Privacy notice
Effective 14 October 2026.
Who is responsible
Peter Höftberger, Allmendstrasse 120, 8041 Zürich, Switzerland. Privacy questions and requests: [email protected].
In short
We keep as little as the game needs. Your email address is never shown. Your name in the game is random. Your presses are public, because a game nobody can check is a game nobody can trust. No advertising, no tracking cookies, no selling of data.
What we collect, and why
| Data | Where it comes from | Why | Legal basis (GDPR) |
|---|---|---|---|
| Email address | Your sign-in (Google, Facebook or email link) | To sign you in, to keep one account per person (the same address through Google and by email link is one account) | Contract (Art. 6(1)(b)) |
| Sign-in identifier | Google or Facebook, if you use them | To recognise you at your next sign-in | Contract |
| Display name | Assigned at random; you can change it | Shown with your presses | Contract |
| Country | Estimated from your connection when you sign up; you can change it once | Country statistics and hours held. Shown with your presses only if you turn that on | Contract; showing it: your consent (Art. 6(1)(a)) |
| Pioneer number | Given when your account is created before the first press | Shown on your profile as "Pioneer #N" | Contract |
| Your hour | Chosen for you at sign-up from your device's time zone (its offset from UTC and its name, such as "Europe/Zurich"; never your location), or from the link you came through; you can change it | Who keeps watch at what time: the public board shows only how many players keep each hour and their leading countries, never who. The hour's name (Alpha for 00:00 UTC to Omega for 23:00) is shown next to your display name, unless you turn off "Show my hour next to my name" on your profile; because the hour was chosen from your time zone, it hints at roughly where you are. The zone's name lets our emails say the time on your clock; it is never shown | Contract; showing the hour's name: legitimate interest (Art. 6(1)(f)), players seeing who keeps which hour; you can object by turning it off |
| Where you came from | The link you used, if it said so (e.g. ?via=hn) | Stored once with your account, counted in our sign-up statistics, never public | Legitimate interest (Art. 6(1)(f)): knowing which posts bring players |
| Pioneer confirmation email | Your email address, once, when your hour is first set before the opening | Your Pioneer number and your hour, with a calendar file; sent once. It says that one more email follows the day before the opening, and how to stop it | Contract |
| Welcome email | Your email address, once, when you sign up after the opening and your hour is set | Your hour, with a calendar link, and where to set up alerts; sent once | Contract |
| Reminder before the opening | Every account created before the opening, unless you turn it off (with the time you did) | One email the day before the opening, about the game you signed up for. Turn it off on your profile, in the welcome screen, or with the unsubscribe link in either launch email | Legitimate interest (Art. 6(1)(f)): a one-time notice that the service you joined starts; you can object at any time |
| Game mails after the opening | Your email address, your hour, your time zone, your presses and streak, unless you turn them off | At most one a week, never at night on your clock, never on a day you've pressed: how your hour did the day after your first press, your first week, a new start after a broken streak ("game mails"); the milestones on day 66, 100 and 365 ("milestones"); and, when your hour runs thin, "Your hour needs people". Three switches on your profile, all on until you turn them off, and a one-click unsubscribe in every such email. Which of them go out is decided by our moderator (an AI) from fixed texts; it never sees your email address | Legitimate interest (Art. 6(1)(f)): notices about the game you play; you can object at any time, per kind |
| Moderation | Reported lines, display names, flagged accounts' press times, appeals and their texts | Moderation is done by an AI (Claude, by Anthropic) under the published rules: it decides on reported lines, names, bot flags and appeals, each with its reason in the audit log, and never sees email addresses. You can ask for a human to review any decision about your account (Art. 22 GDPR) | Legitimate interest (Art. 6(1)(f)): a fair game with moderated content |
| Presses | Your presses: time of arrival, time left, sequence number, your line, the country you pressed for, and facts fixed with each press for its marks in the feed (your streak that day, whether it was your first press or your first after a broken streak, whether it was in your hour, whether it was the first from your country, a yearly anniversary of your first press) | The game itself, the marks on your presses, and the public log | Contract; the public log: legitimate interest (Art. 6(1)(f)), see below |
| Reactions | The emoji you give on presses | Shown only as counts on the press, never who reacted | Contract |
| Session data | Your browser: IP address and browser type, for each signed-in session | Security of your account | Legitimate interest |
| Human check on each press | Your browser, through Cloudflare Turnstile, with each press | Whether the press passed the check (passed, failed, or no check), kept 28 days, never public; an account whose presses repeatedly come without a passed check is marked as possibly automated | Legitimate interest (the game's integrity) |
| Sign-up count per address | Your IP address when your account is created, kept only as a salted hash (it can't be turned back into the address) with the number of accounts created from it that day | Detecting mass sign-ups (abuse) | Legitimate interest |
