Privacy policy.

GUESS · THE · THING (hereinafter, "the Platform", "guess.com" or "the Service") is an independent editorial project of daily identification games, published under the GUESS · THE · THING brand.

For any matter related to this privacy policy, the processing of personal data or the exercise of your rights, you can write to [email protected]. Correspondence is handled in English and Spanish.

The Platform is built as a static archive served from a CDN. By default, no active collection of personal data takes place when you browse guess.com or its subdomains. Specifically:

• No registration, account creation, email address or password is requested.

• No device-identifying data (full IP address, User-Agent, browser fingerprint, etc.) is stored on our servers.

• No first-party tracking cookies are installed.

• Game progress (attempts, score, streak) is stored only in your browser local storage (localStorage / IndexedDB) and never leaves your device.

The only data processing that may occur is what is strictly necessary to deliver the Service and meet legal obligations:

• Serving the pages, stylesheets, scripts and graphic assets of the game: the legal basis is the performance of the Service usage relationship.

• Preventing automated abuse and ensuring stability (for example, CDN-level rate limiting): the legal basis is the legitimate interest in protecting the integrity of the Service.

• Handling requests, complaints or the exercise of rights: the legal basis is compliance with an applicable legal obligation.

The Platform does not perform user profiling, behavioural advertising, data sales or automated decision-making with legal effect.

To function, the Platform relies on a very small set of external services. When you use them, those providers may process minimal technical data (IP address, user agent, request metadata) under their own policies:

• TMDB (The Movie Database): the Platform obtains from TMDB movie metadata (title, year, poster, identifiers) and YouTube storyboards. TMDB information is consumed at build time of the static site, not in the user's browser. Policy: https://www.themoviedb.org/privacy-policy.

• YouTube / Google: storyboards and frame thumbnails come from YouTube servers. When a frame loads, a request is made to googlevideo.com / ytimg.com, which implies a technical communication with Google Ireland Limited. Policy: https://policies.google.com/privacy.

• CDN and static hosting provider (Cloudflare, Netlify, Vercel or another equivalent at the operator's choice): serves the site files and records aggregated, anonymised traffic metrics to prevent abuse.

• DNS provider: any DNS query for the domain is logged by the visitor's resolver and by the authoritative provider under their own terms.

The Platform does not sell, rent or transfer personal data to third parties for commercial purposes.

Some of the providers listed above may process data from outside the European Economic Area. When this occurs, the Platform relies on legally required safeguards:

• Adequacy decisions adopted by the European Commission (for example, for transfers to the U.S. under the EU-U.S. Data Privacy Framework).

• European Commission Standard Contractual Clauses.

• Additional technical and organisational measures when necessary to ensure a level of protection equivalent to the European one.

The Platform does not retain identifiable personal data on its own systems. Aggregated and anonymised statistical information generated by the CDN may be kept for up to twelve (12) months, after which it is deleted or irreversibly anonymised.

If you reside in a jurisdiction that recognises a reinforced right to be forgotten, you may request the deletion of any residual data at any time by writing to [email protected].

As a user you may exercise, under the terms of the applicable regulations (Regulation (EU) 2016/679 — GDPR, Spanish Organic Law 3/2018 — LOPDGDD, CCPA/CPRA, LGPD and equivalents), the rights of:

• Access: to know what data is processed, for what purpose and by whom.

• Rectification: to correct inaccurate or incomplete data.

• Erasure ("right to be forgotten"): to request deletion of your data.

• Objection: to object to processing based on legitimate interest.

• Restriction: to request that processing be temporarily restricted.

• Portability: to receive a machine-readable copy of the data you have provided us.

• Withdrawal of consent: when processing is based on consent, to withdraw it at any time without retroactive effect.

To exercise these rights, write to [email protected] attaching a means that allows us to verify your identity. We will respond within a maximum of one (1) month from receipt, extendable to two (2) months when justified by complexity, with prior notice.

If you consider that your rights have not been addressed, you may file a complaint with the competent supervisory authority (in Spain, the Agencia Española de Protección de Datos — AEPD; in the EU, the authority of your Member State).

The Platform does not use tracking cookies, advertising analytics or digital fingerprints. The only ones that may exist are:

• Cookies strictly necessary for technical operation (for example, in the case a subdomain with an authenticated session is published, which would be indicated in its banner beforehand).

• Browser local storage (localStorage / IndexedDB) that retains your game progress. You may clear it at any time from your browser settings.

Some third-party resources (YouTube, CDN) may involve the installation of cookies by those providers when you interact with their embedded content. We recommend reviewing their policies.

The Platform shows no ads, takes part in no programmatic advertising networks and integrates no ad-tracking pixels on its main website. Any derived product (native mobile applications) is published under the same premises:

• No ads.

• No mandatory in-app purchase (any purchase is optional, cosmetic and disclosed in the corresponding store listing).

• No third-party ad SDKs.

The Service is aimed at the general public. No personal information of minors under fourteen (14) is knowingly requested. If a parent or legal guardian becomes aware that a minor has provided data through any channel (for example, a contact form), they may request its deletion by writing to [email protected].

The Platform applies reasonable technical and organisational measures to protect the integrity, confidentiality and availability of the information processed, including:

• TLS encryption in transit for the whole site (forced HTTPS).

• Security headers (Content-Security-Policy, Referrer-Policy, X-Content-Type-Options, Permissions-Policy).

• Subdomains and routes separated by functional domain (apex, movie, song, game) with their own manifests.

• Periodic review of dependencies and reproducible build via SvelteKit + adapter-static.

Even so, no system is completely infallible. If you detect a vulnerability, we appreciate responsible disclosure at [email protected].

This policy may be updated to reflect legal, technical or operational changes to the Service. When substantial modifications are made, this will be indicated visibly on the main page of guess.com and the "Last revised" date in the header of this document will be updated.

We recommend reviewing this page periodically. Continued use of the Service after changes are published constitutes acceptance of the revised policy.

For queries, rights requests, complaints or any other matter related to privacy and data protection:

• Email: [email protected]

• Security channel: [email protected]

• Postal address available on request through the channels above.