Privacy
Last updated 23 September 2026
The short version
- You can play everything without an account, and without saying yes to anything.
- We only log how you play if you allow analytics in the banner, and you can turn it off again from the footer of any page.
- The site carries ads from Google AdSense. In the EU, the UK and Switzerland, Google asks for your consent in its own message before using cookies for ads.
- Apart from Google's ad script, nothing on the site is loaded from anyone else — no Google Fonts, no social widgets, no trackers.
- We never sell your data, and nothing from our own records goes to advertisers.
- A name you put on a leaderboard is public. Nothing else you do is.
Who runs this site
Treble Winner is run by LTD Async, Tbilisi, Georgia, which is the controller of the personal data described here. For anything on this page — a question, a request, a complaint — write to info@async.ge.
Because the site is offered to people in the EU, the EU's General Data Protection Regulation (GDPR) applies to it as well as Georgia's Law on Personal Data Protection. This page is written to meet both.
A company outside the EU that offers a service to people in the EU and analyses how they use it has to appoint a representative in the EU (GDPR Art. 27) and name them here. The "occasional processing" exemption does not fit analytics that run on every visit. This is a paid service; choose a provider and put their name and contact here.
What is recorded, and why
When you play at all
Every request your browser makes reaches our server with your IP address and the browser's user agent, as any website's does. The game itself does not store your address from these requests.
The web server in front of the game keeps an access log of those requests, with the IP address, for security and to find faults. Each log is deleted after 14 days. Legal basis: our legitimate interest in keeping the site running and secure (Art. 6(1)(f)).
The Daily Treble
To give each browser one scored run a day, the site sets a cookie called
tw.daily holding a random id — it says nothing about you, only that this
browser is the one that played this run. It is set only when you open the Daily
Treble; looking at the home page or the daily board sets nothing.
Against that id we keep today's run (the cells, your picks, the result) and a salted hash of your IP address, which lets us spot one address farming the daily board without keeping the address itself. If you have allowed analytics, the run also carries your analytics id. All of it is deleted when the next day's puzzle is published, shortly after midnight UTC.
Legal basis: our legitimate interest in a daily board that cannot be flooded (Art. 6(1)(f)). The cookie is strictly necessary for the one-scored-run rule, so it does not need your consent.
Leaderboards
If you save a result, we keep the manager name you typed, your XI, the result and the time, and show them on a public leaderboard. Use a nickname — nothing asks for your real name. All-time entries stay until the board is reset or you ask us to remove one; daily entries go with the day. Legal basis: you asked us to put it there (Art. 6(1)(b)).
Shared results
Pressing "Share result" stores your XI, the result and the season's seed under a link anyone with it can open. No name and no id goes with it. Share links are kept so that they keep working. Legal basis: Art. 6(1)(b), as above.
The Facebook, X, WhatsApp and Telegram buttons are plain links. Nothing from those services is loaded until you press one, and after that what they do is covered by their own privacy policies.
Analytics — only if you allow it
If you press "Allow analytics", we keep a random id in your browser and log what happens as you play, to find out which parts of the game work: where people give up on the draft, whether they use their re-spins, how many reach a played season, and how many look at the odds. Until you answer, nothing is sent and nothing is stored; if you say no, nothing ever is.
Each logged event records:
- what happened — a spin, a pick, a finished season — and the game mode, difficulty and screen;
- when, and which visit and which draft it belongs to, by random ids;
- the page address and the page that linked you here;
- your browser, operating system and device type (read from the user agent, which is then discarded), your preferred language, and your window size;
- a salted hash of your IP address. The address itself is never stored.
What you type in the squad search is not recorded — only that you searched. Script errors are logged too, so broken things get fixed.
The hash cannot be turned back into your address by anyone without the salt, which never leaves our database. It is still personal data under the GDPR, because we could recognise the same address again, and we treat it as such.
Legal basis: your consent (Art. 6(1)(a) GDPR, and Art. 5(3) of the ePrivacy Directive for the id kept in your browser). You can withdraw it at any time from Cookie settings; that stops the logging from then on and removes the id from your browser.
