Privacy

You can play without an account. If you make one, we store as little as we can and encrypt it.

Who is responsible

Swelis International e.U., Kefedergrundgasse 2, 1210 Vienna, Austria. Email: hello@swelis.com.

Playing without an account

Your daily games, streak and atlas stay in your own browser’s storage and never reach us. Duel and Crowd Trivia are the exceptions, explained below. There are no ads or tracking cookies, and fonts are served from our own server.

Duel and Crowd Trivia

These games need our server, because more than one person plays. You don’t need an account for either, and we ask for nothing but a name, which can be any nickname.

Duel stores the name you give, your answers and how long each took, so friends who open your link can play the same questions and compare. Anyone with the link can see the names and scores in that duel. Your browser keeps a random token so it can tell it’s you. A duel is deleted 30 days after it was started.

Crowd Trivia keeps names, answers and scores in our server’s memory only, never on disk. A room disappears two hours after it was last used, or when our server restarts.

Our reason is to provide the game you asked to play (Art. 6(1)(b) GDPR). The names you type are visible to the other players, so don’t use anything you’d rather keep private.

Counting visits

We count page views and game events, like a finished game and its score, with our own analytics system. It stores nothing on your device and doesn’t recognise you from one day to the next. It keeps the page, the site you came from, your browser and device type, and a rough location worked out from your IP address. Your IP address itself isn’t stored, and neither is your account: these numbers aren’t linked to you. Our reason is our legitimate interest in knowing which games get played and fixing what doesn’t work (Art. 6(1)(f) GDPR). The records are deleted after 13 months.

What we store if you make an account

• Your email address, to sign you in and send account emails.
• A scrambled form of your password that can’t be turned back into it.
• Your game results and atlas, so they follow you between devices.
• When you signed up, and a record of what you agreed to and when.
• Two strictly necessary cookies, which need no consent: one keeps you signed in, and one recognises browsers you’ve used before, so we can email you when your account is signed in from a new one.

Our web server also handles your IP address to deliver pages and to slow down password guessing. Those attempt counts are held in memory only. A sign-in email names your browser and the time, which we work out at that moment and don’t keep.

Why we’re allowed to

• Running your account: necessary to provide the service you asked for (Art. 6(1)(b) GDPR).
• Newsletter: only with your consent, confirmed by email (Art. 6(1)(a) GDPR, § 174 TKG 2021). You can withdraw at any time with the link in every issue or in your account. We never use your address for anything else, and we never sell it.
• Keeping accounts secure, including backups: our legitimate interest in protecting them (Art. 6(1)(f) GDPR).

How it’s protected

Connections use HTTPS. The whole database is encrypted on disk, and on top of that your email and game data are encrypted with a key unique to your account. Backups are encrypted again to a key that isn’t kept on our server.

To be straightforward about the limit of this: it isn’t end-to-end encryption. Our server has to read your email address to send you mail and your results to sync them, so it holds the keys while running.

How long we keep it

• Sign-ups never confirmed: 48 hours, then deleted.
• Sign-in sessions: 30 days after you last used them.
• Browsers recognised for sign-in emails: a year after you last signed in from them.
• Your account: until you delete it, which you can do yourself at any time.
• Backups: encrypted copies are overwritten within 30 days, so deleted data leaves them by then.

Who helps us

• Hetzner Online GmbH, Germany: hosting, including our analytics system, and encrypted backups.
• Microsoft (Microsoft 365): delivering our email, so it handles your address and the emails we send you.

Your rights

You can get a copy of your data, correct it, delete it, restrict or object to its use, and take it elsewhere. Your account page lets you download and delete everything yourself; for anything else, email hello@swelis.com. You can also complain to the Austrian Data Protection Authority (dsb.gv.at).

Accounts are for people aged 14 or over.

Last updated 3 November 2026.