Who is responsible?
Hvem mon? is developed and operated by Nicklas Andreasen, known as Adrez, who is the data controller for the processing described here. Adrez is a developer brand, not a separate company. Contact: support@adrez.dev.
You play in private rooms without creating an account. You can use a nickname. Avoid sensitive information about yourself or others in names, answers, and reports.
Information in a game
The game server processes your player name, emoji, language, random player ID, and a hash of your secret reconnect credential. It also processes the room code, settings, questions, answers, guesses, scores, and game progress. Connections to the game server use HTTPS and WSS.
Room participants can see player names and emojis. An answer’s author is hidden during guessing, then revealed afterwards; answers are not permanently anonymous. Guesses and results appear as part of the game. Other participants can independently copy content or take screenshots. Share invitations only with people you want to play with.
Network, security, and local storage
Cloudflare provides hosting, networking, and the game server. Cloudflare receives your connection’s IP address and technical request information to deliver and protect the service. The game’s access limiter uses a SHA-256 hash of the IP address in counters with 60-second windows. This does not mean all Cloudflare technical data is deleted after 60 seconds.
The game code does not log answers, player names, or secret room credentials. Logpush is disabled on the Rooms server, with no attached log consumer. Provider operations and security can still involve processing technical data.
Your device saves room logins for reconnection, language preferences, and locally hidden players and answers. The web version also uses a language cookie. The game includes no advertising, analytics, or crash-reporting SDKs and does not use gameplay information for advertising tracking across other companies’ services.
Support and reports
Report opens an email draft containing relevant room and game content. You can edit it and decide whether to send it. We process the report you actually send, including your email address, message, attachments, and any information you include.
Support@adrez.dev is forwarded through Cloudflare Email Routing to Gmail, provided by Google. Your own email provider also processes the outgoing message. A sent report is separate from the short-lived game room. Never send your secret room login.
How long is information kept?
The game server is configured to delete active room data ten minutes after all players disconnect. Reconnecting before then keeps the room alive. Answers, guesses, and results reset when the game returns to the lobby. Leave game removes your player profile and authored answers from the active room.
In the app’s Support, you can delete saved room logins on this device. You lose the ability to return as the same player, including as host. Leave active games and close other tabs first. This does not delete room data or emails. Language and local hiding preferences remain; clear the app or website data to remove these too. Older web versions may lack this button.
Support messages are kept while the case is being handled and while specific follow-up remains necessary. Once that need ends, the message and unnecessary attachments are to be deleted from the support mailbox. If a security case, dispute, or legal obligation requires longer retention, it is limited to relevant material and the necessary period. You can request deletion through support.
Deletion from active rooms or the support mailbox is not a promise of immediate deletion from providers’ security or backup systems. Cloudflare and Google have separate retention processes for operations, security, backups, and legal obligations. The game’s ten-minute period does not apply to those systems.
Why may we process this information?
Necessary room and gameplay information is processed to provide the game you request (GDPR Article 6(1)(b)). Safety filtering, access limiting, and abuse-report handling rely on our legitimate interest in protecting players and keeping private game rooms available and safe (Article 6(1)(f)).
General support relies on our legitimate interest in answering requests and resolving problems; where necessary to provide the game to you, Article 6(1)(b) applies. Processing necessary to meet a specific legal obligation relies on Article 6(1)(c). We do not treat using the game as blanket consent to other purposes.
Recipients and processing outside the EU/EEA
Recipients include participants in your room, Nicklas Andreasen for support, and Cloudflare and Google for the services described. We do not sell your gameplay information. Information may also be disclosed where a legal obligation requires it.
Cloudflare and Google operate international services that may process information outside the EU/EEA, including in the United States. We do not promise that all data stays in the EU. Cloudflare’s Data Processing Addendum describes applicable transfer safeguards, including standard contractual clauses; Google describes its transfer mechanisms in its privacy policy. Contact support for information about relevant safeguards or a copy.
These information pages on adrez.dev load a font from Google Fonts. This sends your IP address and technical browser information to Google. The game itself delivers its fonts with the game.
Your rights
Depending on the processing, you have rights to access, correction, deletion, restriction, and portability. You may object to processing based on legitimate interests. If we later use consent, you can withdraw it for future processing. Email support@adrez.dev to exercise your rights.
We may ask for a room code and approximate time or other necessary information to locate data and protect it from disclosure to someone else. Do not send your secret room login. We cannot reconstruct content already deleted from the active game server. You may complain to Datatilsynet, the Danish data protection authority. Material changes to this policy will appear here with a new date.