🔒

Privacy Policy

Data Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) for the data processing on GeoBlitz is the person named in the Legal Notice; there you will also find the full contact details for data protection enquiries. If you contact us via the email address provided there, we process your details solely to handle your enquiry (Art. 6 Abs. 1 lit. b und lit. f DSGVO (GDPR)). We are not legally obliged to appoint a data protection officer.

In short

GeoBlitz works without an account and without a login. In the daily challenges and in Geo Streak you play anonymously via a random identifier stored only locally in your browser. In the remaining single-player runs as well as in multiplayer rooms you enter a freely chosen nickname yourself, which is stored on the server together with your game result (score) for the daily leaderboards. No IP addresses are stored in the leaderboard database; however, for technical reasons integrated third parties (hosting, flag CDN, advertising) process your IP address as described below.

Please do not enter any real names or other personal data as your nickname – a made-up nickname is sufficient.

Hosting & Server Logs

The site is hosted by Vercel. With every request, technically necessary server log files are created that your browser transmits automatically – including the IP address, the date and time of access, the address requested, and the browser and operating system used. The legal basis is our legitimate interest in a secure and trouble-free operation of the site (Art. 6 Abs. 1 lit. f DSGVO (GDPR)).

The provider is Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA, which acts for us as a processor on the basis of a data processing agreement (Art. 28 DSGVO (GDPR)). The application is operated in the EU region Frankfurt (fra1), so that processing takes place primarily within the EU. Insofar as personal data is transferred to the USA in the process, Vercel Inc. is certified under the EU-U.S. Data Privacy Framework, so that the transfer is based on the European Commission's adequacy decision (Art. 45 Abs. 1 DSGVO (GDPR)); in addition, the European Commission's Standard Contractual Clauses have been agreed (Art. 46 Abs. 2 lit. c DSGVO (GDPR)). The server log files are stored only for as long as is necessary for security and technical operation and are then automatically deleted.

Game Scores & Database

Scores, daily leaderboards and the nickname you enter (in single-player runs outside the daily challenges as well as in multiplayer rooms) are stored in a Supabase database.

The legal basis for operating the leaderboards and the game progress function is our legitimate interest (Art. 6 Abs. 1 lit. f DSGVO (GDPR)); insofar as you enter a nickname yourself in single-player runs or in multiplayer rooms, we process it in order to provide the gaming or multiplayer service you have actively requested (Art. 6 Abs. 1 lit. b DSGVO (GDPR)). No IP addresses and no other device or network identifiers are stored in the database, but solely the nickname or the anonymous identifier, game metadata and timestamps. The provider is Supabase, Inc., 970 Toa Payoh North #07-04, Singapore 318992, which acts as a processor on the basis of a data processing agreement (Art. 28 DSGVO (GDPR)). The project region is Frankfurt, so that the data is physically stored within the European Economic Area. As the provider is based in a third country (Singapore) and access from third countries (including the USA) cannot be ruled out in the course of operation and support, such access is safeguarded by the European Commission's Standard Contractual Clauses (Art. 46 Abs. 2 lit. c DSGVO (GDPR)). Scores, leaderboard entries, the personal streak best value and any nickname remain stored until you request their deletion or they are no longer needed for the operation of the leaderboards; transient run and room data (open quiz rounds as well as streak and multiplayer runs) are removed automatically – ordinary rounds at the latest around ten minutes after the start, daily and streak runs at the change of day at midnight (time zone Europe/Berlin).

Local Storage in the Browser

For the game function, GeoBlitz stores an anonymous identifier as well as small progress data in your browser's local storage (localStorage) – specifically a random anonymous identifier for the daily leaderboards ('geoblitz.dailyId'), your most recently entered nickname ('geoblitz.username') and your personal streak best value ('geoblitz.streak.best'). For multiplayer rooms, a transient game identity is additionally stored per browser tab in sessionStorage ('geoblitz.flaggenbattle.identity', 'geoblitz.georoulette.identity', 'geoblitz.potato.identity'). For the language switch, GeoBlitz also sets a technically necessary first-party cookie named 'NEXT_LOCALE', which remembers the language you last selected (German or English). This data remains on your device, is strictly necessary for the service you have called up (§ 25 Abs. 2 TDDDG) and therefore does not require consent. No tracking takes place; you can delete the data at any time via your browser settings.

Audience measurement (Vercel Web Analytics)

For anonymous audience measurement, GeoBlitz uses Vercel Web Analytics. The service works without cookies and collects solely aggregated, anonymous statistics about page views (for example the page visited, the approximate region of origin, the device type) – without setting cookies, without storing or reading information on your device, without recognising you across pages or sessions and without forming a cross-device profile. The measurement data is processed via our own domain (first-party). The legal basis is our legitimate interest in data-minimising statistics to improve our offering (Art. 6 Abs. 1 lit. f DSGVO (GDPR)). The service is operated by Vercel Inc. (USA); for any transfer associated with it, the same safeguards apply as for hosting (EU-U.S. Data Privacy Framework, Art. 45 Abs. 1 DSGVO (GDPR), in addition Standard Contractual Clauses, Art. 46 Abs. 2 lit. c DSGVO (GDPR)).

