Plain.

Last updated October 18, 2026

Privacy

Plain is a daily game. We collect as little as we can: you can play without an account, a username account needs no email address or real name, and we use no analytics or tracking tools. This policy explains exactly what we process, why, on what legal basis, for how long, and what your rights are under the EU General Data Protection Regulation (GDPR).

1. Who is responsible

The controller responsible for processing your data on Plain (playplain.app) is:

[Full name][Street and number][Postal code] [City]Germany

Email: hello@playplain.app. More details are in the legal notice (Impressum).

We are not required to appoint a data protection officer (Art. 37 GDPR, § 38 BDSG). For anything about your data, email us directly.

2. In short

  • We store your games so the game works: progress, streak, results and rating.
  • An account is optional. It needs only a username and password, or sign-in with Google.
  • Reminders and personalised ads only happen with your consent, and you can withdraw it at any time.
  • We never sell your data, and we use no analytics or tracking tools.
  • Our servers are run by DigitalOcean and protected by Cloudflare, both in the USA.

3. What we process and why

For each use of data below you'll find the data involved, the purpose, the legal basis under Art. 6(1) GDPR and how long we keep it. “Legitimate interest” means Art. 6(1)(f) GDPR; you can object to that processing (see Your rights).

Visiting Plain

Whenever you open Plain, your browser sends technical data that is needed to deliver the page. Cloudflare receives each request first, filters attacks and passes it on to our server.

Data
IP address, date and time, the page or file requested, referring page, browser and operating system (user agent), response status and amount of data.
Purpose
To deliver Plain, keep it stable and secure, defend against attacks such as denial of service, and find faults.
Legal basis
Legitimate interest (Art. 6(1)(f) GDPR) in providing a secure, reliable website. Without this data, the site can't be delivered at all.
Kept
Our server keeps no log of every page view. Its technical logs (errors and security events), which may contain IP addresses, are deleted after 14 days. Cloudflare processes request data to deliver and protect the site and keeps it only briefly under its own retention rules; we see only aggregated traffic numbers.

Playing, with or without an account

When you first play, we create a guest profile with a random ID and set the session cookie dialed_sid, so the game recognises your device and keeps your progress. We store only a hash of the cookie's value, never the value itself.

Data
Random guest ID; the answers you submit (what you typed and the answer it matched), points, accuracy tier, time to answer and round start times; completed games, altitude, streak and streak freezes, XP, badges, your rating and its history, and reminder preferences.
Purpose
To run the game: score your answers, save your progress across visits, show your results, streak, badges and rating, and compute the daily statistics (the curve and percentiles) that other players see only in aggregated, anonymous form.
Legal basis
Providing the game you use under our Terms (Art. 6(1)(b) GDPR). For the guest session before any account exists: our legitimate interest (Art. 6(1)(f) GDPR) in letting you play without signing up and without losing your progress. Storing the session cookie is strictly necessary for this (§ 25(2) no. 2 TDDDG).
Kept
As long as your guest profile or account exists, so your streak, statistics and rating keep working, until you ask us to delete it. The session cookie expires 400 days after it was set. Aggregated daily statistics contain no personal data.

Creating an account

Data
Your username, your password as a salted scrypt hash (we never store or see the password itself), your confirmation that you are 13 or older, and the creation date. Your guest progress moves into the new account.
Purpose
To let you sign in on any device and keep your progress safe.
Legal basis
Providing the account you asked for under our Terms (Art. 6(1)(b) GDPR).
Kept
Until you ask us to delete your account. A username change is also possible by email.

Sign-in with Google

If you choose “Continue with Google”, you sign in on Google's own page and Google sends us your Google account ID, name and email address. Your username is generated from your name (from your first name and last initial, like “ben_s”); email us if you want it changed. We don't receive or store your Google password or any Google access tokens. Google processes your data as its own controller under the Google Privacy Policy.

Data
Google account ID, email address, the times of your first and last Google sign-in. Your name is used only once, to suggest your username, and is not stored separately. During sign-in, a short-lived security cookie (dialed_goauth) protects against forged sign-in attempts.
Purpose
To identify your account when you sign in with Google. Your email address is never shown publicly and never used for marketing.
Legal basis
Providing the sign-in you chose under our Terms (Art. 6(1)(b) GDPR).
Kept
As long as your account exists. The sign-in cookie expires after 10 minutes.

Daily reminders (push notifications)

If you turn on reminders, we send one reminder at your chosen time on days you haven't played yet and, only when it's true, a “streak at risk” note. The push service of your browser or phone delivers them (see Who receives data). Messages are end-to-end encrypted, so the push service can't read them.

Data
Your browser's push subscription (an address at your push service and encryption keys), your chosen reminder time, your time zone, and a log of which reminders were sent when (so you never get one twice).
Purpose
To send the reminders you asked for, at the right local time.
Legal basis
Your consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG), given by turning reminders on and allowing notifications in your browser. You can withdraw it at any time by turning reminders off in Profile or blocking notifications for playplain.app in your browser. Withdrawal doesn't affect anything done before.
Kept
Until you turn reminders off, your push service reports the subscription as expired, or your data is deleted.

