Privacy Policy
This English version is a courtesy translation — the German version is the authoritative one.
Sounds Legit is a private hobby project. Playing works without an account, there are no ads and no marketing tracking. This page states honestly which data comes up while playing, where it goes and why.
Controller
David Gonzalez Casin
E-mail: david.gonzalezcasin@gmail.com
Hosting: Vercel
The website runs on Vercel (Vercel Inc., USA); the server functions execute in Frankfurt am Main. Accessing the site technically produces server logs containing your IP address, the time of access and browser information. We also use Vercel's Web Analytics and Speed Insights to see visitor counts and loading times — both work without cookies and without recognizing individual people; the statistics are aggregated. The legal basis is our legitimate interest in secure, stable operation (Art. 6(1)(f) GDPR).
Playing: Supabase
All game data lives in a Supabase database in Frankfurt am Main (AWS region eu-central-1). On your first visit your browser automatically receives an anonymous play session: a session token with a random user ID — no name, no e-mail, no account. The game does not work without this token; it is technically necessary and therefore requires no consent (§ 25(2) no. 2 German TDDDG). The legal basis for the processing is the provision of the game (Art. 6(1)(b) GDPR).
We store what belongs to playing: your freely chosen player name, your game color and figure, lobby and game membership, your answers, votes, ratings and any theme wishes you enter. Fellow players in your lobby see your player name and answers — that is the point of the game. Ideally pick a pseudonym as your name. Submitted answers may flow into the game's question pool permanently — anonymously, without player names and without any link to your session.
Error diagnostics: Sentry
When something goes technically wrong, an error report goes to Sentry (Functional Software, Inc.), processed in the EU data region. Such reports contain error details, browser and device information and the IP address. A small share of sessions (and sessions with errors) is additionally recorded as a "session replay" — a sequence of interaction steps in which texts and inputs are masked by default. This serves solely to reproduce and fix errors (Art. 6(1)(f) GDPR).
Via the feedback form in the settings you can voluntarily send us a message; name and e-mail address are optional. We use them only to respond to your feedback (Art. 6(1)(a) GDPR — consent, revocable at any time).
AI-generated questions: Anthropic
Our server creates the quiz questions with Anthropic's API. No player data is transmitted in the process — no names, no answers, no session data. Only an optionally entered free-text theme wish goes to the API as text. So please don't put anything personal into the theme field.
Community: Discord
We link to our Discord server on the contact page. That is a plain link — the site itself embeds nothing from Discord and transmits nothing there. If you join the server, Discord's privacy policy applies (Discord Inc., USA).
No tracking cookies, no banner
Besides the technically necessary session token, the site stores in your browser only your sound, music and animation settings — which stay local and never leave your device — and a cookie with your chosen language so the site loads correctly on your next visit. Both are required for the use you asked for and need no consent (§ 25(2) no. 2 German TDDDG). There is no marketing tracking, which is why there is no cookie banner. And it is going to stay that way.
Services in the USA
Vercel, Sentry, Supabase and Anthropic are US companies. Insofar as data reaches the USA, the transfer relies on the adequacy decision for the EU-U.S. Data Privacy Framework or on the EU standard contractual clauses (Art. 44 et seq. GDPR).
Storage duration
The respective services delete server logs and error reports automatically after a short time. Game data remains stored as long as your anonymous session exists; anonymized game content may remain in the question pool permanently.
Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR), and the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). Because play sessions are anonymous, we can only attribute stored data to a person if you tell us your anonymous user ID or write to us from the still-active browser session (Art. 11 GDPR). An e-mail to david.gonzalezcasin@gmail.com is all it takes.
Changes
When the game or the services it uses change, we update this policy. Last updated: July 2026.