Website Privacy Policy
This policy covers the website at https://guessthesong.pro and the quizzes you can play on it. The iOS app has its own policy, because it collects different things for different reasons: see the app Privacy Policy.
1. Who we are
“Guess The Song” is developed by Maksym Myronenko, an individual sole developer based in Ukraine. For the purposes of the EU/UK GDPR, Maksym Myronenko is the data controller for the data described here. Contact: maximusik2@gmail.com. Email is the only contact channel.
2. The short version
- There is no sign-up, no account and no form on the website. You never give us your name or email to play.
- The website shows no advertising and uses first-party cookies for analytics and nothing else (section 3.3).
- It counts visits and gameplay by default, to see whether the site works and whether anyone plays. If you are in the European Economic Area, the United Kingdom or Switzerland, a banner asks first and nothing is set or sent until you press Accept all (section 4). Each event is tied to a random identifier stored in your browser, plus your approximate location (country, region and city, derived from your IP address), your browser, operating system, language, and the page that sent you.
- Nothing you type is ever collected. A guess is never sent, only whether it was right.
- You can switch it off in one click, on every page, with the “Analytics” button in the bottom-left corner, and Decline all on the banner is the same size as Accept all (section 6).
- The quiz plays music through Apple’s own player, which Apple loads and runs (section 5).
3. What the website collects
3.1 Hosting logs
The server that delivers the website is run by our hosting provider, Railway. Like any web server it handles your IP address and the pages you request, for delivery and security. We do not use those logs for analytics.
3.2 Analytics events
Every page loads our analytics, which sends the events below and no others. Events are sent to our own server, which relays them to Amplitude, our analytics processor; this is so a blocked third-party address cannot silently remove visitors from the counts, and it is also how Amplitude receives your IP address to work out where you are.
| Event | When | What it carries |
|---|---|---|
web_page_viewed | you open a page | the path on this site, e.g. /support/ — never the query string |
web_app_store_clicked | you tap the App Store link | the path you were on |
web_support_email_clicked | you tap the support email address | the path you were on |
web_play_pressed | you press play on a quiz | the path, which quiz, which ruleset, which song number of your run, and whether it was a replay |
web_guess_submitted | you submit a guess | the path, which quiz, which ruleset, whether the guess was right, and how many seconds of the record you had heard |
web_round_ended | a round finishes | the path, which quiz, which ruleset, how it ended (named, gave up, skipped), the points, the seconds heard, and the song number |
web_run_ended | a run finishes | the path, which quiz, which ruleset, why it ended, the score, how many songs you completed, and your best streak |
web_mode_switched | you switch between Classic and Arcade | the path, which quiz, the ruleset you left and the one you chose |
web_audio_failed | a record fails to play | the path, which quiz, which ruleset, and our own description of the failure (a fixed sentence and a code, never a browser message) |
web_apple_signed_in | you use “Sign in with Apple Music” | the path, which quiz, and whether the sign-in resulted in full-length playback |
3.3 What comes with every event
- A random visitor identifier, generated in your browser and kept in a first-party cookie (named
AMP_followed by part of our project key, valid for up to a year). A second cookie,AMP_MKTG_…, remembers the page that sent you and any campaign tags so the first visit can be credited to its source. It contains nothing about you, and it is how we tell one visitor’s events from another’s. It is not linked to the app or to any account, and the website’s Amplitude project is separate from the app’s. - Approximate location: country, region and city. Your IP address is sent with the event so Amplitude can derive these. Amplitude may keep the IP address with the event according to its own settings and terms.
- Browser and operating system, device type, and language.
- Where you came from: the referring page and any campaign tags (
utm_*) on the link that brought you. - A session, which is a run of activity with gaps of under half an hour.
3.4 What we switch off
We switch off Amplitude’s capture of form interactions and element clicks, so nothing you type or tap on this site is collected beyond the events above. The quiz has one box you type your guess into: the guess itself is never sent anywhere. We do not use session replay. We do not use advertising identifiers, and there are none.
