Privacy Policy

Last updated: 10 July 2026

1. Controller

The controller within the meaning of the EU General Data Protection Regulation (GDPR) for data processing on this website is:

Vadim Bauer
Am Fort Hechtsheim 17
55131 Mainz
Germany
Email: hello@playhowheavy.com

2. Overview

  • How Heavy? works without an account, login, or any personal details.
  • We do not set cookies and do not use advertising or cross-site tracking services.
  • Your browser stores only data that is strictly necessary for the game (progress, streak, preferences) — which is why this site does not need a consent banner (§ 25 (2) no. 2 of the German TDDDG).
  • Game statistics are stored on the server only in anonymous, aggregated form.

3. Hosting and server logs (Cloudflare)

This website is hosted on the infrastructure of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (“Cloudflare”). When you visit the site, your browser necessarily transmits technical data to Cloudflare's servers, in particular your IP address, the requested URL, date and time of the request, browser type and version, and operating system. Cloudflare processes this data to deliver the website, to ensure its stability and security (for example, defence against attacks and abuse), and stores it in short-lived technical logs.

Legal basis: Art. 6 (1) (f) GDPR — our legitimate interest in the secure, stable, and efficient provision of the website. We have concluded a data processing agreement with Cloudflare pursuant to Art. 28 GDPR. Cloudflare operates a global network, so data may also be processed in the USA and other third countries; transfers are safeguarded by Cloudflare's certification under the EU–US Data Privacy Framework and by EU standard contractual clauses (Art. 45, 46 GDPR).

For more information, see the Cloudflare privacy policy .

4. Rate limiting

To protect the game API against abuse, the number of requests per IP address is limited (currently 30 write requests per 60 seconds). For this purpose, your IP address is processed transiently within the Cloudflare infrastructure; we do not store it in our own database. Legal basis: Art. 6 (1) (f) GDPR — our legitimate interest in protecting the service against abuse and overload.

5. Storage in your browser (no cookies)

The game stores the following data in your browser's local storage (localStorage) — not as cookies, and it is never sent to third parties:

  • a randomly generated, anonymous browser identifier (see section 6),
  • your Daily Challenge progress and completion state,
  • your streak, scores, and achievements,
  • your unit preference (metric or imperial) and language choice.

This storage is strictly necessary to provide the game you requested (saving progress, one Daily attempt per day, keeping your settings), so it is permitted without consent under § 25 (2) no. 2 TDDDG; no consent banner is required. You can delete this data at any time by clearing your browser's site data — this also deletes your streak.

6. Game statistics and the random browser identifier

After each round, the game shows how other players guessed. For this, your guesses are stored on the server exclusively as aggregated counts per object and weight bucket — individual guesses cannot be traced back to any person.

For the Daily Challenge, a randomly generated identifier from your browser is transmitted and stored together with the day and your total score. Its sole purposes are to count each player's Daily result only once per day and to calculate the score distribution. This identifier is generated locally, contains no personal details, and is not linked to your name, email address, or IP address. To the extent it qualifies as pseudonymous personal data at all, the legal basis is Art. 6 (1) (f) GDPR — our legitimate interest in correct, manipulation-resistant game statistics. In addition, anonymous usage counters without any identifier (for example “a Daily game was started”) are recorded.

7. Contact by email

If you email us, we process the data you provide (email address, message content) to handle your enquiry. Legal basis: Art. 6 (1) (b) GDPR where your enquiry relates to a contractual matter, otherwise Art. 6 (1) (f) GDPR — our legitimate interest in answering enquiries. We delete the correspondence once the matter is resolved, unless statutory retention obligations apply.

8. Recipients and storage periods

We do not sell data and do not pass it on for advertising purposes. The only recipient is Cloudflare as our hosting and infrastructure processor (see section 3). Technical logs are kept only for a short period; aggregated game statistics contain no personal reference and are kept indefinitely; data in your browser remains under your control and stays until you delete it.

9. Your rights

Under the GDPR you have the right to access the personal data we hold about you (Art. 15), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), and to data portability (Art. 20). Where processing is based on consent, you may withdraw it at any time with effect for the future (Art. 7 (3)).

Right to object (Art. 21 GDPR): where we process data based on legitimate interests (Art. 6 (1) (f) GDPR), you may object at any time for reasons arising from your particular situation.

Please note: server-side game statistics are stored anonymously, so we cannot associate them with you and can therefore neither retrieve nor delete individual entries. Data in your browser can be deleted by you directly at any time.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the authority of your habitual residence or of our registered address.

10. No obligation to provide data, no automated decision-making

You are neither legally nor contractually obliged to provide personal data; the game can be played without providing any. There is no automated decision-making or profiling within the meaning of Art. 22 GDPR.

11. Changes to this policy

We will update this privacy policy when the game's functionality or the legal situation changes. The current version is always available on this page.

Privacy questions? Email hello@playhowheavy.com — provider details are in the legal notice.