Privacy policy

Last updated: 22 October 2026.

Whodunit is operated by ZanoTech Solutions (Pty) Ltd. Contact: info@zanotechsolutions.com.

Solo play

Your local detective identity, preferences, investigation progress, notes and scores are stored on your device. Solo play does not require a cloud account. Local profile and progress controls are available in the app.

Connected play

When you use connected multiplayer, our service processes your detective name, assigned player identifier, authentication sessions, lobby membership, gameplay actions and shared investigation history. Other lobby members can see your detective identity and shared discoveries. Do not put sensitive personal information in your detective name.

If you submit a connected account sign-in, linking or recovery form, the email address and authentication information you enter are transmitted to our service. Failed sign-in attempts can retain a hashed email identifier for rate limiting. Verification and password-recovery messages are delivered through Resend from info@zanotechsolutions.com. Verification is completed only after you submit the valid code. Passwords are stored as salted password hashes; verification and recovery codes expire after 20 minutes. Pending message bodies are encrypted in our delivery queue and removed after successful sending or expiry. Solo account credentials remain on your device.

Optional Google Play Games

On Android, you may connect Google Play Games and choose to share already-earned achievements and your best completed-attempt score. Google processes Play Games authentication, gamer profile information, achievements and submitted scores. The Play Games SDK also automatically collects analytics and diagnostics to improve SDK stability and its products; this is separate from your choice to share earned results. Your gamer name and score may be visible to other players according to your Google Play Games profile and leaderboard privacy settings. Manage those settings and Google-held Play Games data through Google Play Games and your Google Account.

Play Games does not sign you into our multiplayer service or replace your local detective identity. This release does not upload investigation saves, case notes or transcripts to Google Drive, and does not use Play Games Saved Games. Solo investigations remain available offline without connecting Play Games. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

Optional case-preview analytics

In versions offering “Help improve case previews”, this device-wide preference is off by default and can be changed in the case store or Privacy & Data. If enabled, we send counts of preview views, pack views and checkout starts, their screen source, and a random identifier for each event. These events contain no email, account identifier, advertising identifier, receipt or gameplay content. Delivery requires internet; offline events are not queued. Turning the preference off stops future events. We retain these measurement events for up to 90 days through scheduled cleanup. Hosting request logs may include network metadata such as IP addresses. Purchase verification records are processed separately for ownership and aggregate sales reporting regardless of this optional preference; Google test purchases are excluded from sales counts.

Why we process information

We use these records to authenticate players, synchronise shared cases, restore connected progress and prevent duplicate actions or abuse. Hosting infrastructure can process request metadata, including IP addresses and technical logs, for service operation and security.

Service providers

The connected service runs on Google Cloud. This website uses Firebase Hosting. Google Play distributes the Android application. Android builds with optional rewarded hints use Google AdMob. Ads are shown only when you choose to watch one for an extra fieldwork plan in The Last Dinner. Existing hints stay free, premium cases have no ads, and saved plans and solo gameplay remain available offline. Google’s consent platform checks applicable privacy requirements and offers choices where required. You can revisit applicable choices in Profile → Privacy and Data → Ad privacy choices. Declining an ad does not remove free hints. Ad requests are separate from optional case-preview analytics. The Google Mobile Ads SDK collects and shares IP addresses (which can indicate approximate location), device/account identifiers including advertising and app-set IDs, app/ad interactions and diagnostic information for advertising, measurement and fraud prevention. Requests use non-personalised ads; this does not mean no data is processed. SDK data is encrypted in transit. Google handles its own retention and account/device privacy controls under Google’s Privacy Policy. You can reset or delete your advertising ID through Android settings. We do not send detective notes, investigation evidence or your connected-account email to AdMob. Ad rewards are saved on your device. Premium case packs are optional one-time Google Play purchases in supported app versions and regions. The Last Dinner remains free. Subscriptions are not offered. Approved internal testers may use Google Play test purchases. When you purchase or restore a premium case pack, Google Play handles checkout; we do not receive payment-card details. Our service processes the purchase token, product identifier, purchase and acknowledgement status, and an account identifier to verify ownership, restore access and revoke refunded purchases. Purchase tokens are encrypted in our database. A connected, verified account is required to associate the pack with your detective identity. Resend processes the recipient email address and message content to deliver account verification, password recovery and password-change notifications. Its delivery infrastructure processes delivery and failure information.

Storage and deletion

Local progress stays on your device until you remove it. Deleting a local profile does not delete connected player records or shared cloud history. Connected player and investigation records currently remain until an approved deletion request is processed; there is no automatic expiry of this history. Expired or revoked session records are eligible for cleanup after seven days. Database backups are retained separately for seven daily backups, with one day of point-in-time recovery logs. Deleted records may remain in those backups until they expire. Contact us to request deletion of connected data; see the data deletion page. We will verify the request before taking action. Shared case records may include contributions from other players, whose information must be protected.

Audience

Whodunit is intended for adults aged 18 and over and contains fictional murder themes.

Contact and changes

For privacy questions, contact info@zanotechsolutions.com. This page will be updated when the app’s data practices change.