Privacy
Updated 18 October 2026. Controller: Dirk Ohlmann, Konrad-Adenauer-Straße 4, 56564 Neuwied, Germany. Contact: [email protected].
Website hosting
Cloudflare Pages delivers this website; Pages Functions handle game and account requests and Cloudflare D1 stores the application data. Cloudflare receives necessary connection information, including IP address, requested URL, time and browser information, to deliver and secure the service. The application database was created with the EU jurisdiction restriction. This does not mean that every network or request-processing operation takes place exclusively in the EU.
Provider: Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Hosting can involve processing outside the European Economic Area. Details on international transfer safeguards and provider retention are in Cloudflare’s privacy policy and data processing addendum. The purpose is reliable delivery and security, based on our legitimate interest under Article 6(1)(f) GDPR.
Guests, accounts and passkeys
You can play as a guest with a nickname. An account stores an internal ID, username, public passkey and credential identifier, verification metadata, recovery-code hash, game attempts and earned points. Your device keeps the private key; this website receives no fingerprint, face image or other biometric data. No email address or date of birth is required for an account. Recovery codes are shown once and are replaced when used; recovery revokes existing sessions and passkeys.
These data provide the game, maintain your account and preserve the score you requested, under Article 6(1)(b) GDPR. A necessary HttpOnly session cookie keeps you signed in for up to 30 days. The server stores a hash of its session token. Optional advertising is described below and requires the cookie-dialog choice.
When you open an original game, this browser tab temporarily stores its current game session and study/answer deadlines in sessionStorage so that moving from the homepage or reloading does not restart the timer. The data stay in this tab and are removed when the tab session ends; the one-time homepage handoff is consumed by the game. This storage is necessary for the game you requested.
Cookies and optional advertising
On your first visit, the cookie dialog explains necessary session storage and optional Adsterra and Google AdSense advertising. Accept grants the described advertising, measurement and storage access; Reject keeps optional advertising off. All games remain available. We store the choice, version and timestamp in this browser's localStorage for up to 180 days. Expiry or a new consent version asks again. Necessary session and game storage is independent.
Advertising scripts load on the production homepage only after acceptance. They run directly on this page, can access its content and may process your IP address, device information, cookies and identifiers for advertising, measurement and fraud prevention. Optional storage/access and subsequent advertising processing are based on your consent under Section25(1) TDDDG and Article6(1)(a) GDPR.
Adsterra supplies the native banner. Providers: AD MARKET LIMITED, Cyprus, and ADMEDIA LLC FZ, United Arab Emirates. Details: Adsterra privacy policy and cookie policy.
Google AdSense supplies a separate responsive display unit. For the EEA, the provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin4, Ireland. We explicitly request ads without personalization and with child-restricted treatment. This does not promise complete anonymity: Google still processes connection data and may use storage for frequency capping, aggregated measurement and fraud prevention. Information about Google and participating advertising partners: Google advertising technologies and Google privacy policy. Provider processing may take place outside the EEA.
You can withdraw through Cookie settings in the footer and choose Reject. If advertising is already running, the page reloads to terminate its active document, scripts and frames. Unfinished inputs may be lost; saved points remain. This cannot undo prior transmissions or automatically remove third-party cookies already set; you can delete those in your browser. We use no additional analytics or social-media tracking scripts.
Optional Google and TikTok sign-in
Where configured and available, you can choose Google or TikTok instead of a passkey. Clicking a provider opens its own authorization service. Google sign-in requests basic OpenID profile access; TikTok requests user.info.basic. The provider handles your password and its own permissions. We receive its stable account identifier and may temporarily receive basic profile information to verify the sign-in. We store the provider name and account identifier linked to your internal game account. Provider access tokens are used on the server for sign-in and are not stored for background access, published, or sent to the browser. We do not obtain permissions to post, read your contacts, or access your videos.
A necessary HttpOnly cookie and a single-use server transaction protect this chosen login for up to ten minutes. Your existing guest points are retained when creating or returning to an account. An already signed-in account can explicitly link another offered provider; accounts are never joined merely because an email address matches. Your public score uses the game nickname, not a Google or TikTok profile name. The purpose is the sign-in/account service you request, under Article 6(1)(b) GDPR. These providers have their own privacy terms: Google and TikTok. An unconfigured provider is not presented as a working sign-in option. Game-account recovery revokes game sessions and passkeys but does not remove linked provider identities or revoke your Google/TikTok credentials; a valid provider sign-in remains available.
Scores and shared challenges
Public rankings show registered usernames and points. Anyone given a challenge link or code can see its nickname list, teams and scores and join while it is open. Choose a nickname rather than personal contact information, and share invitations with the people you intend. Challenges accept play for 24 hours. Rankings are recreational and have no prizes; no automated profiling or decisions with legal or similarly significant effects are made.
Retention, export and deletion
Account scores and game history remain until you delete your account. The account menu lets you export your data and delete the account, sessions, passkeys and dependent challenge data. Expired sessions are removed during cleanup. Guest accounts without a valid session and older than two days are removed when a new guest session triggers cleanup; because guest sessions may last 30 days, closing the browser alone does not immediately delete the server record. Closed challenge data may remain in the related account history until account deletion or guest cleanup. Cloudflare’s Free D1 recovery history can retain an earlier database state for up to seven days; deleted data are not brought back into ordinary use intentionally.
For abuse prevention, the server stores a hash derived from the IP address with request counts and short time buckets. This is pseudonymised rather than anonymous. Expired rate-limit records older than one day are removed on guest-session cleanup; actual deletion depends on subsequent service activity. Security processing is based on Article 6(1)(f) GDPR.
Help, contact and feedback
The cup helper displays prepared game rules in English and German. This help makes no calls to an AI service. If you submit a technical report, feedback or a contact request through the form, we store the category and text, language, time, ticket reference and any optional reply address or game association in a separate private support queue in Cloudflare D1. You can optionally include the page path without query parameters and broad display dimensions. The queue is not publicly readable and is reviewed manually. Messages trigger no automatic AI analysis or remote operation; people read feedback. Submitting this form does not automatically send email. The additional email button opens a draft in your own mail application, which you decide whether to send. For spam prevention, support also stores short-lived request counters and a hash derived from the connection address, not a raw IP address. Resolved messages are deleted during manual support maintenance once no longer needed. To request access to or deletion of a message, provide its ticket reference through the contact route.
Media and external destinations
Current fonts, design images and scripts load from this website. Imported memes and videos may use their own HTTPS media host; loading such media can transmit connection data to that host. An item’s licence and source are shown where available. External links open the relevant service when you click them; its own privacy terms apply. The game videos and English/German captions are served from this website. Videos retain their original English image text. No finished reusable meme collection was found in the existing material.
Your rights and contact
Subject to the applicable conditions, you have rights to access, correction, deletion, restriction, data portability and objection to processing based on legitimate interests. Contact the controller above for requests that the account controls do not cover. You can complain to a supervisory authority, including the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz: datenschutz.rlp.de. More information: European Commission: individual data protection rights.