Analytics events are deleted automatically 13 months after they were recorded, and the id in your browser is replaced with a new one after 13 months too.
Cookies and browser storage
| Name | What it is for | Kind | How long |
|---|---|---|---|
tw.daily |
Which daily runs are yours. Unreadable by the page itself. | Cookie, strictly necessary | 60 days |
tw.consent |
Your answer to the analytics question, so we do not ask on every page. | Local storage, strictly necessary | 12 months, then we ask again |
tw.lang |
The language you picked, English or Georgian. | Local storage, strictly necessary | Until you clear site data |
tw.visitor, tw.visitor.at |
Tells one browser's visits apart from another's in the analytics, and when that id was made. | Local storage, analytics — only with consent | 13 months, or until you withdraw consent or clear site data |
tw.session |
Groups one visit's events together in the analytics. | Session storage, analytics — only with consent | Until you close the tab |
Google's ad cookies, such as __gads and __gpi |
Set by Google, for showing and measuring ads. See Advertising. | Advertising — in the EU, UK and Switzerland only with consent, asked by Google | Set by Google, typically up to 13 months |
Change your cookie settings. Your browser's own "clear site data" removes all of them.
Who else sees it
- Grena, our hosting provider in Georgia, whose servers everything above is stored on. Grena processes it only on our behalf.
- Google, which runs the ads — see Advertising. Google gets what its own ad script collects in your browser, not anything from our records.
- Anyone, for leaderboard entries and result links, which are public by design.
Nobody else. We do not sell data, and our analytics, leaderboards and daily runs are not shared for advertising.
Where it is kept
Your browser sends everything described here straight to our server in Georgia, where it is stored. Georgia is outside the EU and is not covered by an EU adequacy decision. The GDPR still applies to how we handle your data, and so do the rights below. We pass nothing on to any other country. Google's ad script is a separate matter: Google may process what it collects in the United States, and Google LLC is certified under the EU–US Data Privacy Framework.
Advertising
The home page and shared result pages load Google AdSense, provided by Google Ireland Limited for visitors in the EEA and Switzerland and by Google LLC elsewhere. When the page loads, Google's script receives your IP address and details of your browser, and Google may use cookies or similar identifiers to show ads, measure them and stop fraud — and, only if you agree, to personalise them.
In the EU, the UK and Switzerland, Google shows its own consent message before it does any of that beyond what is strictly needed, and lets you change your answer later. Google decides for itself how it uses what its script collects; that is set out in how Google uses information from sites that use its services, and you can turn off personalised ads for your Google account in Google's ad settings.
Our analytics question and Google's ad question are separate. Saying yes to one is not saying yes to the other, and nothing from our analytics is given to Google.
Your rights
Under the GDPR you can ask us to:
- tell you what we hold about you and give you a copy (Art. 15 and 20);
- correct it (Art. 16), or delete it (Art. 17);
- stop or limit using it (Art. 18 and 21);
- and you can withdraw consent to analytics at any time, which does not affect what was done before you withdrew it.
Nothing we hold carries your name, so we need something to find your data by. For analytics, Cookie settings shows your analytics id — send us that. For a leaderboard entry, the name, the date and the board. We answer within one month.
Write to info@async.ge to use any of these rights. You can also complain to a data protection authority: in the EU, in particular the one in the country where you live or work; in Georgia, the Personal Data Protection Service. We would rather you told us first, but you do not have to.
Nothing on this site makes decisions about you. The analytics are read in aggregate, to improve the game.
Children
Anyone can play: the game asks for nothing about you. Analytics are different. If you are under 16, please choose "No thanks" in the banner; we do not knowingly log analytics for anyone under 16. On a leaderboard, use a nickname rather than your real name. If you are a parent and think we hold something about your child, write to info@async.ge and we will delete it.
Changes to this page
When this page changes, the date at the top changes with it. If a change means we would be doing something new with your data, we ask again rather than assume.