Skip to content
AtlasRivals

Privacy Policy

Version 2026-11-07

This explains what AtlasRivals does with your personal data, in plain language. If anything here is unclear, email us and we will explain it.

Who is responsible

The controller of your data is Code7 d.o.o., Zagorska ulica 105, 42220 Novi Marof, Croatia, reachable at [email protected]. We have not appointed a Data Protection Officer, and we are not required to under Article 37 GDPR.

What we collect, and why

  • A guest account, if you play without signing in: a made-up name, which you can change and which other players see like any name, and no email address of yours. It holds the same game data as an account (below) and lives in this browser only: we cannot tell who you are without it, so a guest whose browser loses it cannot be found again. If you later sign in with Google, its rounds move into your Google account (except any that clash with a round already there, such as the same day’s quiz played on both) and the guest account is deleted. Legal basis: performing our contract with you (Art. 6(1)(b)).
  • From Google, when you sign in with it: your name, email address, Google account ID and a link to your Google profile picture, plus the sign-in tokens Google issues us. We use them to create and run your account, and your name to show you to other players. The picture link is stored with your account, but nobody is shown the picture. Legal basis: performing our contract with you (Art. 6(1)(b)).
  • A record that you confirmed you are 16 or over, and which version of the Terms you accepted, with the date. We do not collect your date of birth. We keep this so we can show, if it is ever questioned, what you agreed to and that you told us you were old enough. Legal basis: our legitimate interest in being able to prove that (Art. 6(1)(f)).
  • The rounds you play: which mode, when you started and finished, the answer you picked for each question and when, how many you got right and the score. This is the game: without it there is no streak, no personal best and no quiz of the day. From the same rounds we work out which countries you know, which only you see. Legal basis: performing our contract with you (Art. 6(1)(b)).
  • Who your rivals are. When you open another player’s rival link, we store the two of you as a pair: your two account ids and nothing else, with no date and no message. Everyone else on your Rivals page comes from the challenges you have played, worked out from the rounds themselves. Legal basis: performing our contract with you (Art. 6(1)(b)).
  • A push subscription, only if you switch on streak reminders: the address your browser gives us to deliver one notification a day on the days you have a streak and have not played yet, the date you switched it on and the last day we reminded you. Switching it on also installs a small script in your browser (a service worker) that shows the reminder. Nothing is sent otherwise. Legal basis: your consent (Art. 6(1)(a)), which you must be 16 or over to give (Art. 8 GDPR and Art. 19 of the Croatian GDPR Implementation Act). You withdraw it by switching reminders off in your profile or in your browser. Signing out does not switch them off on that browser, so switch them off first.
  • Your sign-in session, which records the browser it was created from, when it was created and when it expires, and keeps you signed in for 60 days. Legal basis: performing our contract with you (Art. 6(1)(b)), since without it you would have to sign in again on every page; we keep the browser so you can tell your sessions apart if you ask us about one. We do not record the IP address you signed in from.
  • Your IP address, briefly, to stop anyone creating guest accounts in bulk. It is counted in the server’s memory only, never written to the database or to any log we control, and gone when the server restarts. Legal basis: our legitimate interest in keeping the service standing up (Art. 6(1)(f)).
  • Emails you send us: your address and what you write, to answer you. Legal basis: our legitimate interest in replying (Art. 6(1)(f)), or our legal duty when you use one of your rights below (Art. 6(1)(c)). We delete them 12 months after the conversation ends.
  • Reports. If you report a player’s name, we keep your email, what you reported and what we decided, for 12 months, to deal with it and to show that we did. The player you reported learns who you are only if that is strictly necessary. Legal basis: our duty under the EU Digital Services Act (Art. 6(1)(c)).

We do not run advertising, we do not build a profile of you for advertising or anything outside the game, and we make no automated decisions that have legal or similarly significant effects on you.

Cookies and what we store in your browser

Everything in this list is stored only because a feature you asked for needs it, so the law does not require us to ask first. None of it is used for advertising, analytics or tracking.

  • __Secure-better-auth.session_token (ours): keeps you signed in. For a guest it is the account itself. Lasts 60 days from the last time you played. HttpOnly, SameSite=Lax, Secure.
  • __Secure-better-auth.state (ours): protects the trip to Google and back when you sign in with it. Lasts a few minutes.
  • atlas_rival (ours): only if you open someone’s rival link and play as a guest. It holds that player’s account id so that signing in with Google makes the two of you rivals, and is deleted when you start that sign-in, or after 24 hours. HttpOnly.
  • cf_clearance (set by Cloudflare, which protects the site): Cloudflare may set it to tell people from bots. It can last up to a year and is not used to track you.
  • Local storage (ours, never sent to us): atlas_globe_hidden when you hide the minimap, atlasrivals.install.dismissed and atlasrivals.push.dismissed when you dismiss a hint, and atlas_marathon_best_… with your best Every Country run. They stay on your device until you clear this site’s data.

