← Back to Game

Privacy Policy

Last Updated: August 21, 2026 | Effective Date: August 21, 2026
Summary for Quick Reading: What The Track ("MusicWho", "we", "our", or "us") is an instant music recognition web arcade. We operate on a zero-registration model — we do not require user accounts, emails, passwords, or personal profiles to play. We respect your fundamental privacy rights under the European Union General Data Protection Regulation (GDPR), UK GDPR, and applicable global privacy regulations.

1. Data Controller Identification

For the purposes of the EU General Data Protection Regulation (Regulation (EU) 2016/679) and UK Data Protection Act 2018, the Data Controller responsible for your personal data is:

2. What Data We Process

We believe in strict data minimization. Depending on your interactions with our site, we process the following categories of data:

A. Technical & Connection Data

When you connect to our website, standard web server access logs are processed via our edge hosting provider (Netlify). This includes your IP address, browser user-agent, operating system, timestamp, and referring URL. This data is processed temporarily to deliver web assets securely and defend against DDoS attacks.

B. Ephemeral Multiplayer Session Data

If you host or join an online multiplayer room, we process temporary session data via Google Firebase Realtime Database:

C. Local Browser Storage

We store functional preferences directly on your device using HTML5 LocalStorage:

D. Analytics & Diagnostics Data

With your consent (or under our legitimate interest for aggregated anonymized telemetry), we use Google Firebase Analytics to track high-level aggregate game performance (e.g., game mode popularity, round completion rates, error diagnostics). IP addresses are anonymized.

E. Advertising & Cookie Data (Google AdSense)

We display advertisements provided by Google AdSense to support free gameplay. Google and its ad technology partners use cookies, device identifiers, and similar technologies to serve advertisements based on your prior visits to this and other websites across the Internet.

3. Legal Bases for Processing (Art. 6 GDPR)

Purpose of Processing Data Categories Legal Basis (GDPR Art. 6)
Serving web assets, game execution, and site security IP address, HTTP request headers, browser type Legitimate Interests (Art. 6(1)(f)) — ensuring site availability, stability, and anti-abuse protection.
Real-time multiplayer synchronization Ephemeral nickname, room code, game choices Contractual / Service Performance (Art. 6(1)(b)) — delivering the requested game functionality.
Personalized or contextual advertising (Google AdSense) Advertising identifiers, cookies, browsing interactions Consent (Art. 6(1)(a)) obtained through our certified Consent Management Platform (CMP).
Aggregated performance analytics Anonymized telemetry, game event counts Consent (Art. 6(1)(a)) / Legitimate Interests (Art. 6(1)(f)).

4. Third-Party Sub-Processors & External APIs

We work with trusted third-party providers who process data in accordance with strict privacy safeguards:

5. Cookies & Consent Management (CMP / TCF v2.2)

In compliance with the ePrivacy Directive and GDPR, we implement a Google-certified Consent Management Platform (CMP) adhering to the IAB Europe Transparency and Consent Framework (TCF v2.2) for users in the European Economic Area (EEA) and the United Kingdom.

You have the freedom to accept, decline, or configure specific purposes and vendor consents for advertising cookies upon your first visit. You can modify or revoke your consent at any time.

Opt-Out & Privacy Controls:

6. Your Rights Under GDPR (Articles 15-22)

If you reside within the European Economic Area (EEA) or the United Kingdom, you are entitled to the following statutory rights:

  1. Right of Access (Art. 15): Right to obtain confirmation as to whether personal data concerning you is processed and request copies.
  2. Right to Rectification (Art. 16): Right to obtain correction of inaccurate personal data.
  3. Right to Erasure / "To Be Forgotten" (Art. 17): Right to request deletion of your personal data. (Note: because we do not maintain persistent accounts, clearing your local browser storage will instantly remove all local game records).
  4. Right to Restriction of Processing (Art. 18): Right to restrict how we process your data under certain conditions.
  5. Right to Data Portability (Art. 20): Right to receive your personal data in a structured, commonly used format.
  6. Right to Object (Art. 21): Right to object to processing based on legitimate interests or direct marketing at any time.
  7. Right to Withdraw Consent (Art. 7(3)): If processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of processing prior to withdrawal.
  8. Right to Lodge a Complaint: You have the right to lodge a complaint with a competent Data Protection Supervisory Authority in your EU Member State (e.g., DPC Ireland, CNIL France, ICO United Kingdom).

To exercise any of these rights, please email us at privacy@whatthetrack.app. We will respond within 30 days without charge.

7. Children's Privacy (COPPA & GDPR Art. 8)

Our game is designed for general audiences and does not knowingly collect personal information from children under the age of 13 (or under 16 in certain EU member states). If you believe a child has provided us with personal data, please contact us immediately, and we will purge the data without delay.

8. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect enhancements to our gameplay, legal obligations, or advertising partnerships. The "Last Updated" timestamp at the top of this document indicates the effective date of the latest revision. Continued use of the website constitutes acceptance of the revised terms.

9. Contact Information

If you have any questions, inquiries, or privacy concerns regarding this policy, please reach out to:

Email: privacy@whatthetrack.app
Web: https://whatthetrack.app