What this site records, and what it cannot

Who is responsible for this

This site is run by one person rather than a company: Victor Lipov, a sole trader in Portugal. He decides what is recorded here and what it is for, which is what makes him the one answerable for it, and he reads privacy@howsureami.com.

There is no data protection officer, and no separate representative standing in for anyone abroad. A site this size is required to appoint neither, and the address above reaches the person who makes these decisions rather than a department.

What stays on your device

Your round history — which positions you were dealt, what you chose, and the profile drawn from them — is written to this browser's own storage and read back by this browser. It is not sent anywhere and there is no copy of it here. Clearing this site's data in your browser deletes it, and once you have there is nothing left for us to delete.

What the site records, from the moment a page opens

Recording starts when a page opens, not when you start playing: on the pages that carry the product — the front page and a round of ten positions — the first row is written as that page loads, before you have touched anything and whether or not you ever touch anything. Those are the only pages here that write a row at all; every other page, this notice included, records nothing as you read it. Two kinds of thing are written from there. A decision becomes a row of its own: which position was shown, which of the two options you picked, which one ground truth said, how far apart they were, how long you took, and the confidence you stated. And the reading itself is written the same way — how far down a page you got, what you did with the controls it offers you, where you stopped, and how long each of those took. The rows a page writes are grouped by a key belonging to that page alone, so arriving on the front page and then playing a round leaves two sets of rows with nothing joining them. A browser with JavaScript switched off writes none of it, because every one of these rows is written by script running in yours.

What is not in those rows: your IP address, your browser's user agent, a cookie, an account, a device identifier, or anything from a third-party analytics service, because there is no third-party analytics service here. A round is grouped by a key generated at random in your browser, never stored there, and thrown away when the round ends.

Two facts about what you have played do travel with the rows a round writes, and we would rather name them than let this page read as a stronger claim than the code makes: which ten positions you were dealt, and roughly how many rounds you have finished — as a band, never the exact count. The rows the front page writes carry neither: nothing has been played there, so there is nothing to derive.

Nobody is asked to agree to any of this, so agreement is not what we are relying on. What we are relying on is that the site does not exist without these rows, and the two kinds are relied on for two different things. The decisions are the measurement: every crowd figure, every comparison and every report here is computed from them, and a decision trainer that measures nothing has nothing to say. The rows about reading are no part of that and never will be — nothing published on this site is computed from one of them. They are how we tell whether a page does the job it was written for: where it loses people, and whether a change we made helped. Weighed against both is what the rows actually are — no name, no address, no IP, nothing pointing back out at a person. And if you would rather add nothing at all, stopping part-way is not it: leaving is itself the last thing recorded, because the row saying where you got to is written as you go. Nothing is written after that, and a browser with JavaScript switched off writes nothing here in the first place.

We keep those rows indefinitely and no period has been set for either kind. The decisions are the measurement this site is built on. The rows about reading are kept because we have not decided what a shorter life for them would be, and we would rather say that than imply a period we do not enforce. None of them carries a name, address or contact detail, and if any of this changes this page changes with it.

We cannot tell which rows are yours

That is a statement about what we are able to do, not a promise about what we intend. No row we write holds an IP address, and neither does any log we keep: our own logs record which route was called, whether it worked and how long it took, and stop there. What groups a round is a key your browser invents and then discards, so there is nothing in our database pointing outward at a person.

What we cannot speak for is the traffic on its way here. Every request to this site passes through Cloudflare, which can see the address it came from — and because it carries that traffic on our instructions rather than as a stranger, we would rather say so than write a sentence that quietly leaves it out. We have no way to read those records: the plan this site runs on does not offer them. Nothing in them carries the key that groups a round either, so joining the two would mean building a link out of timing alone.

The consequence is worth being blunt about. If you asked us for a copy of your decisions, or asked us to delete them, we could not find them — not because we would refuse, but because we cannot tell them apart from anybody else's. The key that grouped your round is gone. The one thing you can always do without us is clear this site's data in your browser.

You can object to us recording it

We are relying on our own interest here rather than on your agreement, and that gives you the right to object to the whole of it. This sits on its own because a right buried in a list is one nobody reads. Write to privacy@howsureami.com.

Then the limit, stated rather than discovered: the section above is true, so we could not find your rows to stop them, and we would have to tell you that. What an objection does reach is the practice itself — whether the site should record this way at all — and that is a question we will answer.

If you leave an email address

One box on this site takes personal data: the save-progress door at the end of a round. It stores the address and the language you were reading in, and nothing else. It is not given your history — the box cannot attach a round to an address, because it is never handed one.

The purpose is a single message telling you that saving progress exists, if it ever does. No newsletter and no other use, and it is never sold or handed to anyone to use for their own purposes. That is not the same as saying nobody else ever touches it — the next section says who does.

We hold it only because you chose to leave it, and that is the whole of the reason — there is nothing else underneath it. You can take that permission back whenever you like, and here withdrawing it and asking for the address to be deleted are the same act, because the address is all there is.

We delete the address twelve months after we first see it, or on the day the feature ships and that message goes out — whichever comes first. Leaving the same address again does not restart the clock.

To have it removed before then, write to privacy@howsureami.com. Tell us which address to remove; that is all we need, and it is all we are able to act on.

Deletion is not the only thing you can ask for. The address is the one thing on this site that points at a person, so the rest applies to it in full: a copy of what we hold, a correction if it is wrong, a stop on using it while a question is open, an objection to our using it at all, and a copy in a form you could take somewhere else. What there is to copy is one address, one language, the wording you were shown and the date it arrived.

Who else it passes through

The site runs on a server we rent from Hetzner in Germany and sits behind Cloudflare, which serves the pages and sees requests on their way through. Those two are the only recipients of anything the site stores. Writing to us reaches a third: the address on this page is a forwarding alias, carried by Cloudflare into a mailbox hosted by Migadu — a Swiss company whose mail servers are in France — so a request you send us, and the address inside it, passes through both. Nothing is sold, and there is no advertising network and no tracking pixel on any page.

Cloudflare is a United States company with machines all over the world, so a request you make may well be answered from outside Europe, even though the database holding the address sits in Germany. The safeguard relied on for that is the European Commission's standard contractual clauses, which Cloudflare's data processing addendum incorporates and which attach to our account through the terms it is part of. Cloudflare separately holds a Data Privacy Framework certification; the clauses are what this page names, because a contract does not lapse on a renewal date. Mail is a different path and it does not leave Europe at all — the mailbox behind the address on this page sits in France.

If you think this is wrong

You can complain to a data protection authority, and you do not have to raise it with us first. Ours is the CNPD — the Comissão Nacional de Proteção de Dados — in Portugal, because that is where the person running this site is. If you live elsewhere in the EU, the authority in your own country will take the complaint just as well.

Getting in touch

Everything on this page is handled at privacy@howsureami.com.