Privacy notice

The Secrecy Club is operated by Elliot Fagerberg (“we”, “us”), trading as The Secrecy Club. For the personal data described in this notice, we act as the data controller.

You can reach us about anything in this notice at intelligence@thesecrecyclub.com.

Account data — your email address, your chosen Inquirer name, and a securely hashed password. Used to create and operate your account and to sign you in. Legal basis: performance of our contract with you.

Membership data — your subscription status, billing period, and the identifiers our payment provider gives us. Used to know whether your membership is active and which cases you may access. Legal basis: performance of our contract.

Case activity — the answers you submit, which cases you have solved, and your rank. Used to run the game and track your progress. Legal basis: performance of our contract.

Messages — your name, email, and the content of anything you send through the contact form. Used to answer you. Legal basis: our legitimate interest in responding to enquiries.

Email delivery data — whether a transmission was delivered, and technical logs from our email provider. Used to make sure the mysteries actually reach you. Legal basis: legitimate interest in a working service.

Technical data — IP address, browser type, and basic request logs generated when you use the site. Used for security, abuse prevention, and diagnosing faults. Legal basis: legitimate interest in keeping the service secure.

Card numbers and full payment details are never collected or stored by us. They are handled by our payment provider.

Merchant of Record — our order process is conducted by Stripe, which acts as Merchant of Record for our orders and handles payments, subscription management, tax compliance, invoicing, and refunds. Stripe processes your payment and contact details for those purposes.

Service providers — hosting, database, authentication, and email delivery providers that run the site and send your transmissions on our behalf, under contract and only on our instructions.

Professional advisers — legal and accounting advisers, where necessary.

Authorities — where we are required to disclose information by law.

We do not sell your personal data, and we do not share it for advertising.

Some of our providers operate outside the EEA and the UK. Where personal data is transferred outside those areas, it is protected by an adequacy decision or by Standard Contractual Clauses together with appropriate safeguards.

Account, membership, and case data are kept for as long as your account exists, and for up to 12 months after you delete it or your membership ends, so that a returning member keeps their record.

Contact messages are kept for up to 24 months. Records required for tax and accounting are kept for as long as the law requires. After that, data is deleted or anonymised.

You may ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or receive it in a portable format. Where we rely on consent, you may withdraw it at any time.

Write to intelligence@thesecrecyclub.com and we will respond within one month. If you are unhappy with our response, you may complain to your local data protection authority — in Sweden, the Integritetsskyddsmyndigheten (IMY).

We use appropriate technical and organisational measures to protect your data, including encryption in transit, hashed passwords, access controls on our database, and row-level restrictions so that members can only read their own records.

We use only essential cookies and equivalent local storage: keeping you signed in, remembering that you have already seen the opening animation, and security. We do not use advertising or third-party tracking cookies.

Our payment provider may set cookies needed to complete checkout. You can clear or block cookies in your browser settings, though signing in will then no longer work.

If we make material changes to this notice, we will notify members by email. The version on this page is always the current one.