Privacy in the app

Last updated: DATE

This statement covers the Wissky app and the API behind it. The website has one of its own, under Privacy.

In short

Without an account we store nothing about you. You can play the daily round without signing in, and doing so creates no row in our database: no profile, no stored answer, no cookie, no device identifier. The only thing that occurs is your IP address in the rate limit and in the server log, the same as with any website you open.

With an account we store what a duel spread over several days needs: your email address, your name, your duels and your answers. There is no advertising, no analytics tool, no crash reporter and no advertising identifier. We pass nothing on for advertising purposes and we build no profile of you beyond the game.

Controller

NAME OR COMPANYADDRESSCONTACT ADDRESS

Without an account: the daily round

The three questions of the day are open to everyone. You tap, you get the answer, and that is that. The server creates nothing for you: no answer, no profile, no counter. Nothing is left on your device that would recognise you next time either.

The only personal value this path touches is your IP address. It serves the rate limit, so that a single machine cannot overrun the API, and it appears in the server log. For the rate limit it lives in memory only, and only for the duration of the current one minute window.

Purpose: to keep the service reachable. Legal basis: legitimate interest in secure operation, Art. 6 (1) (f) GDPR. How long: one minute in memory, RETENTION PERIOD in the server log. Recipients: HOSTING PROVIDER as a processor.

Account and signing in

Wissky has no passwords. You enter your email address and receive a six digit code that is valid for five minutes and for one use. The same email carries a button that does the same thing. Three failed attempts use the code up, and at most three requests per minute go out per address. We hold the code only as a checksum that cannot be turned back into the code.

We store your email address, your name, whether the address is confirmed, and the timestamps. Every sign-in creates a session with a token, an expiry, the IP address and the identification of the device or browser it came from. A session is valid for seven days and is extended as long as you keep using the app.

If you sign in with Google, your Google identifier, your email address and your name reach us from Google, and we store the link to that account. Whether this path is offered is visible on the sign-in screen; without it the code from the email remains.

A second factor exists only for moderation and administration accounts. Player accounts never turn it on.

Purpose: so that you can sign in and stay signed in. Legal basis: performance of the contract of use, Art. 6 (1) (b) GDPR. The limits on failed attempts and requests rest on our legitimate interest in access free of abuse, Art. 6 (1) (f) GDPR. How long: as long as your account exists. Sessions expire after seven days without use, sign-in codes after five minutes. Recipients: EMAIL PROVIDER to send the email. Google only if you choose to sign in with Google.

Your profile

Your account comes with a profile: your display name, your language, a six character friend code, your quiz score, and a seed from which the app draws your wave. The wave is assigned when the profile is created and cannot be picked; it is not an image but a number from which every installation draws the same shape. You can change your name and language at any time.

There is no search by name or email address. You are found only if you hand out your friend code.

Purpose: so that others can recognise you in the game and invite you. Legal basis: performance of the contract of use, Art. 6 (1) (b) GDPR. How long: as long as your account exists.

Duels, rounds, points

A duel is between two profiles. We store who challenged whom, how many rounds were agreed, which category was picked, which three questions belong to the round, who won, and when all of that happened.

For every question we store which answer you tapped, whether it was right, when the question was served to you and when your answer arrived. The time your app measured is kept as evidence; what decides is the server clock.

Points are not simply counted up, they are booked one by one: every credit sits in a ledger with an amount, a reason and a timestamp. On top of that we record when you first reached a grade of an award. If you look for an open duel, a waiting ticket is created with your language and the timestamps; it lives for a day and then expires.

If you play the daily round while signed in, it is recorded: when you started and how you tapped. That is the only way for you to see how you did and how everybody else did.

Purpose: the game itself. Legal basis: performance of the contract of use, Art. 6 (1) (b) GDPR. How long: as long as your account exists.

Writing and rating questions

Wissky lives on questions from the community. If you write one, we store the question text, the four answers, the explanation, the category and the language, along with where it stands between draft, review and release.

A released question is immutable and stays in the pool. Your display name appears below it, so others can see who it came from. A correction creates a new question instead of rewriting the old one, because otherwise past duels would be falsified after the fact.

If you rate someone else's question, we store your vote, the tags you picked and your comment. If you propose a category, we store the name, your reasoning and the decision on it.

Purpose: so that there are questions, so that they are good, and so that it is visible who contributed them. Legal basis: performance of the contract of use, Art. 6 (1) (b) GDPR, and our legitimate interest in a usable pool of questions, Art. 6 (1) (f) GDPR. How long: as long as your account exists. If you delete it, your questions go with it, released ones included.

Automated checks on submitted questions

When you submit a question for review, two things happen automatically, and both concern the content of the question, not you.

First, the question text together with the four answers and the explanation runs through an automated pre-check at OpenAI. It says whether the text breaks the rules. If the verdict is harsh, the question does not enter the review queue but comes back to you with a note; you can revise it and submit it again, and a human will look at it if you want that.

Second, a vector is computed from the question text and the correct answer, again at OpenAI. That is how we recognise whether the question already exists. The vector stays with us, the text goes out once for it. If the service is down, the question is submitted anyway.

Moderation can additionally trigger a fact check. In that case the question text, the answers and the explanation go to OpenAI, the model searches the web and returns an assessment with sources. This only ever happens when a human asks for it, never on its own.

For each of these calls we file a cost record: kind of call, model, consumption, amount, and, if a human triggered it, their identifier. The record holds no content.

Purpose: so that no unlawful and no duplicate questions enter the pool, and so that the costs stay verifiable. Legal basis: legitimate interest in a lawful and usable pool of questions, Art. 6 (1) (f) GDPR. How long: the results hang on the question and go with it. Cost records stay RETENTION PERIOD. Recipients: OpenAI, USA.

