Datenschutzerklärung

Privacy policy

Guesstimate is built to collect as little as possible. There are no cookies, no ads and no tracking across other websites. This page explains what is stored, why, and how to delete it.

1. Who is responsible

The controller under the General Data Protection Regulation (GDPR) is Essa Ahmad. The full postal address is in the Impressum. For anything about your data, email [email protected].

2. When you open the website

The website is hosted and delivered by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (Cloudflare Pages and Cloudflare's network). To deliver the pages and protect the site from attacks, Cloudflare receives technical data from your browser: your IP address, the time, the page requested and your browser type. Cloudflare keeps this only briefly in security and error logs.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is delivering the website reliably and securely. Cloudflare processes this data on our behalf under a data processing agreement (Art. 28 GDPR). Cloudflare is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has issued an adequacy decision (Art. 45 GDPR), and the agreement also includes the EU Standard Contractual Clauses. More in Cloudflare's privacy policy.

The fonts and scripts the game uses are served from this website too. Your browser does not contact Google Fonts or other outside content networks when you play.

3. What the game saves on your device

The game uses your browser's local storage, not cookies, to remember things on your own device:

• your progress, today's result, your streak, games played and best scores;
• a random guest ID and the name you chose for the leaderboard;
• whether you chose to play as a guest;
• if you're signed in, a sign-in token so you stay signed in.

This is needed for the game to work the way you asked it to (§ 25(2) no. 2 TDDDG; Art. 6(1)(b) GDPR). It stays on your device until you clear this website's data in your browser settings. Clearing it as a guest resets your streak and scores.

4. The daily leaderboard

When you post a daily score, we store the name you chose, your total and round points, details of each round (your guesses and the correct answers), a random player ID and the time. Your name and score are shown publicly on that day's leaderboard. As a guest, once you've posted, your later daily scores are posted automatically under the same name.

Legal basis: Art. 6(1)(b) GDPR, because you choose to take part in the leaderboard. Scores are kept so past boards and streaks keep working. To have a guest score removed, email us the name and the date.

5. Accounts

If you create an account, we store your email address, your password (only as a secure hash, never in readable form), your leaderboard name, your scores, and the time you signed up and last signed in. Our sign-in provider also keeps technical logs, including IP addresses, to protect accounts from abuse. We send you emails only to confirm your address or reset your password. They are sent from [email protected] through Resend, Inc. (USA), using its EU servers in Ireland, under a data processing agreement with Standard Contractual Clauses.

Legal basis: Art. 6(1)(b) GDPR, to provide the account you asked for. Accounts are for people aged 16 and over.

Deleting your account: sign in, open your account and choose Delete account. This immediately removes your account, your name and all your scores. You can also ask us by email.

Signing in with Google

If you choose "Continue with Google", Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, confirms who you are and sends us your email address, your name and your profile picture address. These are stored with your account, but the game only uses your email address; your leaderboard name is the one you choose. Legal basis: Art. 6(1)(b) GDPR. Google's handling of your data is described in Google's privacy policy.

6. Where leaderboard and account data is stored

Leaderboard and account data is stored with Supabase, Inc. (USA), on servers in Ireland (EU). Supabase processes the data only on our behalf under a data processing agreement (Art. 28 GDPR). Where Supabase staff or systems outside the EU may access it, the agreement includes the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

7. Visitor statistics

To know how many people play, we use Cloudflare Web Analytics, also from Cloudflare (see section 2). It counts page views without cookies, without storing anything on your device and without fingerprinting. It records the page visited, the referring website, the browser and device type, the country and how fast the page loaded. Your IP address is used to deliver the request but not to identify you.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is understanding how the game is used, in a privacy-friendly way. Cloudflare is certified under the EU-U.S. Data Privacy Framework.

8. Ads

There are currently no ads on Guesstimate. If we add ads, we'll update this policy first and ask for your consent where the law requires it.

9. Your rights

You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16), deleted (Art. 17) or restricted (Art. 18), to receive it in a portable format (Art. 20) and to object to processing based on legitimate interests (Art. 21). Email us to use any of these rights.

You also have the right to complain to a data protection authority (Art. 77 GDPR), for example the one where you live or the one for the German federal state where we're based.

We don't make automated decisions about you or build profiles.

10. Changes

We update this policy when the game changes, for example if ads are added. The current version always lives on this page.

Last updated: 31 October 2026