Genius Square Play now

Privacy Policy

Last updated:

This policy explains how personal data are used when you visit and play Genius Square at geniussquare.smartgames.com, create an account, sign in, receive our emails or enable browser reminders.

SMART NV, Neerveld 14, B-2550 Kontich, Belgium, enterprise number 0448.827.611 (“SMART”, “we” or “us”), is the data controller. For privacy questions or requests, contact privacy@smart.be or write to that address.

The game promotes the physical Genius collection, including through Happy Puzzle Company branding and shop links. SMART operates the online game and manages its account and game data through the services described below. Promotional branding does not change who is responsible for those data.

Your account and sign-in data

We use your email address to create and identify your account and send login links. You choose a nickname to play. We store your account creation and update dates, your email verification status, your marketing preference and the authentication information needed to keep your account signed in and connect it to the game.

You can sign in with an email link or, where available, Apple, Google, Facebook or Microsoft. If you choose a social sign-in, we receive an identifier from that provider and the email address and name it makes available. Apple may provide a private relay email address. We store the provider name and identifier to recognise your linked account. We do not receive your social account password or request your friends list or social posts.

The provider processes your sign-in under its own privacy policy: Apple, Google, Facebook or Microsoft. Signing in redirects you to that provider, which may use its own cookies.

To create an account, you only need an email address or one of the social sign-in options above. You then choose a nickname to play and save results; it does not need to be your real name. We do not ask for your postal address, phone number or payment details to play. You can read this policy and view the public leaderboard without creating an account.

Game records and public leaderboards

We record game participation linked to your account, the player name used in the game, scores, winner status, game start time and duration, whether a game is multiplayer, and the difficulty and daily challenge date where applicable. These records let us save your results, calculate points and rankings, and show game progress.

Your nickname, points and ranking can appear on the public leaderboard. Other players can also see the player name you use in multiplayer games. Choose a nickname that does not reveal information you want to keep private. Your email address and linked sign-in identifiers are not displayed on the leaderboard.

The browser game receives your nickname and an account authentication token to connect your play to your account and submit results through the game service.

Functional cookies

A cookie is a small text file stored by your browser. We use the following functional cookies to keep the website and account features working:

You can inspect cookie expiry dates, remove cookies or block them in your browser settings. Blocking functional cookies can prevent sign-in and other account features from working. Persistent sign-in cookies can sign you back in after a session expires, so log out when using a shared device.

Analytics cookies and visitor statistics

We use our own installation of Matomo Analytics at matomo.smart.be to count visitors and understand how the game website is used. Page views and link interactions are sent to SMART's analytics service. This can include the page visited, referring website, visit time, browser and device information, IP address and cookie identifiers.

Matomo may use cookies with names beginning _pk_, such as _pk_id to recognise a returning browser, _pk_ses to group activity into a visit, and _pk_ref to record how a visitor reached the website. Names can include a site-specific suffix. You can inspect and remove these cookies through your browser settings. More information is available in Matomo's cookie documentation.

We also send a server-side event when a match summary is saved, containing the game mode and duration, without player names or account identifiers. The website does not include Google Analytics, advertising pixels or a Mautic browser-tracking script. Mautic is used on the server for email and contact management, as described below.

Technical information and sign-in providers

Requests to the website and game services include technical information such as your IP address, browser information and request details. Session records can contain your IP address and browser information. Hosting and application logs may contain request and error information used to operate the service, investigate faults and prevent abuse.

We use a country indication supplied by our hosting infrastructure to distinguish UK visitors from other visitors, display the appropriate branding and select a regional email group. This does not require your precise device location.

If you choose Apple, Google, Facebook or Microsoft sign-in, you visit that provider's sign-in service. It may use its own cookies and process technical information under the provider policy linked above.

Login emails and product updates

We use Twilio SendGrid only to deliver login emails, not to receive your game results or manage your marketing preferences. SendGrid processes your email address, the login link and email content, together with delivery and security information needed to provide the service. We disable SendGrid open and click tracking for these emails. Login emails are service messages needed to access your account and do not depend on marketing consent.

