Draft, not yet reviewed.
Privacy
Last updated: 7 November 2026
Who is responsible
Math Waiter is run by Salvador Correia, in Portugal, who is the data controller. Contact: privacy@mathwaiter.tech.
What we collect and why
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Email address, only if you create an account. Stored encrypted. | Sign you in and keep your scores across devices. | Contract, Art. 6(1)(b) |
| Password, if you choose one. Only a salted, one-way hash is stored. | Sign you in. | Contract |
| If you use Google to sign in: your Google account ID and verified email. We do not ask for your name, photo or contacts. | Sign you in. | Contract |
| Profile: display name, avatar, colour, time zone, sound and difficulty settings, leaderboard choice. | Run the game as you set it up. | Contract |
| Game results: score, correct answers, level, answer times, pauses, and when you played. | Personal bests, leaderboards and ghost races. | Contract |
| Rooms you create: name and time zone. | Run the room. | Contract |
| IP address and browser signals, used briefly to limit requests and, when you create an account or reset a password, by Cloudflare Turnstile to check you are not a bot. | Protect the service from abuse. | Legitimate interest, Art. 6(1)(f) |
We do not use advertising, tracking or analytics, and we do not sell data.
Cookies
Two cookies, both needed for the game to work, so there is no consent banner: __Host-mw_device remembers your game (up to 400 days) and __Host-mw_session keeps you signed in (30 days).
Who else sees it
- People in a room you play in see your display name, avatar, colour and results, unless you turn off "Show me on leaderboards". Anyone with a room's link can open it.
- Cloudflare hosts the service. Stored data is kept in the EU. Your requests may pass through the Cloudflare data centre nearest to you, which can be outside the EU if you are, under Cloudflare's data processing terms.
- Scaleway (France) delivers account emails (confirmation and password reset), processing your address and the email within the EU.
- Google handles the sign-in if you choose "Continue with Google", under Google's own privacy policy. Google can be outside the EU.
How long we keep it
- Confirmation and password reset links: 15 minutes, or until used.
- Sessions: 30 days.
- Rooms and their results: 30 days after the last play.
- Accounts, with their profile and results: until you delete the account.
- Without an account: your profile, results and game are deleted 12 months after you last played.
Your rights
You can ask to access, correct, delete or receive a copy of your data, or object to its processing, by writing to the address above. You can delete your account yourself from the Account dialog on the home page. You may also complain to the Portuguese data protection authority, the CNPD.
Age
You need to be at least 13 to create an account.