4. Why, and on what basis
We collect this to find out whether the site and its quizzes work and whether people use them: does a visit turn into a game, where do rounds end, and is playback broken in some country or browser (it has been; this is how we found it).
The lawful basis is our legitimate interest in measuring and improving a free service, Art. 6(1)(f) GDPR. We have weighed it against yours by keeping the data pseudonymous, limiting it to the events above, never selling or sharing it for advertising, never joining it to the app, and giving you a one-click way out.
Where the law requires asking first, we ask. If your browser’s time zone puts you in the European Economic Area, the United Kingdom or Switzerland, or we cannot tell, a banner appears and nothing is stored or sent until you press Accept all; the lawful basis there is your consent, Art. 6(1)(a) GDPR and Art. 5(3) ePrivacy. Everywhere else we do not ask: analytics and its cookie start with your first page view and you can turn them off at any time. Working out where you are from your time zone is a guess, not a lookup, and it can be wrong; if you are somewhere that requires consent and were not asked, use the button (section 6) or tell us.
5. Music: Apple’s player
Quiz pages contain a playable quiz. The moment you first touch or focus the player, and never on a page you only read, the page loads Apple’s MusicKit JS from Apple’s servers (js-cdn.music.apple.com) and asks it to play 30-second previews from Apple Music. From then on Apple’s servers receive the requests any music player makes: your IP address, the songs requested, and standard browser headers. Apple is an independent controller for that; see https://www.apple.com/legal/privacy/. We receive nothing from it. To let Apple’s player start, the page fetches a short-lived access token from our own API (api-production-faad.up.railway.app); that request carries no identifier of yours and we store nothing from it.
Signing in with Apple Music is optional and handled by Apple. If you choose it, Apple’s own sign-in window opens and Apple’s player streams full songs under your subscription. Your Apple Account, subscription and library are handled entirely by Apple; the sign-in token is kept by Apple’s script in your browser, never sent to us, and we cannot see who signed in.
6. Switching it off
The “Analytics: on · turn off” button in the bottom-left corner of every page turns analytics off, and Decline all on the banner does the same. Either one stops events being sent and stops the analytics code being downloaded on later visits. Your choice is remembered in your browser’s local storage as the word on or off, nothing else; that is the one thing stored before you decide, and it is needed to honour your decision. Press the button again to turn analytics back on. Clearing your browser’s site data resets the choice (and, where we ask, you will be asked again).
If you opt out after playing, events already sent stay until deleted (section 8).
7. Who else processes it
| Who | Role | What they receive |
|---|---|---|
| Amplitude | Product analytics, processor under GDPR Art. 28 terms, US region | the events in section 3.2 and the data in section 3.3 |
| Railway | Hosting, processor, region EU West (Amsterdam) | page requests and server logs |
| Apple | Music playback, independent controller | what a music player sends (section 5) |
Amplitude is in the United States, so analytics data is transferred there. The transfer relies on Amplitude’s data processing terms and standard contractual clauses. We do not sell data and we do not share it for advertising.
8. How long we keep it, and your rights
We keep website analytics events for up to 24 months, then delete them.
You can ask us for access to, correction of, restriction of, or erasure of the data about you, and you can object to the processing at any time (Art. 15–21 GDPR). The easiest objection is the button in section 6. To have events deleted we need to find them, and because they are tied to a random identifier rather than to you, we cannot identify you from your name: email us and we will tell you how to read your visitor identifier from your browser, then we delete the events under it.
You can complain to your national data protection authority. In Ukraine that is the Ukrainian Parliament Commissioner for Human Rights; in the EU/EEA and UK, your local supervisory authority.
9. Children
The website is a general-audience music quiz and is not directed at children under 13. We do not knowingly collect data about them and the website asks for no personal details from anyone.
10. Changes
When this policy changes we change the effective date above. A new kind of data or a new processor is a material change, and we will say so here before it starts.
11. Contact
maximusik2@gmail.com — put “Privacy” in the subject line.