Soundcheck asks for one thing, and only if you want the word in the morning: an email address. Here is exactly what happens to it.
If you subscribe: your email address, whether you confirmed it, a random token used for the confirmation and unsubscribe links, where you signed up from, and the dates.
When anyone plays: the date, the puzzle number, whether it was solved, how
many tries it took, and a pseudonymous identifier. That identifier is
sha256(salt + date + IP), truncated to 16 characters, and the salt
rotates every day. Your IP address is never stored.
We call that identifier pseudonymous rather than anonymous on purpose. Under the GDPR, anything recomputable by whoever holds the salt is still personal data. We would rather be accurate than flattering.
Your email is used to send you the morning word. Once in a while — rarely, and never on a schedule you need to brace for — we also write about the rest of Mitxoda: the radio show, the Top 100, how the thing stays funded. That is the whole of it. No other use, ever, and your address goes to no one.
The basis is your consent — GDPR Article 6.1.a — which you can withdraw at any time. The same one-click unsubscribe link ends both: there is no way to leave one and keep the other, because we are not going to make you hunt through preference checkboxes.
Play records and audience measurement are used to count how many distinct people came on a given day. The basis is legitimate interest — Article 6.1.f — in knowing whether the thing is worth making. No email address is ever linked to a game.
We use Umami, an analytics tool that runs on our own server. Two things make it unusual, and both matter here.
First, it is served same origin. The script comes from this domain, not from an analytics company's domain, so your IP address never travels to anyone else. There is no third party in this picture at any point.
Second, no cookie is set and no IP address is stored. What is kept is coarse and non-identifying: browser, operating system, device type, screen size, language, and an approximate location derived from your IP at the moment of the visit — country, region, city — after which the IP itself is discarded. Visits are grouped by a hash that rotates daily, exactly like the play records above.
That is enough to know that four hundred people opened the word on a Tuesday. It is not enough to know that you did.
Nothing is sent until you click the link in the confirmation email. If you never click it, your address is deleted after seven days. Every email carries a one-click unsubscribe link.
Email delivery runs through Brevo, in France. The service is hosted on Hetzner, in Germany. Both sit inside the European Union, so no data leaves the EU and no transfer safeguards are needed.
Subscribers: until you unsubscribe. Unconfirmed signups: seven days. Play records: twenty-four months, then deleted.
No third-party trackers. No advertising. No profiling. Nothing sold, rented, or shared. Even the fonts are served from this server rather than from Google, so loading the page tells no one but us that you were here.
The privacy page you are reading is itself not measured — it seemed the least we could do.
Your streak and stats live in your browser's localStorage and never
reach us. That storage exists only to run the thing you asked for, so it is exempt from
consent under the ePrivacy rules.
The audience measurement described above is exempt on separate grounds: it sets no cookie and reads nothing from your device, it serves only this site, it never follows you anywhere else, and its results are shared with no one. Those are the conditions European data protection authorities set for audience measurement to be exempt from consent. Between the two, there is nothing here to ask you to accept — which is why you are not being shown a cookie banner.
Access, correction, erasure, restriction, portability, and withdrawal of consent. Email info@advicethat.be and it gets done.
If you are not satisfied, you can lodge a complaint with the Belgian Data Protection Authority, Rue de la Presse 35, 1000 Brussels — dataprotectionauthority.be.