Privacy
Updated 14 October 2026. Controller: Dirk Ohlmann, Konrad-Adenauer-Straße 4, 56564 Neuwied, Germany. Contact: dohlmann1810@gmx.de.
Website hosting
Cloudflare Pages delivers this website; Pages Functions handle game and account requests and Cloudflare D1 stores the application data. Cloudflare receives necessary connection information, including IP address, requested URL, time and browser information, to deliver and secure the service. The application database was created with the EU jurisdiction restriction. This does not mean that every network or request-processing operation takes place exclusively in the EU.
Provider: Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Hosting can involve processing outside the European Economic Area. Details on international transfer safeguards and provider retention are in Cloudflare’s privacy policy and data processing addendum. The purpose is reliable delivery and security, based on our legitimate interest under Article 6(1)(f) GDPR.
Guests, accounts and passkeys
You can play as a guest with a nickname. An account stores an internal ID, username, public passkey and credential identifier, verification metadata, recovery-code hash, game attempts and earned points. Your device keeps the private key; this website receives no fingerprint, face image or other biometric data. No email address or date of birth is required for an account. Recovery codes are shown once and are replaced when used; recovery revokes existing sessions and passkeys.
These data provide the game, maintain your account and preserve the score you requested, under Article 6(1)(b) GDPR. A necessary HttpOnly session cookie keeps you signed in for up to 30 days. The server stores a hash of its session token. We use no advertising or analytics cookies, advertising trackers, social-media scripts or browser storage for advertising.
Scores and shared challenges
Public rankings show registered usernames and points. Anyone given a challenge link or code can see its nickname list, teams and scores and join while it is open. Choose a nickname rather than personal contact information, and share invitations with the people you intend. Challenges accept play for 24 hours. Rankings are recreational and have no prizes; no automated profiling or decisions with legal or similarly significant effects are made.
Retention, export and deletion
Account scores and game history remain until you delete your account. The account menu lets you export your data and delete the account, sessions, passkeys and dependent challenge data. Expired sessions are removed during cleanup. Guest accounts without a valid session and older than two days are removed when a new guest session triggers cleanup; because guest sessions may last 30 days, closing the browser alone does not immediately delete the server record. Closed challenge data may remain in the related account history until account deletion or guest cleanup. Cloudflare’s Free D1 recovery history can retain an earlier database state for up to seven days; deleted data are not brought back into ordinary use intentionally.
For abuse prevention, the server stores a hash derived from the IP address with request counts and short time buckets. This is pseudonymised rather than anonymous. Expired rate-limit records older than one day are removed on guest-session cleanup; actual deletion depends on subsequent service activity. Security processing is based on Article 6(1)(f) GDPR.
Media and external destinations
Current fonts, design images and scripts load from this website. Imported memes and videos may use their own HTTPS media host; loading such media can transmit connection data to that host. An item’s licence and source are shown where available. External links open the relevant service when you click them; its own privacy terms apply. The library is currently waiting for reviewed bilingual content.
Your rights and contact
Subject to the applicable conditions, you have rights to access, correction, deletion, restriction, data portability and objection to processing based on legitimate interests. Contact the controller above for requests that the account controls do not cover. You can complain to a supervisory authority, including the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz: datenschutz.rlp.de. More information: European Commission: individual data protection rights.