of your subscription, never your card details.

Retention and deletion

Games are kept so your history and replays keep working. You can make a replay private at any time. Twelve months after a game ends, its step-by-step moves are deleted unless you made its replay public; the result (opponent, time, clicks) is kept. You can delete your account yourself from your account page, in one click: your email address, username and sign-in are removed immediately, and a Premium subscription is cancelled at once (the current period is not refunded). Games you played are kept so your opponents keep their history and shared replays keep working, with your name replaced by “Deleted player”. Nothing in them identifies you any more. If you play the daily challenge as a guest, that guest account is deleted for good — with its games — thirty days after your last game, unless you turn it into a real account before then. An account whose email address was never confirmed (a link that was never opened) is deleted seven days after its creation if it never played.

Your rights

You can access your data, have it corrected or erased, and object to its processing, audience measurement included. You can change your username and delete your account yourself, from your account page. For any other request, write to hello@wikichallenge.org. If you believe your rights are not respected, you can lodge a complaint with the CNIL, the French data protection authority (cnil.fr), or with the authority of your country.

Contact

hello@wikichallenge.org

Publisher and hosts: legal notice.

What the extension collects

Only while you are in a game, and only in the tab the game runs in:

The title, URL and page id of each Wikipedia page you open in the game tab, with a timestamp and whether it was reached by a link click or the back button.

Navigation events that break a rule (typed address, search box, language switch, new tab, leaving Wikipedia), used to disqualify the move.

A heartbeat every few seconds while the game runs, so your opponent can tell whether you are still connected.

Notifications

What the website collects

Your email address and the username you choose, to create and sign in to your account.

Your games and their moves, so you and your opponent can see the result and, if you make a replay public, anyone with its link.

Your friends list, the requests you send and receive, the players you block, and your “who can invite me” setting.

If you register interest in Premium: your email address, only to tell you when it launches.

If you send yourself the link from a phone: your email address, to send it and create your account. Only if you tick the box, one reminder three days later if you have not installed the extension yet; nothing else is ever sent under that consent. Each reminder carries an unsubscribe link, and the “Emails” card of your account page turns it off.

If the team offers you Premium by email: your address, kept until the invitation is used, cancelled or expired, with the team's message.

Audience measurement

The website and the extension send usage statistics to PostHog, hosted in the European Union:

On the website: the pages viewed, a few actions (sign-in link sent, account creation steps, button clicked, Premium waiting list joined, replay shared, friend request…), the reason and comment of the uninstall form if you fill it in, and technical errors, with the type of browser and device.

In the extension: game events (game created, joined, started and finished, with the outcome, the number of clicks, the distance covered and the duration; a broken rule or a blocked link, by type only), disconnections and reconnections, invitations and friend requests sent and your answers, notifications received and opened, the account and Premium suggestions shown and your answers, the daily reminders shown and clicked, and technical errors.

On our servers: the moment an account is created (and whether it started as a guest), the moment a friendship is accepted, and the sending of the phone link's reminder and its unsubscription.

Service providers

Supabase: database and accounts, in the European Union (Paris region).

Vercel: hosting of the website.

Resend: sending of the sign-in emails.

PostHog: audience measurement and technical errors, in the European Union.

Cloudflare Turnstile: the anti-robot check on the sign-in and sign-up pages, and before playing as a guest.

Google: Chrome's push service, which carries invitations to your browser while the side panel is closed.

ImprovMX: forwarding of the messages sent to hello@wikichallenge.org.

Stripe (Link), when Premium opens: payment, receipts and VAT, as the merchant of record. We receive the status of your subscription, never your card details.

Retention and deletion

Your rights