Privacy policy

What we process, and why

Your account

If you register, we store your email address, your display name and your password as an Argon2 hash. We never store the password itself. Verifying your address or resetting your password creates a record holding a hash of the one-time link, and for verification the address being confirmed. Expiry stops the link working but does not delete the record: it stays until a new one replaces it or you delete your account.

Legal basis: Performance of a contract — we cannot give you an account without this information.

Staying signed in

Each session is recorded on our server with a hashed refresh token, your IP address and a short description of your device or browser. This is what lets you stay signed in, see your active sessions in Settings, and sign a lost device out. Signing out marks a session as revoked but keeps the record, and renewing a session leaves the previous one behind the same way, so these rows — including the IP address and device description — stay until you delete your account. Nothing purges them automatically yet.

Legal basis: Performance of a contract, and our legitimate interest in keeping accounts secure.

Games and scores

We store the games you join, the guesses you place, how far each one landed from the target, and the scores and statistics built from them. These appear on leaderboards and in your own history. We also store which quizzes you have upvoted, so a quiz is counted once per person.

Legal basis: Performance of a contract — the game does not work without them.

What you create

Quizzes, locations, clues and any media you upload are stored and linked to your account. Content you publish or add to a public quiz becomes visible to other players. When you save a location, the text of its clues is sent to OpenAI to be translated into the site's other languages, and the translations are stored alongside your original. When you upload an image we also record that you uploaded it, when, the exact rights statement you confirmed and any source you gave, so that a rights complaint can be traced. If you delete your account, that record — including any source you wrote — is kept, no longer linked to your account, and there is currently no time limit after which it is removed.

Legal basis: Performance of a contract — you asked us to publish it, and the game presents it in the player's own language.

Signing in with Google

Signing in with Google is optional. If you use it, Google sends us the account identifier, the email address on that account, whether that address is verified, your Google profile name and a link to your profile picture. We keep the identifier, the email address and the name, which becomes your display name; we never receive your Google password.

Legal basis: Performance of a contract, after you choose this sign-in method.

Bug reports

If you send a bug report, it is filed as an issue in our private GitHub repository. It contains what you wrote, an email address only if you supply one, the address of the page you were on, and technical context: browser and version, screen size, the language the site is currently showing you, connection type, whether you were signed in, and recent console errors. If you report from inside a game, the game's identifier and code, its number of rounds and the quiz name are attached too. Your browser also sends us the names — never the values — of the entries it has stored; that list reaches our server but is not written into the issue, and it is removed before anything goes to OpenAI. Sign-in tokens, your profile and your display name are excluded from the start. The report text and the rest of that technical context are also sent to OpenAI to draft a short summary — see below.

Legal basis: Consent — nothing is sent unless you submit the report.

Reporting a clue

If you report a problem with a clue, we store which clue it was, the kind of problem you chose, your description of it, and a link to your account so we can follow up. The report keeps its status and any notes an administrator adds while it is handled. Deleting your account detaches the report from you but keeps the report itself, so the correction is not lost.

Legal basis: Our legitimate interest in fixing mistakes in the game's content.

API keys

Administrators can create API keys for tools that load content. We store the name you give a key, the permissions granted to it, the first few characters so you can recognise it in the list, and the times it was created, last used and revoked. The key itself is stored only as a hash and shown once — we cannot recover it. Keys are deleted with the account that created them.

Legal basis: Performance of a contract, for administrators who ask for a key.

Server logs

Our server writes operational logs, and they say more about you than the name suggests. Entries record your account identifier when you register or sign in, your display name at registration, the email address on a sign-in attempt whether or not it succeeds, your IP address when a request is rate-limited, and — as you play — the code of a game you join together with your player identifier, and the identifier of each round you guess in. If GitHub is unreachable when you send a bug report, the whole report including any contact address is written here instead. The email service records every recipient address. Because these entries carry your account identifier they are directly linked to you; they are kept on the server until we remove them, and are not deleted when you delete your account. Write to us if you need something removed from them.

Legal basis: Our legitimate interest in operating and securing the service.