Flag Images (CDN)

The country flags shown in the game are loaded from flagcdn.com (Flagpedia). For technical reasons, your device's IP address is transmitted to the CDN provider in the process. The legal basis is our legitimate interest in a fast and resource-efficient delivery of the flag images (Art. 6 Abs. 1 lit. f DSGVO (GDPR)).

The transmission of the IP address is technically necessary so that the image server can deliver the flag to your browser at all; without this information the image could not be retrieved. No tracking or recognition of your person takes place in the process, and no data going beyond the connection information required for retrieving the image is transmitted to us. As flagcdn.com is operated as a content delivery network, delivery via servers outside the EU cannot be ruled out. To avoid this third-party transfer entirely, the flag images can alternatively be self-hosted.

Cookie Consent (Cookiebot)

To obtain and manage your consent to non-necessary cookies and services (in particular advertising), GeoBlitz uses Cookiebot, a service provided by Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark. On your first visit, Cookiebot displays a consent banner and stores your choice in a technically necessary first-party cookie named 'CookieConsent' (storage period 12 months). As proof of consent, Cookiebot also processes your IP address (according to the provider, in shortened or encrypted form), technical browser data, the URL called up as well as the date and time.

The 'CookieConsent' cookie is strictly necessary and is set on the basis of § 25 Abs. 2 TDDDG; the processing to document your consent is based on Art. 6 Abs. 1 lit. c DSGVO (GDPR) (legal obligation to provide proof pursuant to Art. 7 Abs. 1 DSGVO (GDPR)). You can change or withdraw your consent at any time with effect for the future by reopening the cookie dialogue via the consent widget or by deleting the 'CookieConsent' cookie in your browser.

Usercentrics A/S acts for GeoBlitz as a processor on the basis of a data processing agreement (Art. 28 DSGVO (GDPR)).

Advertising (Google AdSense)

GeoBlitz integrates Google AdSense, a service for delivering advertisements. The contracting party within the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland. Insofar as advertisements are delivered, Google and its partners use cookies or device identifiers to display advertisements and measure their performance. For users in the EEA and the United Kingdom, consent is obtained in advance via our Google-certified consent banner (Cookiebot, see above). Without your consent, the AdSense service remains blocked by the consent banner; no advertisements are then delivered and no advertising cookies or device identifiers are set or read. The legal basis is your consent pursuant to Art. 6 Abs. 1 lit. a DSGVO (GDPR) in conjunction with § 25 Abs. 1 TDDDG.

In the course of ad delivery, personal data is also transferred to the USA to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google LLC is certified under the EU-U.S. Data Privacy Framework, so that the transfer is based on the European Commission's adequacy decision (Art. 45 Abs. 1 DSGVO (GDPR)); in addition, Google uses the European Commission's Standard Contractual Clauses (Art. 46 Abs. 2 lit. c DSGVO (GDPR)). In the context of advertising, Google uses various cookies with different storage periods; you can find details on this as well as on further processing at https://policies.google.com/technologies/partner-sites and https://policies.google.com/privacy. Consent to advertising cookies requires that you are at least 16 years old; younger users need the consent of their legal guardians for this (Art. 8 DSGVO (GDPR)). Once given, you can withdraw your consent at any time with effect for the future via the consent widget.

Encryption (SSL/TLS)

To protect the transmitted data, GeoBlitz uses SSL or TLS encryption. All connections are established exclusively via HTTPS, recognisable by the fact that your browser's address bar begins with 'https://'. This means that the data exchanged between your device and the server cannot be read by third parties.

Your Rights

Within the scope of the statutory provisions, you have the right at any time to information/access (Art. 15 DSGVO (GDPR)), rectification (Art. 16 DSGVO), erasure (Art. 17 DSGVO), restriction of processing (Art. 18 DSGVO), data portability (Art. 20 DSGVO) as well as the right to object to processing on grounds relating to your particular situation (Art. 21 DSGVO). Insofar as processing is based on your consent, you can withdraw it at any time with effect for the future (Art. 7 Abs. 3 DSGVO); the lawfulness of the processing carried out up to the withdrawal remains unaffected. In addition, you have a right to lodge a complaint with a data protection supervisory authority – for example with the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia responsible for our registered office, or with the supervisory authority of your habitual residence, your place of work or the place of the alleged infringement. Automated decision-making including profiling with legal effect pursuant to Art. 22 DSGVO does not take place. To exercise your rights, please contact the address named in the Legal Notice.

Changes to this Privacy Policy

We adapt this privacy policy as soon as changes to GeoBlitz or to the legal situation make this necessary. The current version published here always applies. Last updated: July 2026.

🗂️ Data Sources & Attribution

GeoBlitz uses open data and hereby fulfills the attribution requirements of the respective licenses:

Country data: dr5hn/countries-states-cities-database – Open Database License (ODbL) v1.0
Statistics: CIA World Factbook (public domain) · World Bank Open Data (CC BY 4.0)
Maps & outlines: Natural Earth via world-atlas (public domain)
Flags: flagpedia.net / flagcdn.com
Germany – city districts: Stadt Essen (opendata.essen.de), Stadt Frankfurt am Main, Freie und Hansestadt Hamburg (LGV) – each dl-de/by-2-0, modified · Stadt Dortmund (dl-de/zero-2-0)