Short version: we save only what is needed to run the games, keep your progress and show leaderboards. We do not sell data, show ads or use tracking. You can delete your account yourself at any time.
1. Who is responsible
The data controller is David Larsson, a private individual in Sweden. You can reach me at info@disco.games.
This policy covers all games on disco.games and its subdomains. Right now that is:
| Game | Address | What it is |
|---|---|---|
| Guess the Career | guessthecareer.disco.games | Guess the footballer from their career table |
| Mumla | mumla.disco.games | A daily Swedish word game, with leaderboard and challenges between players |
Each game has its own account and database. Signing in to one game does not sign you in to another, and your data in one game is not shared with the others. When a new game is added, this policy is updated first.
2. What data we collect and why
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Guest account. An anonymous account with a random ID, stored as a session in your browser. Guess the Career created when you make your first guess. Mumla created when you open the game. |
To save your progress without asking you to sign in, and to let you keep it when you later sign in with Google. | Performance of the service (Art. 6(1)(b)) |
| Google sign-in. Your name, email address and a link to your profile picture, as provided by Google, plus your Google account identifier. | To create and secure your account. Your email address is only shown to you, in your own profile. | Performance of the service (Art. 6(1)(b)) |
| Profile. A display name (by default your Google name, which you can change) and a two-letter country code. | To show you on the leaderboard with a country flag next to your name. | Performance of the service (Art. 6(1)(b)) and legitimate interest in running a leaderboard (Art. 6(1)(f)) |
| Gameplay data. Guess the Career which players you have identified, your wrong guesses (with time), your current and longest streak, free players you have earned, and which player you are currently guessing. Mumla the words you guess each day, the result of each guess, whether you solved the word and on which attempt, and your streaks. |
To save your progress, calculate rankings and statistics, and show the same game on all your devices. | Performance of the service (Art. 6(1)(b)) |
| Challenges Mumla who you challenge and who challenges you, the word each of you chooses, your guesses and results, and whether a challenge was accepted or declined. | To run challenges between players and show head-to-head results. | Performance of the service (Art. 6(1)(b)) |
| Country lookup and IP address. To set your flag automatically, we look up your country from your IP address when you sign in with Google. Guess the Career your browser asks a geolocation service (ipapi.co). Mumla our hosting provider (Vercel) reads the country from the request. In both cases we store only the country code, never the IP address. Our hosting and infrastructure providers also process IP addresses in technical logs. |
To show a country flag, and to keep the services secure and available. | Legitimate interest (Art. 6(1)(f)) |
| Bot protection Guess the Career when you make your first guess as a guest, Cloudflare Turnstile runs a short check in your browser to tell people from automated bots. Cloudflare processes technical signals such as your IP address and browser information. We only receive a pass or fail result. | To stop bots from creating large numbers of guest accounts and abusing the service. | Legitimate interest (Art. 6(1)(f)) |
| Security data. Counts of guesses over time, and server-side checks of how many attempts you have made. | To prevent cheating and automated abuse. | Legitimate interest (Art. 6(1)(f)) |
| Emails to us. If you write to info@disco.games, we receive your email address and your message. | To answer you. | Legitimate interest (Art. 6(1)(f)) |
We do not collect special categories of personal data, and we do not sell your data. We do not currently show advertising or use analytics tools. If that changes, this policy will be updated first, and we will ask for your consent where the law requires it.
3. What is public
Leaderboards are visible to everyone who visits the games. Guest accounts are never shown on a leaderboard. For signed-in players, the following is shown:
- Guess the Career: your display name, country flag, score and streak badge. Clicking a name also shows that person's three best leagues as percentages.
- Mumla: your display name, country flag, and how many words you have solved out of the days you have played. Clicking a name also shows how many words that person solved on each attempt.
Challenges in Mumla are only visible to the two players involved. After both of you have played, each of you can see the other's word, number of attempts and the result, and your head-to-head record against each other.
Choose a display name you are comfortable sharing publicly. You can change it at any time in your profile.
4. Who we share data with
We use the following service providers. They process data on our behalf, or, in Google's case, provide the sign-in.
| Provider | What for | Where |
|---|---|---|
| Supabase | Database and sign-in (accounts, profiles, progress, challenges) | Data is stored in the EU: Guess the Career in Ireland (AWS eu-west-1), Mumla in Sweden (AWS eu-north-1) |
| Vercel | Hosting of the websites, and the country lookup in Mumla | Global network; company based in the US |
| Cloudflare | Domain registration, DNS, email forwarding for info@disco.games, and bot protection (Turnstile) in Guess the Career | Global network; company based in the US |
| "Sign in with Google", and web fonts in Mumla (Google Fonts) | Global; company based in the US | |
| jsDelivr | Delivers a code library the games use to talk to the database | Global network |
| ipapi.co | Looking up your country from your IP address in Guess the Career | Third-party service (see its privacy policy) |
When your browser loads fonts or code libraries from these providers, they receive your IP address as part of the normal request. We do not share your data with anyone else, except where the law requires it.
5. Transfers outside the EU/EEA
Some providers above are based in, or may process data in, countries outside the EU/EEA, such as the United States. Where that happens, the transfer relies on safeguards required by the GDPR, such as the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework. You can ask for more information at info@disco.games.
6. How long we keep your data
- Accounts, profiles, gameplay data and challenges: until you delete your account. Challenges you took part in are deleted together with your account.
- Guest accounts: deleted automatically after 30 days without activity.
- Backups: if you delete your account, copies in backups are removed within 30 days.
- Technical logs: kept by our infrastructure providers according to their own retention periods.
- Emails you send us: as long as needed to handle your request.
7. Your rights
Under the GDPR you have the right to:
- get access to the personal data we hold about you
- have incorrect data corrected
- have your data erased
- restrict or object to certain processing, including processing based on legitimate interest
- receive your data in a portable format
Delete your account yourself: sign in to the game, open your profile and choose Delete account (in Mumla: Radera konto). This permanently removes your account and everything connected to it in that game, including progress and your leaderboard entry. It cannot be undone. Since each game has its own account, delete it in each game you have used.
For anything else, such as access to your data, removing your country flag or other requests, email info@disco.games. We aim to reply within one month.
If you think we handle your data incorrectly, you have the right to complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at imy.se.
8. Cookies and local storage
The games store your sign-in session in your browser's local storage. This is strictly necessary for you to stay signed in and keep your progress. Mumla also stores your game for the day, your colour settings and which challenge notifications you have seen, so the game works the way you left it. This data stays in your browser and is removed when you sign out or clear your browser data.
The Cloudflare Turnstile check in Guess the Career is used only for security, not for advertising or tracking. We do not use advertising or tracking cookies. When you sign in, Google may set its own cookies on its sign-in pages, governed by Google's policies.
9. Security
Answers are checked on the server, so they are not sent to your browser before you have played. Access to the databases is restricted with row level security, and data is sent over encrypted connections. No system is perfectly secure, but we work to protect your data.
10. Children
The games are not intended for children under 13. If you believe a child has created an account, contact us and we will delete it.
11. Changes to this policy
We may update this policy when the games change, for example when we add a game or a feature. The date at the top shows when it was last updated. For significant changes, we will make it visible in the games.
12. Contact
David Larsson
Email: info@disco.games