Privacy policy

1. Controller

Softure UG (haftungsbeschränkt), Scharfenberger Str. 28, 13505 Berlin, Germany, represented by its managing director Mohamed Hamda. E-mail: [email protected]. We are not required to appoint a data protection officer; please send any questions to this address.

2. What we store and why

• a random player ID (UUID) and a 6-character recovery code (“My code”), neither of which relates to you as a person,
• a randomly generated nickname (your own names are not possible by default),
• whether you “grew up here” or “moved here”, per country,
• optionally a country of origin (only the country, no city),
• your answers, scores and the timestamps of your rounds,
• voluntary reports about questions (optionally with a short text).

The legal basis for the player ID, nickname, answers and scores is Art. 6(1)(b) GDPR (providing the game you use) and Art. 6(1)(f) GDPR (our legitimate interest in fair leaderboards free of abuse).

“Grew up here / moved here” and the country of origin are voluntary. We do not ask about ethnic origin, religion, skin colour or nationality. Because a country of origin might in individual cases allow conclusions about ethnic origin, we process this information only with your explicit consent (Art. 6(1)(a), Art. 9(2)(a) GDPR), which you give by selecting it. You can withdraw it at any time with effect for the future (see section 8). If you prefer not to give a country, choose “Prefer not to say” – you can still play without any restriction.

3. What is public

• On the top list: your random nickname, score, duration and – if given – the flag of your country of origin.
• In all statistics (groups, categories, countries, questions): averages only. A group or country of origin appears once at least 5 people took part.

As nicknames are random and we collect neither names nor contact details, an entry cannot be linked to a specific person.

4. Cookies

We only use strictly necessary cookies (§ 25(2) no. 2 TDDDG), no tracking or advertising cookies – which is why there is no cookie banner.

• pid: signed player ID so your browser keeps your nickname and stamps (up to 20 years or until you delete it),
• locale: your chosen language,
• edition: the country you last chose,
• practice_seed: a random number so practice questions only repeat once you have seen every question of a topic,
• a session cookie with a token that protects forms against forgery (CSRF).

5. Servers, IP addresses and security

Our application stores no IP addresses, neither in its database nor in its logs. To prevent abuse (e.g. mass requests) we count requests per device for at most one hour, using a shortened, daily re-salted hash instead of the IP address, from which the IP address cannot be recovered (Art. 6(1)(f) GDPR). All connections are encrypted via HTTPS.

The application is hosted by Contabo GmbH, Welfenstraße 22, 81541 Munich, Germany, on servers in the European Union, under a data processing agreement pursuant to Art. 28 GDPR. To establish the connection, the server processes your IP address only transiently in memory.

To protect against attacks (e.g. DDoS) and for faster loading, traffic runs through the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare processes technically necessary connection data such as IP address, browser identifier and requested address to forward requests and fend off attacks; content is served from data centres close to you where possible. The legal basis is our legitimate interest in a secure, available service (Art. 6(1)(f) GDPR) and a data processing agreement pursuant to Art. 28 GDPR. Cloudflare is certified under the EU-US Data Privacy Framework (Art. 45 GDPR); the EU Commission’s standard contractual clauses apply in addition. Cloudflare also tells us the country a request comes from; we only use it to suggest the right quiz and do not store it.

6. Use of AI

Quiz questions are created and checked in advance with the AI service Claude by Anthropic, PBC (USA). No player data is transmitted. There is no AI processing while you play.

8. Retention, deletion and withdrawal

Player data is kept as long as the game is offered. Send your code (“My code”, shown in your passport) to [email protected] and we will delete your nickname, information and rounds completely, or remove only your country of origin – as you prefer. Group values that are already published no longer contain personal data.

9. Minimum age

The service is intended for people aged 16 and over. Younger people may only give the voluntary information about origin with their parents’ consent.

10. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability, withdrawal of consent and objection to processing based on legitimate interests (Art. 7(3), Art. 15–21 GDPR). You may also lodge a complaint with a data protection supervisory authority, e.g. the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin, Germany.