Privacy policy

Last updated 2026-10-16

This explains what personal data DailyChallenge.org processes, why, and what rights you have under the EU General Data Protection Regulation (GDPR). The short version: the site has no tracking, no analytics, no third-party ads and no third-party embeds. What you log and write on the site is public, because it is a community scoreboard. Your email address is never shown to anyone.

1. Who is responsible

The controller under Art. 4 (7) GDPR is:

Email: soeren.michaels+dailychallenge@gmail.com

2. Visiting the site

When you open a page, your browser sends us your IP address, the time, the page requested, the referring page and your browser's user agent. We need this to deliver the site and keep it secure (Art. 6 (1) (f) GDPR: our legitimate interest in running a working, safe website). Server logs that contain IP addresses are deleted after 14 days at the latest. To stop the feedback form from being flooded, the server remembers your IP address for ten minutes after you send feedback, in memory only.

All fonts, images and scripts, including the ad banners and profile pictures, are served from our own server. Your browser does not contact any other site until you click a link.

3. Hosting

The site and its database run on a server rented from Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The server is in Helsinki, Finland (EU). Hetzner processes data on our behalf under a data processing agreement (Art. 28 GDPR). Details: Hetzner's privacy policy.

4. Your account

You can use most of the site without an account. If you create one, we store:

• your email address and a hash of your password (never the password itself), used only to log you in;
• your display name, profile URL, pixel avatar, profile text and links, as far as you fill them in;
• passkeys: only the public key and the name of the device, never your fingerprint or face;
• for each login session: when it started and ends, your IP address and browser user agent, to keep your account secure. Sessions end when you log out, or after seven days without using the site;
• API tokens you create: their name, a hash of the token and when it was last used.

Legal basis: Art. 6 (1) (b) GDPR, because we need this data to provide the account you asked for. We keep it until you delete your account.

5. Logging in with Discord or Twitch

If you choose to log in with Discord or Twitch, you are sent to that site and it tells us your account ID, name, email address and profile picture. We also store the access tokens it gives us, so the optional profile sync (below) works. Discord Inc. and Twitch Interactive, Inc. are in the USA; both take part in the EU-U.S. Data Privacy Framework (adequacy decision under Art. 45 GDPR). This only happens when you click one of these buttons (Art. 6 (1) (b) GDPR). See the privacy policies of Discord and Twitch. You can unlink these logins in your settings.

If you turn on profile sync, our server copies your name and picture from that account each time you log in with it, and shows the picture through DailyChallenge.org. Turning sync off stops this.

6. What is public

DailyChallenge.org is a community scoreboard, so the things you post are public and visible to anyone, including through our public API: your display name, profile, avatar or synced picture, the results and share texts you log, challenge links and games you add, comments, reactions, lists, and your friends list. Leaderboards and stats are built from these results. That is what the service is for (Art. 6 (1) (b) GDPR). Please don't put anything in them you don't want others to see. Your email address, login data, sessions and tokens are never public.

7. Feedback

Messages you send through the feedback form go to a private channel of the site's maintainers on Discord (Discord Inc., USA, EU-U.S. Data Privacy Framework), together with the page you were on and, if you are logged in, your display name and profile link. When you paste a share text the site can't read yet, a note with that text is sent the same way so we can add the game. Legal basis: Art. 6 (1) (f) GDPR, our interest in answering feedback and improving the site. We delete messages once they are dealt with.

8. Cookies and local storage

The site only stores what it needs to work. Nothing is used for tracking or advertising, so no consent banner is needed (§ 25 (2) TDDDG).

• better-auth.session_token: keeps you logged in. Set when you log in, removed when you log out, expires after seven days without use. While you log in with a passkey, Discord or Twitch, a few more short-lived cookies protect that login step.
• dc-scope: remembers whether you are looking at Everyone, Friends or Me. Kept for one year.
• Local storage dc:feedback-button-hidden: remembers that you hid the feedback button. Stays in your browser until you clear it.

9. Auto-submit script and API

The optional auto-submit userscript runs in your own browser and sends a game's share text to DailyChallenge.org when you press that game's Share button, using an API token you created. Nothing else is read from the game's site.

10. Ads

The banners on the site are for friendly websites. They are plain links with images served from our server: no tracking, no data goes to those sites unless you click.

11. How long we keep data

Account data and what you posted are kept until you delete your account, or delete the item. When you delete your account in Settings, your profile, logins, results, comments, reactions, friends, lists and tokens are deleted right away. Challenge links and games you added stay for the other players, without your name. Database backups are kept for 30 days, so deleted data disappears from them by then.

12. Your rights

You have the right to:

• access the data we have about you (Art. 15 GDPR);
• have wrong data corrected (Art. 16);
• have your data deleted (Art. 17);
• restrict processing (Art. 18);
• get your data in a machine-readable format (Art. 20);
• object at any time to processing based on Art. 6 (1) (f) GDPR, for reasons arising from your particular situation (Art. 21);
• complain to a data protection supervisory authority (Art. 77), for example the one where you live, or the one responsible for us: the Berliner Beauftragte für Datenschutz und Informationsfreiheit.

Most of this you can do yourself in Settings: edit your profile, download all your data as a JSON file, or delete your account. For anything else, email soeren.michaels+dailychallenge@gmail.com.

You don't have to give us any data to read the site. To have an account, we need an email address or a Discord or Twitch login. We make no automated decisions about you (Art. 22 GDPR).

13. Changes

When the site changes what it does with data, we update this page. The date at the top shows the latest version.

Impressum · Privacy policy · Terms of use