What this game knows about you

01Who is responsible

Controller under the General Data Protection Regulation (GDPR):

Up or Out is a private, non-commercial project. A data protection officer is not required.

02The short version

• No cookies, no analytics, no trackers, no advertising, no social media plug-ins.
• No accounts, no sign-up, no forms, no newsletter.
• Your answers, points, hints and streak are saved only in your own browser. They are never sent to me or anyone else.
• Fonts and everything else the page needs come from this site. Your browser does not contact Google or any other third party while you play.
• The only personal data that reaches a server is the technical data described in section 03.

03Hosting and server logs

The site is hosted by Infomaniak Network SA, Rue Eugène-Marziano 25, 1227 Les Acacias (Geneva), Switzerland, in Swiss data centres. Switzerland has an adequacy decision from the European Commission (2000/518/EC, confirmed in the review of 15 January 2024), so no further safeguards are needed for this transfer. Infomaniak processes the data on my behalf under a data processing agreement (Art. 28 GDPR).

When you open the site, the server automatically logs: your IP address, date and time, the page or file requested, the amount of data sent, the referring page, and your browser and operating system.

Purpose: delivering the site and keeping it secure and stable. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in running the site safely). The logs are kept for up to twelve months under Infomaniak's policy, are not combined with other data and are not used to identify visitors.

The site sends a referrer policy of "strict-origin-when-cross-origin": when you follow a link to another site, it learns only that you came from uporout.co, not which page.

04What stays in your browser

The game uses your browser's local storage, not cookies. What is stored there never leaves your device:

• your progress for each day: the companies you named, your points, the hints you took and the companies the game did not know;
• your statistics: days played, streak, best floor;
• small settings: whether you have seen the how-to-play window and whether the QR code is shown or hidden;
• a copy of the latest daily calls, so the game still works when the connection is slow.

This is strictly necessary to provide the game you asked for, so no consent is needed (§ 25(2) no. 2 TDDDG). You can delete everything with "Reset my progress" at the bottom of the game, or by clearing this site's data in your browser settings.

05Daily calls and QR code

The daily calls may be maintained in a Google spreadsheet. If so, this site's own server fetches the spreadsheet from Google and passes it on to your browser. Your browser does not contact Google, and Google does not receive your IP address.

The "Play now" QR code is drawn inside your browser. Scanning it with your phone simply opens uporout.co.

06Sharing your result and external links

"Copy post" copies your result text to your clipboard on your own device. "Share" opens your device's share menu. "Post on LinkedIn" opens linkedin.com in a new tab with your result text filled in; from then on, LinkedIn's privacy policy applies. Nothing is shared unless you press one of these buttons.

"Companies we didn't know" only offers a copy button. If you decide to send that list to me, it is handled as an email (section 07).

07Email

If you write to me, I use your message and address only to answer you. Legal basis: Art. 6(1)(f) GDPR, or Art. 6(1)(b) GDPR if your message is about working together. Emails are kept while needed to deal with your request and then for up to three years after the last message. They are not passed on to anyone.

08Your rights

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interest (Art. 21). Send requests to the address in section 01.

In practice the only personal data on the server side are the server logs and any emails. The game data in your browser is under your control and can be deleted at any time.

You can complain to a data protection authority, for example the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de, or to the authority where you live.

09Children

Up or Out is made for students and adults interested in finance. Because the game collects no personal data and has no accounts, no parental consent is needed to play.

10Changes

If anything changes that affects personal data, for example a global leaderboard with nicknames, this policy will be updated before the change goes live and get a new date.