We record your preference for updates about products, offers, competitions and exclusive content. We use Mautic for contact management and marketing updates. New accounts are synchronised to Mautic as email contacts, including accounts that do not opt into marketing. Only accounts that opt into updates are added to a UK or non-UK marketing group. Mautic does not send your login link.

You can decline updates using the checkbox when creating an account with email, change your preference in Profile, or unsubscribe using the option in a marketing email or by contacting privacy@smart.be. Receiving marketing updates is not required to play. Declining updates does not prevent service emails such as login links.

Optional browser reminders

Where available, you can enable daily challenge reminders after allowing notifications in your browser. We store a browser push subscription linked to your account, including its delivery address, security keys, your browser's time zone and the date of the last reminder sent. We use these details and your daily challenge participation to send morning reminders in your local time. The delivery address and keys are stored encrypted.

Reminders use a service worker and your browser's push service, which may be operated by Google, Mozilla, Apple or Microsoft. That provider processes the technical information needed to deliver the notification. You can turn reminders off in the game or block notifications in your browser settings. Turning reminders off in the game removes the stored subscription; deleting your account also removes it.

Why we process your data

We use account and game data to provide the service you request: sign-in, saved results, multiplayer play and rankings. We process technical and security information for our legitimate interests in keeping the service working, diagnosing problems and preventing misuse. Where processing relies on consent, including marketing where consent is required, you can withdraw it. We may also process information when required by law.

Services that receive information

People who operate and support Genius Square can access information needed for their work. The following services process information for the purposes described in this policy:

The Matomo and Mautic website policies describe their own websites; SMART's use of those tools for Genius Square is described here. Your chosen social sign-in and browser push providers also process the interactions described above. Hosting and game-server infrastructure process the account, game and technical information needed to provide the game.

Links to product shops, including Happy Puzzle Company's shop, take you to separate websites governed by their own policies. Following a shop link does not give the shop access to your Genius Square account or saved results. Information you provide to a shop, and technical information it receives when you visit, are covered by that shop's policy.

Providers, including Twilio SendGrid, may process information outside your country, including outside the European Economic Area. SendGrid login-email delivery is not configured for EU-only processing. You can contact us for information about processing locations and the transfer safeguards applicable to your data. Information about Twilio's contractual data-protection and transfer provisions is available in its Data Protection Addendum. We may disclose information where legally required.

Retention and account deletion

Account and game records are kept to maintain your account, saved results and rankings. You can permanently delete your account from Profile after signing in. This removes your user record, linked social sign-ins, game participation records associated with your user account, browser reminder subscriptions, and active account sessions and access tokens from the application database.

Account deletion does not delete your Apple, Google, Facebook or Microsoft account. Disconnecting the game in a provider's settings does not by itself delete your Genius Square account.

Deleting your game account queues removal from the Genius Square marketing groups in Mautic, but does not automatically delete the separate Mautic email contact. To request removal of email contacts or other remaining personal information, contact privacy@smart.be. Deleting your game account does not automatically erase SendGrid email delivery and security records. Logs, backups and email delivery records are separate from the account database; retention depends on their operational purpose and any applicable legal requirements. Contact us for the retention details applicable to your request.

Protecting your information

The website uses HTTPS to protect information in transit. Account access uses signed login links or the selected social sign-in provider. Keep login links and account access private, and tell us if you believe your account has been misused. No online service can guarantee absolute security.

Your privacy rights

Subject to applicable data-protection law, you can request access to your personal data, correction, deletion, restriction of processing and a portable copy. You can object to processing based on legitimate interests and to direct marketing, and withdraw consent without affecting processing that took place before withdrawal.

Send requests to privacy@smart.be or SMART NV at the postal address above. We may need to verify your identity before providing or changing personal information.

You can complain to your local data-protection authority or the Belgian Data Protection Authority.

Children and families

If you are under 16, please read this policy with a parent or guardian before creating an account. A nickname can be public, so avoid using your full name, school, address or other identifying information. If you are a parent or guardian with questions about a child's information or marketing messages, contact us.

Changes to this policy

We may update this policy when the service or its data practices change. The date above identifies the latest version.