Protection against abuse

Data
IP address (for IPv6, only the network part), the username tried at login, and counters with a time window.
Purpose
To stop password guessing, mass-created guest players and spam (for example too many login or sign-up attempts in a short time).
Legal basis
Legitimate interest (Art. 6(1)(f) GDPR) in protecting accounts and keeping Plain available and fair for everyone.
Kept
Each counter expires after at most 24 hours and is then deleted automatically.

Answers we didn't recognise

When an answer matches nothing in the game's lists, we log the text, the category, how often it was typed, and when it was first and last seen, without any link to you (no player ID, no IP address). We use this to add missing answers. Please don't type personal information into the answer box.

Legal basis
Legitimate interest (Art. 6(1)(f) GDPR) in improving the answer lists.
Kept
Until we have reviewed the entries and no longer need them.

Emailing us

Emails to hello@playplain.app pass through Cloudflare Email Routing and are delivered to our mailbox, which is hosted by Google (Gmail).

Data
Your email address, your name if you give it, your message and any attachments, and the email's technical metadata.
Purpose
To answer you and to handle your requests, including requests about your data.
Legal basis
Art. 6(1)(b) GDPR when your message is about using Plain; otherwise our legitimate interest (Art. 6(1)(f) GDPR) in answering. For requests about your rights: our legal obligation (Art. 6(1)(c) GDPR).
Kept
As long as needed to deal with your message and any follow-up, then deleted, unless the law requires us to keep it (for example a record that we fulfilled a data protection request).

Ads

Ads are currently switched off. This section describes what will apply once we switch them on; we will update the date of this policy then.

Plain is free and supported by ads served by Google AdSense (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, USA). Ads appear only outside the game itself, never during a round. Google and its partners use cookies and similar technologies to show ads, measure how they perform, limit how often you see the same ad and prevent fraud. With your consent, ads may be personalised based on your visits to Plain and to other websites.

If you are in the European Economic Area, the United Kingdom or Switzerland, a Google-certified consent message (based on the IAB Transparency and Consent Framework) asks for your choice before any cookies or identifiers are used for ads. You can change or withdraw your choice at any time through the privacy and cookie settings link that the consent message adds to the page. Without consent, Google may still show limited, non-personalised ads that don't use cookies for advertising.

Data
Cookie and device identifiers, IP address (also used for approximate location), browser and device information, the page you are on, and how you interact with ads.
Purpose
To show, measure and, with your consent, personalise ads, and to prevent ad fraud. This finances Plain.
Legal basis
Your consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG) for cookies, device identifiers and personalised ads. Google acts as an independent controller for ad serving under its own terms.
Kept
Google's advertising cookies last up to 13 months. Google decides how long it keeps the data it collects.

How Google uses information from sites that use its services: policies.google.com/technologies/partner-sites. Google's cookies are listed at policies.google.com/technologies/cookies. You can turn off personalised ads in Google's My Ad Center. We only see aggregated reports from Google, such as how many ads were shown, and never anything that identifies you. We never sell your data.

People who appear as answers

A few categories use publicly available facts about well-known people, such as Instagram follower counts or ages at death, taken from Wikipedia and Wikidata (see Sources). We process them based on our legitimate interest (Art. 6(1)(f) GDPR) in offering a factual trivia game and the public interest in information about public figures. If you are one of these people and object, email us and we'll remove the entry.

4. Cookies and storage on your device

Under § 25 TDDDG, storing information on your device or reading it needs your consent unless it is strictly necessary for a service you asked for. Plain uses only these:

Strictly necessary (no consent needed, § 25(2) no. 2 TDDDG)

  • dialed_sid (cookie, Plain): Your session, so the game remembers your progress and keeps you signed in. HttpOnly and secure, unreadable to scripts. Lasts: 400 days.
  • dialed_goauth (cookie, Plain): Only while you sign in with Google; protects against forged sign-ins. Lasts: 10 minutes.
  • __cf_bm (cookie, Cloudflare): Only if Cloudflare's bot protection needs it, to tell people from automated traffic. If you are shown a security check, Cloudflare may also set cf_clearance for a similar short time. Lasts: about 30 minutes.
  • Local storage (your browser, Plain): Your current game (so a reload doesn't lose it), your settings (sound, haptics, theme, reduced effects, whether you've seen the tips), and small markers so hints and celebrations show only once. It stays on your device; the game data in it is also stored on our server as described above. Lasts: until you clear site data.
  • Session storage (your browser, Plain): The answer you're typing, so a reload mid-round doesn't wipe it. Lasts: until you close the tab.
  • Service worker and cache (your browser, Plain): A copy of Plain's own app files (no personal data), so it loads fast, works as a home-screen app and can show reminders. Lasts: until the next update or until you clear site data.

Only with your consent (§ 25(1) TDDDG)

  • Push subscription (your browser): Created when you turn on reminders and allow notifications. Lasts: until you turn reminders off.
  • Google ad cookies and identifiers (Google, once ads are on): For example __gads, __gpi or IDE; only after you agree in Google's consent message. That message stores your choice in a cookie of its own so it doesn't ask again. Lasts: up to 13 months.