Cloudflare Web Analytics is the one thing that runs in your browser to measure the site. A small script from Cloudflare reads the address of the page, the page you came from, your browser type and how long the page took to load, and sends them to Cloudflare, which shows us totals. It sets no cookie, stores nothing on your device and does not follow you to other sites. Legal basis: our legitimate interest in knowing which pages are used and whether they load quickly (Art. 6(1)(f)). You can object, and any content blocker that blocks Cloudflare Insights stops it.

Who else sees your data

Other players, when you challenge them. Sending someone a challenge link shows them your name, your score and which of the ten questions you got right (not which answers you picked), and anyone who answers it appears beside you with theirs. A chat app that shows a preview of the link shows the same. That is the point of a challenge, but it is worth being plain about: a challenge link works for whoever holds it, so send it to people you meant to send it to.

Other players, in a live match. The other players, and anyone who opens the match link, see your name, how far through the round you are, and your score once it ends.

Your rivals. A rival is anyone whose challenge you answered or who answered yours, anyone who finished a live match you hosted or the host of one you finished, or anyone on either end of a rival link you opened or that was opened from you. Your rivals see your name on their Rivals page, with your points, how many rounds you have played and how recently you last played (by the day within the past week, then just “last week” or “a while ago”). They also see your score on today’s quiz. If you are linked by a rival link, they also see a live match you open while it is waiting for players. A rival link works for whoever holds it, just like a challenge link, and shows your name in its preview.

Deleting your account removes you, your scores and your rival links. Rounds other people played against you stay theirs — we do not delete another person’s history to complete yours.

These companies process data on our behalf:

  • Hetzner Online GmbH (Germany) hosts our server and database, in its data centre in Finland, and keeps our backups.
  • Cloudflare sits in front of the site. Every request passes through it, with your IP address and browser details, so it can deliver pages and block attacks, and it runs our Web Analytics (above). Emails to [email protected] pass through it too. Legal basis: our legitimate interest in a site that loads and stays up (Art. 6(1)(f)). This can involve transfers to the United States, covered by the EU–US Data Privacy Framework and standard contractual clauses; email us for a copy.
  • Google keeps the mailbox our support emails arrive in. It also handles the sign-in step, for which it is a separate controller of what happens inside your Google account.
  • Your browser’s push service, only if you switch on reminders: Google for Chrome, Mozilla for Firefox, Apple for Safari, Microsoft for Edge. It receives your subscription address and an empty signal when a reminder is due; the reminder text is already on your device.

We do not sell your data, and we do not share it for advertising.

How long we keep it

Your account data and your play history are kept until you delete your account. Deleting erases it from the live service at once; copies stay in our backups for up to 14 days, until they are overwritten, and are kept only to recover from an accident. A rival link is kept until either of you deletes their account.

Sessions expire 60 days after they were last used; expired ones are deleted by a nightly cleanup, which takes the browser information with them. Signing out deletes the session immediately. A guest account goes once nothing keeps it signed in: 60 days after it was last used, or, if you sign out of it, as soon as it is 30 days old. The same cleanup deletes it with its rounds.

A push subscription is kept until you switch reminders off, your browser withdraws it (we delete it the next time a reminder fails to arrive), or you delete your account. Emails and reports are kept for 12 months, as above.

Your rights

You can access, correct, delete or restrict our use of your data, and take your data elsewhere. Where we rely on your consent (streak reminders), you can withdraw it at any time; that does not affect what we did before. Two of these are buttons on your account page:

  • Download my data gives you a copy of your data as a JSON file. It leaves out the sign-in tokens Google issued us and the answer you picked for each question; email us if you want those too.
  • Delete my account erases your account immediately.

Your right to object. Where we rely on our legitimate interest (blocking bulk sign-ups, Cloudflare’s protection and analytics, keeping proof of what you accepted, answering your emails), you can object at any time for reasons to do with your situation. We then stop, unless our grounds override yours or we need the data for a legal claim.

For anything else, email us; we answer within one month. Signing out ends your session and deletes its record straight away.

You can also complain to a data protection authority: in Croatia that is AZOP, Ulica Metela Ožegovića 16, 10000 Zagreb (azop.hr), or the authority in the EU country where you live or work.

Is any of this required?

To play, you must confirm you are 16 or over and accept the Terms, and we have to record your rounds, because that is the game. Signing in with Google is optional: without it your progress stays in this one browser. Streak reminders are entirely optional. You do not need to do any of this to read this site.

Changes

If we change this policy in a way that matters, we will show you what changed on the site before it takes effect. We never start using your data for something new without telling you first.