Third parties

We use no analytics, no advertising, no tag managers and no tracking pixels, and we never sell your data or share it for advertising. These are the only third parties involved, and we name what each one is able to see:

Google Maps

The map you place your guess on is served by Google, which necessarily learns your IP address and which map tiles you request. If you use the place search when creating a location, what you type there and the place you pick are sent to Google too, by its Places service. When we audited it, Google Maps set no cookies and stored nothing in your browser.

Google sign-in

Only used if you choose it. The sign-in happens on Google's own pages under Google's own privacy notice; anything Google stores there, it stores as controller in its own right, not on our behalf.

YouTube clues

Video clues are embedded through youtube-nocookie.com, which our audit confirmed sets no cookies and plants no identifier during playback. The player does still contact Google for anti-abuse checks (www.google.com and jnn-pa.googleapis.com), which we cannot switch off, so your IP address reaches Google when a video clue plays. Videos are not audited for advertising, so an ad shown before a clip could behave differently.

Gravatar

Player avatars are served by Gravatar, run by Automattic in the United States. We never send it your email address, but the picture's address is built from an MD5 hash — of your email address if you have an account, or of your anonymous player identifier if you do not — so Gravatar receives a stable pseudonymous identifier along with your IP address and the page you are on. This happens on the home page, in Settings, in the lobby and on the round and final score screens. Where the hash matches no Gravatar profile, it returns a generated pattern instead of a photograph.

GitHub

Bug reports are stored as issues in our private repository on GitHub, a service operated from the United States. The issue includes the contact email address if you supplied one with the report. Nothing else about your account goes there, and no gameplay or content data beyond the game context described above.

OpenAI

OpenAI, in the United States, is used for two things. When a bug report arrives, its text and technical context are sent there to draft the one-line summary used as the issue title, with identifying values stripped from the diagnostics first. And when you save a location, the text of its clues is sent there to be translated into the site's other languages. Nothing else on the site reaches OpenAI.

Hosting

The site, its database and all your account, gameplay and content data run on a server operated by Bengt Ellison within the EU. None of that is outsourced to a cloud provider; the only data leaving that server is described in the entries above.

Your rights

Access and portability

Sign in and open Settings to download your account details, your linked sign-in methods, your active sessions, your most recent games (up to 1,000) and counts of the locations, quizzes, clues and reports you have created. It does not include bug reports you have sent, which live in the GitHub issue tracker.

Correction

You can change your display name, email address and password yourself in Settings. Write to us if something else is wrong.

Erasure

Settings has a Delete account option that removes your account, your sign-in sessions and your linked Google account. Guesses already recorded in games other people played are kept, with the link to you removed, so that those games remain intact. Quizzes and locations you created are kept, with the link to you removed, so that games built on them keep working — write to us if you want any of them taken down.

Reuse of your data

The export is structured data you are free to keep or move elsewhere.

Objection and restriction

You may object to, or ask us to restrict, processing that rests on our legitimate interest. Write to us and we will answer.

Complaint

If you think we have handled your data wrongly, you can complain to the Swedish Authority for Privacy Protection (IMY), or to the supervisory authority where you live.

How long we keep things

Your account and everything attached to it is kept until you delete it, which you can do yourself in Settings. Session records, including revoked ones, are kept for the life of the account. Quizzes and locations you created stay after deletion, with the link to you removed. Bug reports are different: they live as issues in our GitHub repository, are not linked to your account, and are not removed when you delete it — write to us if you want one taken down. Clue reports stay after deletion too, but with the link to you removed.

How we protect it

Traffic is encrypted with HTTPS. Passwords are stored as Argon2 hashes and refresh tokens only as hashes, so neither can be read back from the database. Access to the server is limited to the operator. No system is perfectly secure, and we do not claim otherwise.

Children

The game has no age-restricted content, but an account requires an email address. If you are under 13, ask a parent or guardian before registering.

Changes to this notice

This page may be updated as the game changes. The date at the top always shows the current version, and significant changes will be announced on the site.