Our fonts are served from our own server, so opening Plain sends no request to Google Fonts or any other font service.

5. Who receives data

We share data only with these providers, and only as far as each one needs it:

  • DigitalOcean, LLC (USA) hosts our server and database in a data centre in New York. It processes data only on our behalf under a data processing agreement (Art. 28 GDPR).
  • Cloudflare, Inc. (USA) sits in front of our server: it delivers the site, encrypts connections, protects against attacks and overload, and forwards emails to our mailbox. It acts on our behalf under a data processing agreement (Art. 28 GDPR).
  • Google (Google Ireland Limited and Google LLC, USA): if you sign in with Google, for our mailbox (Gmail) and, once ads are on, as the ad provider with your consent, as described above.
  • Push services, only if you turn on reminders: the one your browser uses delivers the encrypted message, for example Google (Firebase Cloud Messaging, for Chrome and Android), Mozilla (Firefox), Apple (Safari and home-screen apps on iPhone and iPad) or Microsoft (Edge on Windows). Your browser chooses the service, not us.
  • Authorities, only where we are legally required to (Art. 6(1)(c) GDPR).

Nobody else receives your data. We don't sell it, and we use no analytics tools.

6. Transfers outside the EU

DigitalOcean, Cloudflare, Google and the push services are based in the USA or process data there. For companies certified under the EU-U.S. Data Privacy Framework, the European Commission has decided that the USA ensures an adequate level of protection (adequacy decision of 10 July 2023, Art. 45 GDPR); where a recipient is certified, transfers rely on this decision. Where a recipient is not certified, or for transfers the framework doesn't cover, they rely on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), which these providers include in their data processing terms. You can check a company's certification at dataprivacyframework.gov and ask us for a copy of the safeguards.

7. How long we keep data

The retention period for each use is listed above. In short: game data and accounts stay until you ask us to delete them; abuse-protection counters expire within 24 hours; server logs are deleted after 14 days. Our server makes a daily database backup that is kept for 14 days, so deleted data disappears from backups within 14 days as well. We delete data earlier if the purpose no longer applies, and keep it longer only where the law requires.

8. How we protect your data

  • All connections are encrypted (HTTPS with TLS); browsers are told to use only encrypted connections (HSTS).
  • Passwords are stored only as salted scrypt hashes; session tokens only as SHA-256 hashes.
  • Session cookies are HttpOnly, Secure and SameSite, so scripts and other sites can't read or misuse them.
  • Rate limits stop password guessing; Cloudflare filters attacks and overload before they reach our server.
  • Administrator access to the server is restricted, and we collect only the data the game needs.

No system is perfectly secure. If a data breach is likely to put your rights at risk, we will inform the supervisory authority and, where required, you (Art. 33 and 34 GDPR).

9. Your rights

Under the GDPR you have the right to:

  • access your data and get a copy (Art. 15);
  • have incorrect data corrected (Art. 16);
  • have your data deleted (Art. 17);
  • have its processing restricted (Art. 18);
  • receive the data you gave us in a common machine-readable format, or have it sent to someone else (data portability, Art. 20);
  • withdraw a consent at any time, with effect for the future (Art. 7(3)), for example by turning reminders off or changing your ad choice.

Your right to object (Art. 21 GDPR)

Where we process your data based on legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. We will then stop, unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or we need the data to establish, exercise or defend legal claims. We don't use your data for direct marketing.

To use any of these rights, email hello@playplain.app. If you have an account, include your username; we may ask you to confirm that the account is yours. We answer within one month (Art. 12(3) GDPR). There is no self-service deletion yet, so deletion and username changes are done by email.

If you play as a guest, we can only find your data if you can show that it's yours (Art. 11 GDPR). The easiest way is to create an account first (your guest progress moves into it) and then email us with your username. Clearing your browser's cookies for playplain.app ends the link between your device and your guest data.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU country where you live or work, or where the alleged infringement took place. The authority responsible for us is: [Data protection authority of your federal state] ([Authority website]).

10. Automated decisions

We make no decisions based solely on automated processing that have legal or similarly significant effects on you (Art. 22 GDPR). Your scores, rating, badges and percentiles are calculated automatically, but they only describe your games. If you consent to personalised ads, Google uses your data to build an interest profile (profiling) to choose ads; that is Google's processing under its own responsibility.

11. Children and teens

You must be 13 or older to create an account. If you're under 16, ask a parent before allowing personalised ads or turning on reminders: in Germany, consent to these from anyone under 16 needs a parent's approval (Art. 8 GDPR). Parents who believe their child has given us data without permission can email us, and we'll delete it.

12. Do you have to provide data?

No. You are not legally or contractually required to give us any data. Without the session cookie, though, the game can't save your progress, and without a username and password (or Google sign-in) we can't create an account.

13. Changes to this policy

We update this policy when Plain or the law changes; the date at the top shows the latest version. If a change affects how we use data you have already given us, we'll tell you in the game before it takes effect and, where the law requires, ask for your consent.