Privacy Policy

1. Controller

The controller responsible for data processing is: Rasmus Hansen Westerfeldstraße 21 85737 Ismaning Germany Email: privacypolicy@guesstheartwork.com

2. Hosting and delivery

This website is delivered through Cloudflare Workers and other Cloudflare services. The provider is Cloudflare, Inc., 101 Townsend Street, San Francisco, California 94107, USA.

When the website is accessed, Cloudflare processes technically necessary connection data. This may include the IP address, time and destination of the request, browser and device information, system configuration, routing data and security data.

Processing is necessary to deliver the website securely and reliably, defend against attacks and diagnose errors. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and uninterrupted operation of the service.

Cloudflare generally processes Customer Logs and content transmitted through its services as a processor. Retention depends on the type, purpose and contractual configuration of the relevant Cloudflare service and applicable legal requirements.

3. Local browser storage

The game uses the browser’s Local Storage. Only the following information is stored:

• selected language,
• game progress, score and streaks,
• IDs of previously displayed artworks to reduce frequent repetition.

Purpose and retention of local data

This information generally remains on your device and is not used for advertising or cross-site tracking. It remains stored until it is overwritten by the website or deleted through your browser settings.

Storage provides the game, language and progress features expressly requested by you. The legal basis is Article 6(1)(f) GDPR. Where storage is strictly necessary, it is also based on Section 25(2)(2) TDDDG.

4. Leaderboard

If you voluntarily publish an entry on the leaderboard, the following data is processed:

• your chosen player name or pseudonym,
• score achieved and maximum possible score,
• date of the daily game,
• internal creation timestamp.

Publication and deletion of leaderboard entries

The leaderboard is stored in a Cloudflare D1 database. Player names and scores are publicly visible. Please use a pseudonym where possible and do not enter personal data relating to third parties.

The legal basis is Article 6(1)(b) GDPR because processing takes place at your request to provide the leaderboard feature.

Leaderboard entries are stored for no longer than twelve months and are then deleted automatically. You may request earlier deletion at any time by emailing privacypolicy@guesstheartwork.com.

5. Maps

The location game uses map material from OpenFreeMap based on OpenStreetMap data. When a map is displayed, your browser connects to OpenFreeMap servers or other participating map services. Technically necessary connection data such as IP address, browser type, referrer and request time may be processed.

The map is required for the location feature. The legal basis is Article 6(1)(f) GDPR.

OpenFreeMap states that it does not use cookies or tracking technology and does not store IP addresses during normal operation.

6. Data and images from museum Open Access services

Artwork information comes from the public APIs of The Metropolitan Museum of Art, the Art Institute of Chicago and the Cleveland Museum of Art. Chicago and Cleveland metadata is stored in a Cloudflare D1 database before publication; images are loaded directly from the respective museums’ image servers in the United States. Your IP address, request time, browser information and referrer may be transmitted.

The material is embedded to display the artworks and provide the game. The legal basis is Article 6(1)(f) GDPR.

Only images and core data identified as Public Domain or Open Access are used. All three museums make the selected material available under Creative Commons Zero; description texts under a different licence are not imported.

7. Contact

When you use the feedback form, we process your optional name, email address, selected category and message. Cloudflare Email Service delivers this information to the controller’s mailbox. The application does not store form contents in its own database.

Information sent through the form or by email is used solely to respond to your enquiry. Depending on the subject matter, the legal basis is Article 6(1)(b) or (f) GDPR.

Correspondence is deleted once the enquiry has been resolved unless statutory retention duties or legitimate reasons require further storage.

8. Voluntary support through PayPal

If you enter an amount in the support area and select the PayPal button, you are redirected to PayPal. PayPal receives the selected amount and technically necessary connection data. Payment and account details are processed solely by PayPal and are not transmitted to Guess the Artwork.

The payment is voluntary support for the project and not a tax-deductible charitable donation. The redirect occurs only at your express request. The legal basis is Article 6(1)(b) GDPR to process the requested payment. PayPal acts as an independent controller for payment processing.

9. Cookies, analytics and advertising

The website’s own application code currently does not use cookies, advertising networks, analytics services or tracking services. If this changes, this Privacy Policy will be updated before activation and any required consent will be obtained in advance.

10. Your rights

Subject to the statutory requirements, you have rights including:

• access to your personal data,
• rectification of inaccurate data,
• erasure or restriction of processing,
• data portability,
• objection to processing based on legitimate interests,
• withdrawal of consent with effect for the future.

Contact and right to complain

Privacy requests may be sent to privacypolicy@guesstheartwork.com.

You also have the right to lodge a complaint with a data protection supervisory authority. In particular, you may contact: Bayerisches Landesamt für Datenschutzaufsicht Promenade 18 91522 Ansbach Germany

11. Changes

This Privacy Policy will be updated if website features, service providers or legal requirements change.