Skip to content
Plimp

Privacy

Last updated

Plimp sets no cookies, has no accounts and shows no ads.

Who is responsible

Plimp, Zurich, Switzerland, is responsible for the data described here. Plimp follows the Swiss Federal Act on Data Protection (FADP) and, for players in the European Union, the General Data Protection Regulation (GDPR). For anything about your data, write to hello@plimp.app.

What stays on your device

Plimp saves your progress in your browser’s local storage, not in a cookie. It stays on your device; only the random device ID described below is ever sent to our server.

plimp:v1:meta
a random device ID, the date of your first visit, your theme and sound settings, and game preferences such as a display currency
plimp:v1:<game>:stats
games played and completed, streaks and your score distribution
plimp:v1:<game>:history
your answers, score and finish time for each daily puzzle
plimp:v1:<game>:unlimited
your best unlimited run and how many runs you played
plimp:v1:<game>:polls
which option you picked in each one-tap poll

Clearing your browser’s site data for Plimp deletes all of it.

What the crowd features store

Some games compare your answer with other players. For that, our server stores:

  • Poll votes: the game, the poll, the option you picked, your random device ID and the time.
  • Guesses: the game, the puzzle number, the question and your answer as a number, with your random device ID and the time. In Sticker Shock the number is 1 if your pick was right and 0 if not; in Ping it is how far your first pin landed from the answer, in kilometres.
  • Mistake reports: the game, the item and the message you wrote, with the time. Please do not include personal details in a report.

The device ID is a random number created in your browser. It is only used so that each device counts once. It is not linked to a name, an email address or an IP address.

To limit abuse, the server counts requests per hashed IP address. The hash uses a secret and changes every day, and the counters are deleted within two days. Plimp does not store your IP address.

Why, and on what basis

Plimp uses each piece of data for one purpose only:

  • Votes and guesses: to show how other players answered, and to see which questions are too easy or too hard.
  • Mistake reports: to find and fix wrong facts.
  • Hashed-IP counters: to keep the crowd features from being flooded by automated requests.
  • Technical data at our hosts, such as IP addresses: to deliver the site and keep it secure.

For players in the European Union, the legal basis is our legitimate interest (Article 6(1)(f) GDPR) in running the games, keeping their facts right and protecting the site from abuse. Plimp never uses the data for advertising and never sells it.

Analytics

Plimp currently uses no analytics.

Who processes it, and where

Two companies process data on Plimp’s behalf. Like any web host, they handle technical data such as IP addresses to deliver the site.

  • Vercel Inc., United States hosts the site. Pages are delivered through Vercel’s worldwide network of servers, so the one nearest to you handles your request; the server functions that store votes, guesses and reports run in Dublin, Ireland. Vercel states that it complies with the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework. Its data processing addendum also includes the European Commission’s Standard Contractual Clauses for transfers from the EEA, the UK and Switzerland, together with the UK’s International Data Transfer Addendum for transfers from the UK.
  • Supabase Pte. Ltd., Singapore runs the database that holds votes, guesses, reports and the rate-limit counters. The database is stored in Ireland. Supabase’s data processing addendum applies the European Commission’s Standard Contractual Clauses, with a Swiss addendum, to the data it processes for Plimp. Its privacy notice states that transfers to the United States are subject to standard contractual clauses approved by the European Commission.

How long it is kept

  • Rate-limit counters are deleted within two days.
  • Votes, guesses and mistake reports are kept as long as Plimp runs, because the crowd results are built from them.
  • The device ID exists only on your device. If you clear your browser’s site data for Plimp, a new ID is created, and nothing links you to your earlier votes and guesses any more.

Your rights

You can ask what data Plimp holds about you, and have it corrected or deleted, or object to its use. Write to hello@plimp.app. Plimp knows no names or email addresses, so to find your votes and guesses it needs the device ID from your browser’s local storage (the plimp:v1:meta key). Mistake reports carry no device ID, so to find one, tell us what you wrote.

You can also complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, if you live in the European Union, to your country’s data protection authority.