Privacy

Who is responsible

Daniel Metzner
Münzgrabengürtel 2
8010 Graz, Austria
legal@metzner.uk

Full imprint: Imprint

What we store

When you submit a guess we store the name you type, the number you guess, the time of submission, and a random token that identifies your browser for this one game. Nothing else.

The token stays in your browser; the database holds only a one-way hash of it, so nobody holding the table can trace a guess back to a device.

No account, no email address for guests, no tracking across sites by us, no advertising cookies on the page where you guess.

Legal basis: legitimate interest in running the guessing game you chose to take part in (Art. 6(1)(f) GDPR).

Why

To run the game: to show the organizer who guessed what, to work out who was closest, and to stop one person voting many times. The name is there so winners can be identified at the event.

How long

30 days after the game ends, then it is deleted. The organizer can delete it sooner, or you can ask us to; deleting a game deletes every guess in it.

Reporting a game

If you report a game, we store the reason you picked from a fixed list, the time, and a one-way hash of your IP address (keyed with a secret only the server holds, and different for every game). The hash is there only so the same person cannot file the same report twice; we do not store the IP address itself and use the hash for nothing else. There is no free-text field, and nothing else about you is stored.

Reports are read by us only — not by the organizer of the game. They are deleted 30 days after the game ends, or 30 days after the report if that is later, or sooner when the organizer deletes the game. A report does not block a game by itself.

Legal basis: legitimate interest in handling reports of unlawful content and protecting the service from abuse (Art. 6(1)(f) GDPR).

Hosting

Call It is served by Cloudflare Workers (Cloudflare, Inc.), and the domain is routed through Cloudflare's network. Technically necessary access data — including your IP address, the page requested, and your browser's user agent — is processed there in server logs so the page can be delivered at all.

Legal basis: legitimate interest in operating the site securely (Art. 6(1)(f) GDPR).

Organizer accounts

If you set up a game of your own, you create an account: we store your email address and your password (hashed, never in plain text) with Supabase (servers in the EU), plus the games you create and the guesses submitted to them. You can delete your games — and with them every guess — at any time. The login is shared with our other apps (Verso, Tempo): one sign-in for all of them. Deleting your account here removes the login too, unless you still use it in one of those apps.

Account emails (confirming your address, resetting your password) are sent by Supabase through the mail service Resend (Resend, Inc., USA), which processes them on our behalf and receives your email address and the content of the message for that purpose. The transfer to the USA rests on the EU-U.S. Data Privacy Framework, under which Resend is certified (Art. 45 GDPR), with the EU Standard Contractual Clauses as an additional safeguard (Art. 46 GDPR).

Legal basis: performance of a contract / your request (Art. 6(1)(b) GDPR).

Cookies

Two kinds are set by us or our account provider, both technically necessary, neither used for advertising or for recognising you on other sites. A third kind may be set by Cloudflare's bot detection (see below):

• When you guess, one cookie per game holds the random token described above (30 days). It is what stops the same browser guessing twice.
• When you sign in as an organizer, Supabase sets a session cookie so you stay logged in. Signing out removes it.
• On every page, Cloudflare's bot detection may set its own cookie (cf_clearance, and for some configurations __cf_bm); see “Bot detection on every page”.

Because all of them serve a function you asked for or the security of the service, no consent banner is shown for them.

Bot detection on every page

Our domain runs behind Cloudflare, and Cloudflare adds a small bot-detection script (JavaScript Detections) to every web page it delivers — including the pages where guests enter a guess, see results or read the thank-you page. The script is loaded from our own domain (/cdn-cgi/challenge-platform/…). It reads technical browser signals and, together with your IP address, uses them to tell people from automated scripts. It is separate from Turnstile below, which runs only on organizer sign-in pages.

Cloudflare may set the cookie cf_clearance (according to Cloudflare, required for JavaScript Detections; lifetime 15 minutes) and, depending on the bot-management configuration, __cf_bm (bot score; 30 minutes of inactivity). They hold the outcome of the check, not your name or your guess, and are not used for advertising.

Cloudflare processes this partly on our behalf, and partly as an independent controller to improve its security services. Its privacy policy: cloudflare.com/privacypolicy.

Legal basis: legitimate interest in protecting the service from bots and abuse (Art. 6(1)(f) GDPR).

Bot protection on sign-in

On the organizer sign-in, sign-up and password-reset pages we use Cloudflare Turnstile (Cloudflare, Inc., USA) to tell people from automated scripts. When the page loads, your browser fetches the Turnstile script and challenge from challenges.cloudflare.com; Cloudflare receives your IP address and technical browser signals, and returns a one-time token that we pass to our account provider to verify it. Turnstile itself does not run on the pages where guests enter a guess, see results or read the thank-you page (Cloudflare's general bot detection does; see above).

Cloudflare processes the data partly on our behalf, and partly as an independent controller to improve its bot detection. Its Turnstile privacy policy: cloudflare.com/turnstile-privacy-policy.

Legal basis: legitimate interest in protecting accounts and the service from automated abuse (Art. 6(1)(f) GDPR).

Who else sees it

The organizer of the game you are playing. Our database and account provider, Supabase (servers in the EU), and our hosting provider, Cloudflare, process the data on our behalf; Cloudflare also uses the signals from its bot detection as an independent controller (see above). Organizers' account emails also pass through Resend (see “Organizer accounts”). Nobody else, and it is never sold.

The live results page shows only counts in five coarse ranges while a game runs — never an individual guess, and never a name. Names and guesses appear only after the game has ended.

The Android app

The app in Google Play (uk.metzner.callit) is this same website, displayed by your own Chrome inside the app. It processes nothing beyond what is described here — there is no extra collection, no advertising ID and no device identifier. Installing and updating it goes through Google Play (Google Ireland Ltd.) under Google's own terms.

Your rights

You can ask for a copy of what we hold about you, ask us to correct it, ask us to delete it, or object to processing — write to legal@metzner.uk and say which game you took part in.

You can also complain to a supervisory authority. In Austria that is the Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna (dsb.gv.at).