Privacy Policy

1. Overview

NameThat is a free guessing game with no user account. We process as little data as possible:

• no login, no registration, no email address;
• no advertising, no web tracking, no analytics or statistics services (e.g. no Google Analytics);
• no sharing of data for advertising purposes;
• two strictly necessary cookies: nt_uid (a random device identifier so your game progress is kept without an account) and nt_lang (your chosen interface language).

2. Controller

The controller for data processing on this website is the person named in the imprint. Contact for data protection matters: support@namethat.de.

3. Hosting and server log files

This website is hosted by name of the hosting provider. When the pages are accessed, the host automatically processes information that your browser transmits (so-called server log files): IP address, date and time of the request, URL accessed, amount of data transferred, referrer URL, browser type and operating system.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a technically sound and secure operation of the website). A data processing agreement pursuant to Art. 28 GDPR is in place with the host (add status / link).

4. Cookies

NameThat sets two cookies, both strictly necessary:

• nt_uid – a randomly generated identifier (UUID). Purpose: to associate your game progress (streak, statistics, rounds played) with a device without you having to create an account. The cookie is HttpOnly (no access by scripts), is only sent to our own server (SameSite=Lax) and expires after one year.
• nt_lang – your chosen interface language (en or de). Pre-filled once from your browser’s language on the first visit, changeable any time with the in-app switch. SameSite=Lax, expires after one year. It holds no personal data.

Both cookies are strictly necessary to provide the service you have explicitly requested (a game with ongoing statistics, in your language); they are therefore stored without consent on the basis of § 25 (2) no. 2 TDDDG. Any subsequent processing is based on Art. 6(1)(f) GDPR (functionality of the game).

Because no cookie is used for marketing, tracking or analytics purposes, there is no cookie consent banner. You can delete the cookies at any time via your browser settings; your statistics then start again from zero.

5. Local storage in the browser (localStorage)

For small convenience features (e.g. keeping a dismissed hint dismissed, or remembering the last filter selection) NameThat stores values in your browser’s local storage. These values remain exclusively on your device and are not transmitted to us.

6. Game statistics database

Linked to your device identifier (nt_uid) we store on our server: rounds and marathons played, points scored, your endless streak, and the titles of the songs or names of the people that appeared in your rounds. No real names, contact details or other personal information about you is stored.

Legal basis: Art. 6(1)(f) GDPR (providing the “leaderboard/streak/progress” game features).

Retention: if a device (nt_uid) shows no activity for 12 months, all data linked to it — rounds, matches, streaks, multiplayer history and any display name — is deleted automatically and completely. There is no fixed deletion date: playing again at any point resets the 12-month clock. Deletion runs automatically on our server; you do not need to request it.

7. Leaderboards

NameThat shows public rankings (top 100 per category and game mode). These display a display name and the value achieved (current streak, rounds won, or best marathon score). The display name is generated automatically from the device identifier the first time you play (e.g. “Swift Otter 42”); you can change it at any time on the leaderboards page. A real name is not required.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a motivating, comparative game feature). You can object to the display at any time: the leaderboards page has a “Show me on the leaderboards” switch — turning it off means you disappear from all public rankings. Deleting this website’s cookies has the same effect.

8. Multiplayer lobbies

In Marathon mode, in NameThat Drawing and in NameThat Word you can join a lobby with other people (private via code or public). As long as the lobby exists, the other members see your display name (the same one as on the leaderboards) and your game activity in real time — in Marathon the score state (solved / not solved, points), in NameThat Drawing the picture you draw and whether you guessed the word, and in NameThat Word your team and the revealed cards and clues. There is no chat (only a guess or clue field; wrong guesses stay private) and no further profile data. The lobby state — including drawings and game cards — is held only in our server’s memory and is not stored; the lobby is discarded once the game ends.

From the completed run we store — as with the game statistics — only anonymous key figures (device identifier, lobby code, category, points, ranking, number of players). These values do not feed into the public leaderboards, only into your own history. The legal basis is Art. 6(1)(f) GDPR. If you do not want other players to see your name, simply do not join a lobby, or change your display name.

9. Music clips (Deezer)

In the “NameThat Song” category, 30-second preview clips are played. The URL is requested from the Deezer API via our server; the audio data itself is then loaded directly by your browser from servers of Deezer S.A. (12 Rue d’Athènes, 75009 Paris, France). Your IP address is transmitted to Deezer in the process. We have no influence over this processing by Deezer.

Legal basis for the integration: Art. 6(1)(f) GDPR (providing the game). Deezer’s privacy information: deezer.com/legal/personal-datas.

10. Photos of people (Wikimedia Commons)

In the “NameThat Person” category, the photos originally come from Wikimedia Commons. Your browser does not connect to Wikimedia: our server fetches each image once, caches it, and serves it to you from our own domain (/api/wm-image). Your IP address is therefore not transmitted to the Wikimedia Foundation (USA) — there is no third-country transfer for this feature.

Legal basis: Art. 6(1)(f) GDPR. Our server’s one-off fetch from Wikimedia (to build and refresh the cache) does not involve your data.

11. Fonts

The fonts used are downloaded when the website is built and served from our own server (next/font). There is no connection from your browser to Google Fonts or other external font services.

12. No automated decision-making

There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

13. Your rights

Under the GDPR you have the following rights: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21).

Since we only know you via the anonymous device identifier nt_uid, we cannot link you to any record without that identifier (Art. 11 GDPR). The easiest way to exercise your right to erasure yourself is to delete this website’s cookies and local storage in your browser — this severs the link to the statistics data stored on the server.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), e.g. the authority responsible for your federal state.

14. Changes to this privacy policy

We adjust this policy whenever the data processing changes — for example through new features. The version published here with the date given above always applies.