Privacy Policy

The controller for data processed on this website is:

Musicguesser — Niclas Klimt c/o Online-Impressum 10536 Europaring 90 53757 Sankt Augustin Germany musicguesser@mail.online-impressum.de

The controller decides why and how personal data is processed here. You can use any of the contact routes above for any question in this policy, including to exercise the rights described in section 11.

MusicGuesser is a music guessing game. You can play it without an account and without giving any personal data beyond what any web request necessarily reveals.

There is no analytics, no advertising, no tracking pixels, no social media plugins, and no third-party scripts of any kind. Fonts are served from this site, not from Google. Nothing you do here is used to build a profile of you or sold to anyone.

The one third party your browser does contact is Deezer, which supplies the song snippets and cover art. Section 9 explains what that means.

If you create an account, that is in order to save your results, streak and rank — which is the entire purpose of having one.

The site runs on the infrastructure of Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Server-side processing for this site is configured to run in Vercel's Frankfurt region (fra1).

The database is provided by Neon Inc., 209 Orange St, Wilmington, DE 19801, USA, and is hosted in the AWS region eu-central-1, Frankfurt am Main.

Both companies act as processors under Art. 28 GDPR on the basis of data processing agreements. Both are incorporated in the United States, so access from there cannot be entirely excluded; where such a transfer occurs it is covered by the EU Standard Contractual Clauses under Art. 46(2)(c) GDPR. The stored data itself resides in the European Union.

Legal basis: Art. 6(1)(f) GDPR. Operating a website requires a host, and our legitimate interest is in providing it reliably and securely.

Our hosting provider automatically records technical information that your browser transmits with every request: IP address, date and time, the page requested, referrer, browser type and version, and operating system.

This data is not merged with other sources, is not used to identify you, and serves only to deliver the site, keep it stable, and investigate abuse or attacks. Legal basis: Art. 6(1)(f) GDPR. Log data is retained only briefly and then deleted or aggregated by the hosting provider.

This site sets no advertising, analytics or tracking cookies. Everything it stores on your device is needed to provide the function you asked for, which is why you are not shown a consent banner: § 25(2) No. 2 TDDDG exempts storage that is strictly necessary for a service the user has expressly requested.

The complete list is:

• __Host-authjs.csrf-token — protects the sign-in form against cross-site request forgery. Set for everyone who visits a page with a sign-in option; expires with the browser session.
• __Secure-authjs.callback-url — remembers which page to return you to after signing in.
• __Secure-authjs.session-token — set only once you sign in. It contains a random session identifier, not your data, and is what keeps you signed in. Signing out deletes it.
• snippet-volume — stored in your browser's local storage, not a cookie, and only once you move the volume slider. It holds a single number so the player does not reset to the default volume on every round. It never leaves your device and is never sent to us.

You can delete all of these at any time through your browser settings. Removing the session cookie signs you out; removing the volume value resets the player to its default.

You can play the daily challenge and endless mode without signing in. In that case nothing about your game is stored: no result, no streak, no rating. Rounds played as a guest are not written to the database at all. The only processing is the server logging described in section 4.

An account can only be created by signing in with GitHub or Google. We never see or store a password.

When you do, we receive and store from that provider:

• your name as held by the provider,
• your email address,
• the URL of your profile picture,
• the account identifier at that provider, plus the access and refresh tokens needed to complete and maintain the sign-in.

Legal basis: Art. 6(1)(b) GDPR — processing necessary to provide the user account you requested.

Choosing to sign in with one of these providers means your browser contacts them and they learn that you are signing in to this site. That processing takes place under their own responsibility and their own privacy policies: GitHub, Inc. (a Microsoft company, USA) and Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Both are certified under the EU-U.S. Data Privacy Framework. If you would rather not involve them, you can play without an account.

Once you have an account, we store the results of your play:

• per round: which track it was, how far you got, whether you won, how many guesses you made, the rating change, and when it happened;
• per daily challenge: whether you won and at which stage;
• your rating, highest rating reached, number of rated rounds, and unlocked achievements;
• a nickname and avatar choice, if you set one.

Legal basis: Art. 6(1)(b) GDPR. Streaks, ranks and statistics cannot exist without keeping the results they are calculated from.

Your rating is calculated automatically from your results. This is game scoring only. It produces no legal effect and no similarly significant effect on you, and is therefore not automated decision-making within the meaning of Art. 22 GDPR.

The public leaderboard. Once you have played 20 rated rounds, your rating, rank and number of rounds appear on the leaderboard, which anyone can read. The name from your GitHub or Google account is never shown there. What appears is the nickname you chose, and choosing one is required before you can play — so you decide what other people see, and you are free to pick something that does not identify you. You can change it at any time on your profile. Your email address never appears. Legal basis: Art. 6(1)(f) GDPR — a ranked game is understood to have a ranking. If you would rather not appear at all, you may object under Art. 21 at the address in section 1.

Track metadata and audio previews come from Deezer S.A., 22–26 rue de Calais, 75009 Paris, France.

Both the audio and the cover artwork are loaded by your browser directly from Deezer's servers — audio from cdnt-preview.dzcdn.net and images from cdn-images.dzcdn.net. Deezer therefore receives your IP address and the usual request headers whenever a snippet plays or a cover is displayed.

Our server asks Deezer for the address of the current snippet and passes that address to your browser; the audio itself never travels through us. We do not tell Deezer who you are, and we receive no information back from them about you.

Legal basis: Art. 6(1)(f) GDPR. Playing the snippet and showing the cover are the game itself, and delivering them from the provider's own CDN is the ordinary way to do it. Deezer is based in the European Union.

Account and game data is kept for as long as your account exists. If you ask us to delete your account, it and everything attached to it — rounds, daily results, rating, achievements — are removed.

Server log data is kept only for the short period the hosting provider needs for operations and security.

To have your account deleted, write to the email address in section 1.

Under the GDPR you have the right to:

• access the data we hold about you (Art. 15);
• have inaccurate data corrected (Art. 16);
• have your data deleted (Art. 17);
• have processing restricted (Art. 18);
• receive your data in a portable, machine-readable form (Art. 20);
• object to processing based on legitimate interests (Art. 21).

Exercising any of these costs nothing. Write to the contact address in section 1.

Right to object (Art. 21 GDPR). Where we rely on legitimate interests — the hosting, logging and artwork described in sections 3, 4 and 9 — you may object at any time on grounds relating to your particular situation. We will then stop that processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your residence, place of work, or the place of the alleged infringement (Art. 77 GDPR).

The whole site is served over HTTPS, so traffic between your browser and the server is encrypted in transit. Sign-in cookies are set with the Secure and HttpOnly attributes, which means they are sent only over encrypted connections and cannot be read by scripts in the page.

This policy is updated whenever the site changes in a way that affects it, so that it continues to describe what actually happens. The date at the top tells you which version you are reading.