Privacy policy

Who is responsible

Wisaku is run by Tim Tissari Bjornstedt, a private individual in the United Kingdom, who is the controller of your personal data under the UK GDPR and, for players in the EU and EEA, the EU GDPR. Write to contact@wisaku.com about anything on this page.

What we collect

When you play

• The player name you enter and the colour you pick. Other players in your room see both, and they are shown with your results. Signed in, your account keeps the colour, so it is the same on every device.
• Your games: the route, every article you went through and when you reached it, your clicks and time, and your place. Finished games are stored, and anyone can see them on results pages and the leaderboards, under the name you played with. Anyone can also share a run from its results: a link to it shows that run, your name included, wherever it is posted.
• What you write in a room's chat, and articles you suggest to the host. Only the players in the room see them.

If you create an account

An account is optional: without one you play as a guest, and we never ask for your email address.

• Your email address, to sign you in and send you account emails. Other players never see it.
• Your password, stored only as a salted hash that can't be turned back into it.
• When the account was created, and failed sign-ins and lockouts, which stop others guessing your password.
• Which games you played signed in, so your account page can list them, and the ratings your races against other signed-in players earn you, which anyone can see on the leaderboards under your user name.

The only emails we send are about your account: confirming your address, resetting your password, and telling you when your email address or password has changed. No newsletters, no marketing.

Whenever you visit

• Your IP address, which comes with every request. We use it to limit how often one address can call the game, sign in or open rooms, so nobody can flood the site. We count requests in the server's memory only; we don't log visits or store IP addresses.
• Error logs. The server logs errors and events such as a room closing. An entry can occasionally include an email address, for example when an email couldn't be delivered.

If you write to us

Your email address and what you write, with any name your email program adds. We use them only to answer you and to deal with what you ask.

If you donate

Donations go through Ko-fi, which takes the payment with Stripe or PayPal, so we never see your card or bank details. From them we receive the name you give, your email address, the amount and date and any message you leave, and from Stripe or PayPal the name on your card or account and, depending on how you pay, part of your address. A donation isn't linked to your Wisaku account or player name, and it buys nothing in the game.

Cookies and storage on your device

Everything Wisaku keeps in your browser is there for something you use, and none of it tracks you, which is why there's no cookie banner. There is one cookie, and only once you sign in.

• wisaku.auth, a cookie that keeps you signed in. It ends when you close the browser or, if you chose to stay signed in, 30 days after your last visit.
• wisaku.playerName and wisaku.hue: the last player name you used, so it's filled in next time, and the colour you play in as a guest.
• wisaku.language, wisaku.theme, wisaku.sound and wisaku.resultsView: the interface language and theme, if you picked them, whether you turned sound off, and whether results show the routes as a list.
• wisaku.session: the room you're in and your seat in it, so reloading the page puts you back. It's cleared when you close the tab.

Who else handles it

We don't sell your data or share it with advertisers. Apart from the other players, who see your name, games and chat, it only reaches:

• Hetzner Online, our hosting provider, which runs the server and database for us in Nuremberg, Germany.
• Cloudflare, which keeps encrypted copies of our backups in the EU and can't read them.
• Amazon Web Services, whose email service in Frankfurt, Germany, receives your address and the message to deliver account emails.
• Cloudflare and Google, if you write to us: Cloudflare forwards email sent to our address to our inbox, which Google keeps.
• The Wikimedia Foundation. Images in articles load straight from Wikimedia's servers, so your browser sends them your IP address and browser details, as it does when you read Wikipedia. Article text is fetched by our server and carries nothing about you. Wikimedia's privacy policy covers those requests, and Wikipedia itself if you follow a link there.
• Ko-fi, Stripe and PayPal, if you donate. You give your payment details to them on Ko-fi's site, and each handles them under its own privacy policy, as a controller in its own right. The footer's link to Ko-fi is a plain link: nothing reaches Ko-fi unless you follow it.
• Authorities, if the law requires it.

Why we may use it

• Running your games and your account, including results, leaderboards and account emails, is the service you ask for: performance of a contract with you (Article 6(1)(b) GDPR).
• Rate limits, lockouts, error logs, security notices, keeping leaderboards whole after an account is deleted, and answering emails you send us serve our legitimate interest in a site that is secure, fair and working (Article 6(1)(f)). You can object to these.
• Answering a request about your data under the GDPR, and keeping a record of how we answered it, is required of us by law (Article 6(1)(c)).
• Receiving your donation, and answering you about it, serves our legitimate interest in accepting support for the site (Article 6(1)(f)). Keeping a record of it for tax is required of us by law (Article 6(1)(c)).

How long we keep it

• Your account: until you delete it on your account page, which erases your email address, password and rating at once. An account whose address is never confirmed is deleted after 7 days.
• Addresses an account email couldn't be delivered to, or whose owner marked one as spam: kept by our email provider until we remove them, so it stops sending to them. Deleting your account doesn't remove yours; ask us and we will.
• Finished games: kept for results and leaderboards, under the name they were played with, also after you delete your account, when they're no longer linked to it. Ask us and we'll delete or anonymize yours.
• Rooms and their chat: only in the server's memory, and gone within an hour of the game ending or the room going quiet. During a server restart, rooms in play are saved to the database and deleted again as soon as it's back up, usually within minutes.
• Request counts by IP address: an hour at most, in memory.
• Logs: until they're overwritten, which happens once they reach a fixed size.
• Backups: a copy of the database is made every day and kept for two weeks, so anything deleted from the site is gone from the backups two weeks later. Rooms and chat are never in them.
• Emails you send us, and our replies: as long as we need them to deal with what you asked, and no more than a year after the conversation ends.
• Donations: the record of each one, as long as UK tax law requires us to keep it, currently five years after the 31 January Self Assessment deadline for the tax year it was made in. Ko-fi, Stripe and PayPal keep their own records under their own policies.
• Storage on your device: until you clear it, or close the tab for the session entry.

Transfers abroad

Wisaku is run from the United Kingdom, but its server and database are in Nuremberg, Germany, its account emails are sent from Frankfurt, Germany, and its backups are stored in the EU. The EU and the UK each recognize the other as protecting personal data adequately, so your data can move between them. Amazon Web Services, Cloudflare and Google are US companies, and Cloudflare and Google may handle emails you send us outside the EU, including in the United States. All three are certified under the EU-US Data Privacy Framework and its UK extension, which the EU and the UK accept as adequate protection. Images come from the Wikimedia Foundation, which is based in the United States.

Your rights

You can ask for a copy of the personal data we hold about you, and have it corrected, deleted, restricted or given to you in a portable format. You can also object to what we do on the basis of our legitimate interests. Your account page lets you change your name, email address and password and delete your account yourself; for anything else, write to contact@wisaku.com. We'll answer within a month.

If you're unhappy with how we've handled your data, please tell us. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or, in the EU or EEA, to the data protection authority where you live.

Changes

When what we collect or how we use it changes, we update this page and the date at the top.