| Alert subscription | Your browser, if you turn alerts on | To send the alerts you asked for, in the hours and at the threshold (15, 30 or 60 seconds) you chose | Consent |
| Reports and moderation | When you report a line, or a line of yours is reviewed | Moderation, appeals | Legitimate interest |
| Purchases (once purchases are enabled) | Stripe | Billing, the USD 50 monthly cap, refunds, accounting | Contract; legal obligation (Art. 6(1)(c)) |
| Age and consent at checkout (once purchases are enabled) | You, before checkout | Your confirmation that you are 18 or older (with its time, asked once), and with each purchase the box you ticked before paying (which text and when): to show that a sale was allowed and how the right of withdrawal applies. Confirmed to you by email after each purchase | Contract; legal obligation (consumer law) |
| Withdrawals (once purchases are enabled) | You, when you withdraw from the Guardian subscription | When you withdrew, the days you had, the refund: to carry it out, confirm it to you by email and keep it for accounting. Visible to the operator, not to moderators | Contract; legal obligation |
| Guardian subscription (once purchases are enabled) | Your purchase | The Guardian mark with the months you've paid for, your hour's name in gold, your name on the Wall (unless you turn "Show my name on the Wall" off), your free gift each month | Contract; the Wall: legitimate interest (Art. 6(1)(f)), thanking those who pay for the game; you can object by turning it off |
| Gifts you give or receive (once purchases are enabled) | Your purchase, your free gift or a gift you bought ahead | Shown on the press it was given on, with your display name unless you chose anonymous; the press gifted last also in "Just gifted" above the feed; the receiver's profile shows how often they were gifted. Gifts bought ahead: how many, given and refunded | Contract |
| Day stamps (once purchases are enabled) | Your purchase | Shown on your profile | Contract |
| The winner's last word (only if you win and write one) | You | Shown publicly on the memorial, for good | Contract |
| The winner's postal address (only if you win) | You, by email when we ask | Only to post the printed certificate. Never entered into our database | Contract |
We don't store your real name or photo from Google or Facebook, and we don't keep their access tokens: we have no access to your Google or Facebook account.
What is public
Everyone can see, on the site and through the public API:
- your display name, your presses (time, time left, sequence number) and your lines;
- the marks on your presses in the feed: your streak with the press, your first press, "Back" after a broken streak, the first press from your country (only while you show your flag), "✓ in their hour" (only while you show your hour), a round press number, a year since your first press, your Pioneer number. None of them is about the time left;
- your streak, total presses and the day you joined;
- your country, only if you turned on showing it;
- the name of your hour (such as "Omega" for 23:00 UTC) next to your display name, in the feed, on the lists and on your profile, unless you turned "Show my hour next to my name" off. It is your hour as it is now, so it changes on your earlier presses too when you change your hour;
- if your account is marked as possibly automated: an asterisk next to your name;
- reactions: how many of each emoji a press has, never who gave them;
- if you are a Guardian: the Guardian mark with the number of months you've paid for, next to your name (in the feed, on the lists and on your profile), and your name on the Wall unless you turned it off. Never what you paid;
- gifts: on the press they were given on, and the giver's display name unless the giver chose anonymous; on the receiver's profile, how often they were gifted. Never what anyone paid;
- your day stamps, on your profile.
The downloadable log holds, for every press: its sequence number, time of arrival, time left and round length, the account's pseudonym, the display name, the line (blank if removed), the country only if the player shows it, how many were pressing in that hour compared with usual (coverage), and whether the account is marked as possibly automated. It holds no hour names, marks, reactions, Guardian marks, gifts or day stamps.
The public log identifies each account by a pseudonym, not by your email address.
Why the log is public and stays. That every press can be checked by anyone is what makes the game fair: The Countdown and who wins can be verified without trusting us. That is our legitimate interest, and the players'. For this reason presses are never deleted from the log (see "Deleting your account").
Cookies and storage
Only what signing in needs: a session cookie, set when you sign in, removed when you sign out or the session expires. No analytics, advertising or tracking cookies, so there is no cookie banner. We count visits with Cloudflare Web Analytics, which sets no cookies and keeps no profile of you: it records page views, the referring site, the country and the browser type, in aggregate. We also count the steps of signing in (the options shown, a link asked for and sent, a sign-in by each method, a new account, an error) as numbers per hour in our own database, with nothing about who: so we notice quickly when signing in breaks. If you turn alerts on, your browser stores the alert subscription. If you came through a link that names an hour, or where it was shared (such as ?via=hn), your browser keeps it for the open tab until you sign up. Cloudflare's human check (Turnstile) runs in the form when you ask for a sign-in link by email, and invisibly on the button page with each press; it sets no tracking cookies.