Reporting, blocking, moderation

You can report a question and, if you share a duel or are friends, a person as well. We store the reason, your free text, the timestamp and who reported. You can also block a person; after that the two of you will not end up in a duel together.

A report becomes a review case. It carries the notes, a snapshot of the reviewed content and, at the end, the decision with its reasoning. If the review leads to a suspension, we store the reason, a note and the period.

Every moderation action is logged. The log is only appended to, never changed, and it stays even when the reported content is gone: evidence that disappears along with its cause is not evidence.

Purpose: so that reports can be handled and decisions stay traceable. Legal basis: legal obligation under the Digital Services Act, Art. 6 (1) (c) GDPR, and our legitimate interest in a safe service, Art. 6 (1) (f) GDPR. How long: RETENTION PERIOD. Log entries outlive the deletion of the content they refer to.

Notifications

So that you learn when somebody has played, we send notifications through Firebase Cloud Messaging by Google. The target is the installation identifier that Firebase gives your app on this device. We store that identifier, the platform, and the times of creation and of the last refresh.

The notification carries a title, a sentence and the identifier of the duel, so that your tap lands in the right place. Who won is deliberately not in it.

If somebody else signs in on the same device, the registration moves across instead of sitting next to the old one. Registrations that have not been refreshed for 30 days are cleared away. When you sign out and when you delete your account, the app unregisters the device first.

You allow notifications in the system dialog and can switch them off again in the Android settings at any time. The app keeps working; you simply stop being told when it is your turn.

Purpose: so that a duel works across several days. Legal basis: performance of the contract of use, Art. 6 (1) (b) GDPR, together with your permission on the device. How long: until you unregister the device, delete the account, or 30 days pass without the app checking in. Recipients: Google, USA.

What others see of you

Others see your display name and your wave: the person you are playing, your friends, the rankings, and everyone who meets a question you have released.

The other side sees your answers in a round only once both of you have played. Before that the server does not hand them out, not even in part.

You can view another profile only if you are friends or share a duel. Another person's friend code is never included; it is theirs, and they decide who gets it.

What stays on your phone

Your sign-in token sits in a vault bound to a key in the Android keystore. The key never leaves the device.

Beyond that the app remembers a few small things, so it does not bother you twice with the same moment: which level you have already celebrated, whether you dismissed the hint about notifications, and the identifier of a running search for an open duel.

None of it goes into a Google backup or onto a new device. The app is excluded from backup, and the vault is excluded once more explicitly. If you uninstall the app, all of it is gone.

App permissions

Internet: nothing works without it.

Notifications: optional, see above.

Camera: only to scan a friend code. The image goes straight into recognition on the device, nothing is captured, nothing is stored and nothing is uploaded. You can always type the code instead, so the permission is never mandatory.

Server logs and technical operation

Calling the API produces the technical data every server needs: IP address, time, requested path, response status. They serve operation and defence against attacks and are deleted after RETENTION PERIOD. The application logs carry internal identifiers instead of email addresses; an email address is explicitly never written there.

Each client may make 300 requests per minute. Counting is by IP address, in memory, and once the window ends the count is gone.

Write calls carry a retry key from the app, so that a drop-out in a dead spot does not count twice. For that we store the key, the call it belongs to and the response, and clear it after 24 hours.

Operation and storage sit with HOSTING PROVIDER. The servers are located in SERVER LOCATION.

Legal basis: legitimate interest in secure and reliable operation, Art. 6 (1) (f) GDPR.

Recipients and transfers to third countries

• HOSTING PROVIDER: operation of the servers and the database, as a processor.
• EMAIL PROVIDER: sending the sign-in emails. Your email address is passed on for that.
• Google: delivery of notifications through Firebase Cloud Messaging, and, if you choose that path, signing in with a Google account.
• OpenAI: checks on submitted questions, see above. What is transferred is the content of the question, not your name and not your identifier.

Google and OpenAI also process data in the United States. The transfer rests on the European Commission's standard contractual clauses and, where the recipient is listed there, on the EU-US Data Privacy Framework.

The app is distributed through Google Play. Whatever Google collects in doing so is Google's responsibility, not ours.

Your rights

You have the right to information (Art. 15), correction (Art. 16), deletion (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). You can withdraw consent at any time with effect for the future.

For anything that does not work directly in the app, write to us at CONTACT ADDRESS.

Information and export in the app

Your profile has a section called "Deine Daten" with a "Daten herunterladen" button. It fetches a file with everything stored about you, and the system dialog asks where it should go. That settles Art. 15 and Art. 20 in one step.

It contains your profile including your email address, your friendships, your duels with their rounds and your own answers, your points ledger, your questions including withdrawn ones, your ratings, your reports, your category proposals, your saved categories, suspensions of your account, and your registered devices.

It does not contain the other side's answers. Those are their data, and an information request is not a route to somebody else's data. Of your friends it holds only an identifier and a name, exactly what is visible in the app anyway. The installation identifier of your devices stays out too, because it is a delivery route and does not belong in a file that gets passed around.

Deleting your account

Your profile has a "Konto löschen" button. The app unregisters the device from notifications first, then ends the session, then deletes everything. The same thing happens over the API with DELETE /v1/me.

Deleted are your profile, your duels with all rounds and answers, your points ledger, your friendships, your ratings, your reports, your waiting tickets, your devices, the questions you wrote, and the account itself with your email address and every session. Because a duel has two sides, it disappears for the other side as well.

Not deleted are entries in the moderation log and the cost records of the AI calls. Both are evidence and hold nothing about you beyond an identifier and the decision that was made.

Deleted means deleted. There is no bin and no period after which your account would come back.

Complaints to a supervisory authority

You may complain to a supervisory authority at any time; the competent one is SUPERVISORY AUTHORITY.