Privacy

The short version: you can play without an account, nobody is tracked, there are no ads, and an account stores your quiz progress together with a fingerprint of your email address, not the address itself.

Visiting the site

The site is delivered by Cloudflare (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). To deliver a page, Cloudflare's servers process your network address (IP address), the page requested and technical details of your browser, and may do so on servers outside the EU. The legal basis is the legitimate interest in running the site securely and reliably (Art. 6(1)(f) GDPR). See Cloudflare's privacy policy.

Typefaces, maps and place data are served from this site itself. No third-party analytics, advertising or social media code is loaded.

Counting visits

To see whether the site is used at all, the server keeps daily totals: how many different visitors opened the quiz that day, and how many games were started in which script and mode. To tell one visitor from another within a day it uses a salted hash of the network address that changes every day; the address itself is not stored, and the hashes are deleted when the next day's counting begins. Visits on different days cannot be linked, no cookie is set and nothing is stored on your device for this. The legal basis is the legitimate interest in knowing how much the site is used (Art. 6(1)(f) GDPR).

Playing without an account

Your progress and settings (script, mode, theme) are kept in your browser's local storage on your device. They are not sent to the server. You can remove them by clearing the site's data in your browser.

Accounts

An account is optional. You create it with an email address and a password. The server stores:

• a keyed fingerprint (a one-way hash) of your email address. The address itself is not stored: it cannot be read from the database, and the site cannot write to you on its own;
• a salted hash of a key that your browser derives from your password. The password itself is never sent to the server;
• your quiz progress: which places you have recognised or spelled, your best streaks, records and trophies;
• the dates on which the account was created, last used and last saved.

The legal basis is the provision of the account you asked for (Art. 6(1)(b) GDPR).

Mails. When you create an account or ask for a new password, one mail with a link is sent to the address you typed. For this, the address is passed to the mail service Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA), which delivers the mail and keeps a record of it (recipient, subject, time) according to its own retention rules; see Resend's privacy policy. A sign-up that is not confirmed within 24 hours is deleted; a password link works for one hour.

In your browser. While you are signed in, a cookie named cg_s keeps you signed in for up to one year. It is strictly necessary for the account and is not used for anything else; signing out removes it. Your browser also remembers the address you signed in with, so that the Account window can show it. That stays on your device.

You can delete your account at any time in the Account window; this removes everything listed above at once. Accounts that never saved any progress are deleted after 30 days, and accounts that were not used for two years are deleted as well.

Protection against abuse

To limit automated sign-ups, password guessing and unwanted mails, the server counts attempts per network address and per email fingerprint. It does not store the address itself but a salted hash that changes every day, and it keeps these counts for one day at most.

When you create an account, ask for a new password or send an error report without being signed in, a bot check by Cloudflare Turnstile may run. For this, Cloudflare processes your network address and technical details of your browser. The legal basis is the legitimate interest in protecting the site from abuse (Art. 6(1)(f) GDPR). See Cloudflare's Turnstile privacy information.

Error reports

If you send an error report, the text you write and the details of the sign it is about (script, place, mode, your answer) are stored so that mistakes can be corrected, for up to two years. Please do not put personal information into a report.

Your rights

You have the right to access, correct or delete your data, to restrict or object to its processing, and to receive it in a portable form. To get in touch, use "Report an error" in the quiz. You also have the right to complain to a data protection authority.