1. Who is responsible
The controller under the GDPR (Art. 4(7)) is Mehmet Deniz Peksen, Freisinger Landstraße 88, 80939 München, Germany. Email: geophy.game@gmail.com.
2. What we store when you play
- An anonymous guest account: a random id created on your first game. No name, no email.
- Your games: answers, answer times, scores, rating and streaks. We use them to score games, run rankings and the daily puzzle, and as “recorded runs” that other players race against. Recorded runs are shown without any name.
- Challenge links: when you send a challenge, the first name you type (optional) and your score are shown to anyone with the link, also in link previews in chat apps. The challenge page also shows how many people played it and how many beat you. Challenge pages are not listed in search engines.
- How you found us: the campaign tags in the link of your first visit (
utm_*,ref), so we know which channels bring players. - Question reports and feedback you send, linked to your guest id.
Legal basis: Art. 6(1)(b) GDPR, providing the game you asked for. Reports, feedback and campaign tags: Art. 6(1)(f) GDPR, our legitimate interest in fixing mistakes and improving the game.
3. Bot protection
Before your first game, Cloudflare Turnstile checks that your browser is not a bot. It processes technical data such as your IP address and browser characteristics. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in keeping spam accounts out. See Cloudflare’s Turnstile privacy addendum.
4. On your device
Your guest sign-in is kept in your browser’s local storage, so you keep your games, rating and streak. This is strictly necessary for the service you requested (§ 25(2) no. 2 TDDDG). If you turn off analytics (§5), that choice is stored there too, so we can respect it. We use no cookies for advertising or analytics, and analytics stores nothing on your device.
5. Product analytics
To learn how the game is played and what to improve, our server sends usage events to PostHog (EU cloud, Frankfurt). Examples: a game was started or finished (mode, score, duration), a question was reported, the daily result was shared, or how long the first question took to load. Each event carries your guest id (no name or email), your country and device type (phone or computer), which we derive from your request, and how you found us (the campaign tags from §2). Our server never passes on your IP address. Visits before your first game are counted without any id.
Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in understanding and improving the game. PostHog keeps events for 12 months (its free plan). If you ask us to delete your data (§9), we delete your analytics profile too.
You can object at any time (Art. 21 GDPR). After that, this browser sends no analytics at all. If your browser sends Global Privacy Control, we treat it as an objection.
6. Feedback survey
When you open “Feedback”, the survey is loaded from PostHog (EU cloud, Frankfurt). It stores nothing on your device. What you write is linked to your guest id.
7. Service providers and hosting
- Cloudflare (hosting and network). Server logs with IP addresses are kept briefly for security.
- Supabase (database and guest accounts), EU region Frankfurt.
- PostHog (product analytics and the feedback survey), EU region.
Each processes data on our behalf under a data processing agreement (Art. 28 GDPR). Where data may reach the United States, the transfer is covered by the EU–US Data Privacy Framework or standard contractual clauses.
8. How long we keep data
- Games are kept while the game runs, because they are replayed as recorded runs.
- Guest accounts that are inactive for 12 months may be deleted, together with their games.
- Feedback and question reports are kept until they have been dealt with.
- Analytics events are kept for 12 months.
9. Delete your data
You can delete everything this browser's player has stored with us: games, ratings, streak, challenge links and email settings. It takes effect at once and can't be undone. Analytics events are pseudonymous and are deleted after 12 months; to have them deleted sooner, email us.
You haven't played on this browser, so there is nothing here to delete.
10. Your rights
You have the right to access, correct and delete your data, to restrict or object to its processing, and to data portability (Art. 15–21 GDPR). You can also complain to a data protection supervisory authority, for example the one where you live.
To delete your data, use “Delete my data” above. For everything else, email geophy.game@gmail.com. Because guest accounts have no name or email, tell us roughly when and on which device you played so we can find your account.
11. Changes
When the game changes what it stores, we update this page and the date at the top.