Privacy & Legal
This page explains what personal data Guess the Colour stores, why it is stored, how the account system works, and how you can exercise your privacy rights under the GDPR.
1. Data controller
2. What data is processed
Guess the Colour collects only the data needed to operate the game and the optional account system:
- nickname
- game mode, difficulty, challenge type, and daily challenge date where relevant
- guessed colours, original target colours, round results, final scores, and total time
- challenge identifiers, participant identifiers, and session identifiers
- if you create an account: email address, nickname, password hash, verification status, signup timestamp, accepted privacy/terms policy version, and optional analytics consent timestamp
- single-use hashed password reset tokens and hashed email verification tokens, with expiry timestamps and request metadata
- pseudonymised security data such as hashed IP information, user agent, and auth-related security events for abuse prevention and troubleshooting
- basic technical request data normally created by the web server, such as IP address, request time, browser details, and accessed URL
3. Why this data is processed
- to run the game and calculate scores
- to save finished runs and show leaderboards
- to create and resolve direct duels and group battles
- to create, verify, secure, and maintain player accounts
- to provide password reset, account export, and account deletion features
- to protect the technical operation of the website and investigate errors or abuse
4. Legal basis
Data is processed on the basis of the operator's legitimate interest in providing a working online game, challenge flow, and secure account system, and where relevant to perform the service requested by the player when creating an account, joining a challenge, or saving a score. Optional analytics are not loaded before consent and are only relevant if they are added in the future.
5. Hosting
This website is hosted with IONOS in Germany. Server logs and technical request information may be processed by the hosting provider as part of normal website operation, security, and troubleshooting.
6. Public visibility of scores
Your nickname, score, total time, and where relevant the date of a daily challenge may be visible to other players through leaderboards or shared challenge links. The data is not sold and is not used for advertising.
7. Cookies and sessions
The website uses strictly necessary session cookies for secure sign-in, CSRF protection, and account management. These cookies are marked HttpOnly and use secure settings in production. The site does not load tracking or analytics before consent.
8. Storage period
Game results and challenge data are stored for as long as they are needed to operate the game, resolve challenges, and display leaderboards, or until a valid removal request is received. Account records remain stored until the account is deleted. Password reset and email verification tokens expire automatically and are single-use. Security logs are kept only as long as reasonably necessary for abuse prevention, troubleshooting, and legal defence.
9. Your rights
You may request access to stored personal data, correction, deletion, restriction of processing, or object to certain processing where applicable under the GDPR. You may also lodge a complaint with a competent supervisory authority.
10. Accounts, deletion, and export
If you create an account, you can update your nickname, email address, and password from the account page. You can also delete the account there. Account deletion removes access to the profile and replaces identifying profile fields with anonymised placeholders where possible. You can request an export of the account data stored for you from the account page as well.
If you want a leaderboard result or challenge entry removed, email contact@guess-the-colour.com and include the nickname, challenge link, or other identifying detail so the relevant record can be found.