Privacy

The security check

Before your first guess, the browser fetches a security check from Cloudflare. It is called Turnstile. This happens when you go to the guess field. The check protects the game against automated programs. Its answer is not kept. For the administrator’s account, it is never fetched. It is also never fetched once you have guessed without an account in the browser. The legal basis is legitimate interest (GDPR Article 6(1)(f)).

Visits are counted without names

Visits without an account are counted in the app’s own database. This covers the start page, the pages under About GuessAtlas, Feedback, Today and the games. Only a number per page, day, screen width and language is kept. The first page also counts where you came from, such as LinkedIn or Google. Only the source’s name is kept, never the address you came from. No cookie is kept, and nothing is kept in your browser. The visit count never keeps the IP address. It keeps only a key worked out from the IP address. The key is removed within about an hour. It stops anyone from making the count look bigger than it is. The app also counts how many different visitors come each day. For that, a second key is made from the IP address and the browser’s name. It is mixed with a random number that changes every day. The random number is removed at the first visit on a later day. The backups keep it for up to 30 days. Without the random number, the key cannot be linked to you. No analytics service gets any of it. The count and the keys exist to count visits correctly. The legal basis is legitimate interest (GDPR Article 6(1)(f)).

The administrator’s account

Only the administrator, who runs the app, has an account. The account holds a name, a Google address and games. The app also counts how many have played and opened it. The count shows whether the app is used. No analytics service gets any of it. Only the administrator sees the account’s name and results. The statistics never show names. The legal basis for the counting is legitimate interest (GDPR Article 6(1)(f)).

Today’s shared results

Once you have finished a game, you can open “How it went for everyone” in the finished game. It counts every finished play of that game today, in every language. It shows how many solved it in each number of guesses, and in Border Trip at each number of points. It also shows how many did not solve it. It shows from the first finished game. When a day has ended, the app keeps that day’s counts per game, without names. From them the day’s total points are also counted in coarse ranges. The kept counts are not shown on any page. The statistics exist to show how the day went, without names. The legal basis for the statistics is legitimate interest (GDPR Article 6(1)(f)).

Language and game cookies

Your language choice in the menu is kept in the cookie ga_lang for a year. It holds only the code “en” (English), “sv” (Swedish) or “pl” (Polish). A browser where the administrator’s account has been used also gets the cookie ga_seen. It holds only the digit 1 and stays for up to 400 days. It does not say who played. Without a chosen language the app starts in Swedish if the cookie ga_seen is there. Otherwise your browser’s language decides: English, Swedish or Polish. Any other language gives English. Your browser’s language setting is not stored. Your location is never used to choose the language. The appearance and reduced motion choices stay in the browser, without a cookie. The cookies exist to show and remember your language. The legal basis is legitimate interest (GDPR Article 6(1)(f)).

The games use two more cookies. When you have finished a game, today’s date and the game are kept in the cookie guessatlas_done. The page then shows the finished game at once while it reloads. When you change how the guesses are sorted, for example to Closest, today’s date and the choice are kept in the cookie guessatlas_sort. Both stay for two days. They hold nothing about your guesses, today’s answer or who you are. The cookies exist to show the game as you left it. The legal basis is legitimate interest (GDPR Article 6(1)(f)).

Feedback

What you write on the Feedback page is kept in the app’s own database. With the message, the app keeps what it is about, the page’s language and the time. The text is kept as you wrote it. Before you send, what you have written is kept only in this browser tab, so it is still there if you go back and forward. It is removed when you send, empty the field or close the tab. The message is also sent by email to the GuessAtlas inbox at Gmail, so Google keeps it too. You don’t need to give your name or email. No id, IP address or browser details are kept with it. When you send without an account, the browser fetches the Turnstile security check from Cloudflare. A message is deleted from the database and the inbox after twelve months. The messages exist to make the app better. The legal basis is legitimate interest (GDPR Article 6(1)(f)).

Error reports

If an error occurs, the app may send an error report to Sentry. The report has no name, email address or cookies. The reports exist to find and fix faults. The legal basis is legitimate interest (GDPR Article 6(1)(f)).