Privacy

Felix Mennen
Ostlandring 63, 31303 Burgdorf, Germany

Email: [email protected]

When you open the site, the server necessarily receives your IP address, request time, requested address and method, and technical request headers such as your browser identifier. These data are used to deliver the site, maintain secure connections, prevent abuse, and diagnose errors.

The application temporarily uses IP addresses in memory for request-rate and connection limits. It does not write IP addresses to the game database. Infrastructure providers may process customary access and security logs under their configured retention periods.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are reliable delivery, IT security, abuse prevention, and protection of the service and its users.

When you join and play, we process the room identifier, your chosen display name, join time, selected prompt text, local citation identifier, votes, scores, and technical authentication tokens. Authentication and invite tokens are stored on the server only as cryptographic hashes.

These data are needed to create the room, show its participants, import the prompts you select, run rounds, reveal authors and votes, and calculate scores. Other people in the same room can see display names, played prompts, answers, and results. Anyone with the private invitation link can request to join, so share it only with intended players.

The legal basis is Article 6(1)(b) GDPR because processing is necessary to provide the game you request. Security measures and abuse controls are additionally based on Article 6(1)(f) GDPR.

Rooms and all associated participants, prompts, votes, citations, and tokens are automatically deleted after 24 hours. One-time import codes expire after 30 minutes or immediately after use. In-memory rate-limit records expire after ten minutes or one hour, depending on the protected action, and are also lost when the service restarts.

The command-line client reads supported AI-client histories locally and ignores model output, tool output, attachments, and system context. The operator does not receive your history or analysis shortlist.

For ranking, your 700 most recent prompts are sent through either your authenticated Codex connection to OpenAI or your authenticated Claude Code connection to Anthropic, without local language-specific filtering or scoring. That processing is governed by your account and the selected provider’s terms and privacy notice. Review the OpenAI privacy policy or Anthropic privacy policy, as applicable.

Only the prompts you explicitly confirm, together with their local citation identifiers, are sent to the who said dis? room. Do not select confidential information, special-category data, or third-party personal data unless you are permitted to share it with everyone in that room.

We use Cloudflare Turnstile to protect room creation and joining from automated abuse. The widget connects directly to Cloudflare, Inc., 101 Townsend Street, San Francisco, California 94107, USA. Cloudflare processes signals including the IP address, TLS fingerprint, user-agent header, site key, originating site, browser characteristics, and interaction signals to distinguish people from bots. Our server also sends the IP address and the short-lived verification token to Cloudflare for validation.

For protecting this service, Cloudflare acts as our processor; Cloudflare also states that it processes signals as an independent controller to improve Turnstile. The legal basis on our side is Article 6(1)(f) GDPR. Our legitimate interest is protecting the free service and its users against bots and abuse. Any storage on or access to your device that is strictly necessary for this protection is based on section 25(2)(2) TDDDG.

Cloudflare and its subprocessors may process data outside the EEA. Where required, transfers are protected by the EU Standard Contractual Clauses and supplementary safeguards in Cloudflare’s data processing addendum. Details are available in the Turnstile Privacy Addendum and Cloudflare Data Processing Addendum.

We use only storage required to provide the room you request:

No advertising or audience-measurement cookies are used. These items are strictly necessary to provide the room functionality you requested, so consent is not required under section 25(2)(2) TDDDG. Turnstile storage is described separately above.

Data are received only by intended room participants, the controller, service providers needed for hosting and secure delivery, and Cloudflare for Turnstile. Processors are bound under Article 28 GDPR where required. We do not sell personal data and do not use it for advertising.

We use HTTPS in production, HTTP-only and SameSite cookies, hashed authentication tokens, access controls, short retention periods, and database deletion safeguards. No internet service can guarantee absolute security.

Subject to the statutory conditions, you may request access, rectification, erasure, restriction, and data portability. You may object at any time to processing based on Article 6(1)(f) GDPR for reasons arising from your particular situation.

To exercise a right, email [email protected]. Because there are no accounts and rooms are short-lived, include the room identifier and your display name; we may need additional information to verify that the request concerns you.

You also have the right to lodge a complaint with a data protection supervisory authority, particularly in the EU member state of your habitual residence, place of work, or the alleged infringement.

Providing a display name is required to join a room. Supplying selected prompts and voting are optional, although a game needs at least one prompt. Without the technically required connection and session data, the requested room cannot operate.

We do not make decisions that produce legal or similarly significant effects. Turnstile automatically assesses whether a request is likely automated; a failed check only prevents that room-creation or join request.