Who processes data for us
These companies process data on our behalf, under data processing agreements. Where we can choose, data is stored in the EU.
| Processor | What for | Where |
|---|---|---|
| Cloudflare, Inc. | Network, protection against attacks; every request passes through it; and a human check (Turnstile) before a sign-in link is sent by email and with each press; visit counts without cookies (Web Analytics); forwarding mail sent to [email protected] (Email Routing) | Worldwide network; USA company |
| Vercel Inc. | Website and sign-in | Frankfurt (Germany); USA company |
| Fly.io, Inc. | Game server | Frankfurt (Germany); USA company |
| Neon, Inc. | Database | Frankfurt (Germany); USA company |
| Resend, Inc. | Sending emails: sign-in links, the Pioneer confirmation, the reminder before the opening, the welcome email, the game mails, the confirmations of purchases and withdrawals, and our replies to mail sent to [email protected] (no open or click tracking) | Ireland; USA company |
| Google LLC, Meta Platforms Ireland Ltd. | Sign-in, only if you choose them | Their own privacy notices apply |
| Your browser's push service (Apple, Google, Mozilla) | Delivering alerts you turned on | Their own terms apply |
| Stripe (once purchases are enabled) | Sells and charges purchases as merchant of record (Stripe Managed Payments) | Stripe is responsible for the payment data it collects, under its own privacy notice; we receive what was bought and by which account, never your payment details |
| Google LLC (Gmail) | The mailbox where mail to [email protected] arrives (a Gmail account used only for Unpressed): questions, privacy requests, the winner's postal address | USA company |
| Anthropic PBC | The moderator (Claude, an AI): reads the moderation queues and the game's numbers through our game server, never email addresses | USA company |
Transfers outside Switzerland and the EU. The processors above are US companies. Transfers rely on the EU-US and Swiss-US Data Privacy Framework where the processor is certified under it, and otherwise on the European Commission's standard contractual clauses in the processor's data processing agreement.
How long we keep data
| Data | Kept |
|---|---|
| Account (email, name, country, Pioneer number, your hour and time zone, whether your flag, your hour and your name on the Wall are shown, whether you turned the reminder off and when) | Until you delete your account; the Pioneer number stays with the pseudonymous account so it is never given twice. Turning the reminder off is kept with its time until the opening's reminder is sent or your account is deleted |
| Which game mails went to you, and when; your three mail switches (with the time you turned one off) | Until you delete your account: needed for the weekly limit, and so that a mail meant to go once never goes twice |
| Where you came from (the link's ?via=) | Until you delete your account |
| Presses in the public log | For as long as the game and its archive exist; after deletion of the account, without name, country or line |
| Sessions (IP address, browser type) | Until you sign out or the session expires (7 days without use) |
| Sign-in links | 10 minutes, or until used |
| Sign-up counts per address (hashed) | 30 days |
| Human check results | 28 days |
| Reactions | Until you take one back or change it, or delete your account |
| Alert subscription | Until you turn alerts off or your browser revokes it |
| Purchase records, with the consent given at checkout, your age confirmation and any withdrawal | 10 years (Swiss accounting law); also after you delete your account |
| The winner's last word | For as long as the game and its archive exist; removed if it breaks the rules for lines |
| The winner's postal address | Only in our mailbox until the certificate is posted, then deleted |
| Network logs at Cloudflare | As set by Cloudflare's own retention policy |
Deleting your account
You can delete your account from your profile ("Your data"), confirming with your name. We then delete your email address, sign-in identifiers, sessions, alert subscriptions and settings, appeals, human check results and the reactions you gave, and your name, country, hour and lines no longer appear anywhere: your presses show under a placeholder name, and your lines are deleted. Your presses stay in the public log under their pseudonym, without name, country or line, so that the game remains verifiable; in the feed they keep only the round press number among their marks, and show no reactions or gifts. A deleted account can't press again and can't win. Purchase records are kept as accounting law requires. Your day stamps and your place on the Wall go; gifts you gave stay on their presses, shown as anonymous; gifts bought ahead and not yet given are refunded. While your Guardian subscription still renews, cancel it first: until then the account can't be deleted.
Your rights
You can ask us for access to your data, for a copy in a common format ("Download my data" in your profile), for correction, for deletion, and to restrict or object to processing. Where processing relies on your consent, you can withdraw it at any time; this doesn't affect processing before. Write to [email protected]. We answer within 30 days.
Moderation decisions are made by an AI under the published rules. You can ask for a human to review any decision about your account, such as a removed line, a reset name, a flag or an appeal: write to [email protected].
You can complain to a supervisory authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), in the EU the authority of your country.
Age
Unpressed is for people aged 16 and over. We don't knowingly collect data of younger children. To buy anything you must be 18 or older: before your first purchase you confirm it, and we keep that confirmation with its date as long as the purchase records (above). We don't ask for proof of age.
Changes
We announce changes to this notice on the site before they take effect.