Who is responsible
HeightGuessr (heightguessr.com) is responsible for the processing described in this policy. You can reach us through the contact form or at info@heightguessr.com. “We” and “us” means the operator of the site, and “you” means anyone who visits or uses it.
What we collect and why
We collect only what the site needs. The legal bases named below come from the EU General Data Protection Regulation (GDPR), which we apply to every visitor.
Visiting the site
Every time you open a page, your browser sends technical information such as your IP address, browser type, the page you request and the page you came from. Our hosting provider Cloudflare uses it to deliver the site and protect it against attacks. We use no analytics tools and keep no access logs of our own. This relies on our legitimate interest in a secure and working website (Art. 6(1)(f) GDPR).
Votes
Voting needs no name or email address. When you vote, we add one to the count for the height you picked on that page. These counts show the average guess and how the votes are spread, and they contain nothing about you. To count one vote per visitor and page, we also store a hash calculated from your IP address, a secret value and the page. We cannot read your IP address from the hash. Because we hold the secret value, we still treat the hash as personal data. This relies on our legitimate interest in fair averages (Art. 6(1)(f) GDPR).
Comments
When you post a comment, we store your name, your comment, the date and, if you give it, your email address. The name is required. The email address is optional, never shown and used only if we need to contact you about your comment, for example when we remove it. To limit how many comments one person can post in a short time, we store a hash of your IP address with the comment for 30 days.
Comments without a link appear right away, and comments with a link appear after a quick check. Published comments show your name, your comment and the date to everyone, and search engines can find them.
We publish your comment because you ask us to under our Terms of Use (Art. 6(1)(b) GDPR). Moderation, spam protection and the optional email address rely on our legitimate interest in a friendly comment section without spam (Art. 6(1)(f) GDPR).
Messages to us
When you use the contact form, we receive your name, your email address, the topic, your message and the page you came from. We need the name, email address and message to answer you. The form stores your message in our database and forwards it to our email inbox. To limit how many messages one person can send in a short time, we store a hash of your IP address with the message for 30 days. When you email info@heightguessr.com directly, we receive your email address and your message. This relies on our legitimate interest in answering you and handling follow-up questions (Art. 6(1)(f) GDPR).
Anti-bot checks
Our forms use Cloudflare Turnstile to tell people and bots apart. Turnstile loads only when you start using a form. It checks technical signals such as your IP address and browser characteristics and tells us whether the check passed. It does not read what you type into the form. Cloudflare also uses these signals as an independent controller to improve Turnstile, as described in its Turnstile privacy addendum. This relies on our legitimate interest in protecting the site from spam and abuse (Art. 6(1)(f) GDPR).
Cookies and local storage
The site sets no cookies of its own. A few features save small entries in your browser’s local storage. They are created only when you use the feature, contain no tracking ID and are never sent to us. Cloudflare may set a security cookie when it checks for bots.
| Name | Type | Purpose | Kept |
|---|---|---|---|
| hg-best | Local storage | Remembers your best streak in the game | Until you delete it |
| hg-votes | Local storage | Remembers your guess on each page you voted on, so you see the results | Until you delete it |
| hg-name | Local storage | Saved after you post a comment and fills in your name next time | Until you delete it |
| cf_clearance | Cookie set by Cloudflare | Set only after a Cloudflare security check and remembers that you passed it | 30 minutes |
These entries are needed for the features you use, so they require no consent. You can delete cookies and local storage in your browser settings at any time.
If you are featured on HeightGuessr
Our celebrity pages contain information about public figures: their name, what they are known for, height claims made by them or others, our estimate, photos under free licenses and links to sources. We take this information from public sources such as interviews, official listings, news reports, Wikidata and Wikimedia Commons. We publish it to report and discuss celebrity heights, which is our legitimate interest and a matter of public interest (Art. 6(1)(f) GDPR). If you are featured and want something corrected, or if you object to a page, please contact us. We review every request and update or remove information where your interests outweigh ours.
Who receives your data
- Cloudflare, Inc. hosts the site, stores our database, runs Turnstile and forwards emails sent to info@heightguessr.com. Cloudflare processes this data on our behalf under a data processing agreement. More in the Cloudflare privacy policy.
- Google LLC provides our email inbox, where your messages to us arrive. More in the Google privacy policy.
- Everyone who visits the site sees published comments with the name you chose.
- Authorities and courts receive information when the law requires it or when it is needed to protect the rights and safety of our visitors or of HeightGuessr.
- A new operator receives the data if the site changes hands. We update this policy before that happens.
We do not sell your personal information and do not share it for advertising.
Where your data is processed
Cloudflare runs data centers around the world, and each visit is handled by one close to you. Our database runs in a Cloudflare data center in Europe. Cloudflare and Google are US companies, so data can reach the United States. These transfers rely on the EU-US Data Privacy Framework and its UK and Swiss extensions, under which both companies are certified, and on the EU standard contractual clauses where those apply.
How long we keep data
| Data | How long |
|---|---|
| Published comments with name and date | Until we remove them or you ask us to |
| Email addresses given with comments | As long as the comment exists, or until you ask us to delete the address |
| Comments with a link that we do not publish | 30 days at the most |
| Messages to us, in our database and inbox | 2 years at the most, or less if you ask us to delete them |
| IP hashes stored with comments and messages | 30 days |
| IP hashes that prevent double votes | 12 months |
| Vote counts per height | Kept, as they contain no personal data |
| Technical data at Cloudflare | For a short time under Cloudflare’s own rules |
| Local storage entries | On your device until you delete them |
Deleted data can remain in database backups for up to 30 days.
Your rights
Every visitor has the same rights, wherever you live:
- Access. You can ask what personal information we hold about you and receive a copy.
- Correction. You can ask us to correct information that is wrong.
- Deletion. You can ask us to delete your comments, your messages and your email address.
- Restriction. You can ask us to limit how we use your information.
- Portability. You can ask for your information in a common format.
- Complaint. You can complain to a data protection authority, in particular in the country where you live or work or where you believe the problem occurred.
Your right to object. Where we rely on our legitimate interests, you can object at any time for reasons that arise from your particular situation. We then stop using your data for that purpose unless we have compelling grounds or need it to establish or defend legal claims. On request, we explain how we weighed our interests against yours.
To use any of these rights, write to us through the contact form or at info@heightguessr.com. To protect your information, we may ask you to confirm that a comment or message is yours, for example by writing from the same email address. We answer within one month. Using your rights never affects how you can use the site.
Children
The site is meant for a general audience and is not directed to children under 13. You must be at least 13 years old to comment or contact us. We do not knowingly collect personal information from children under 13. If we learn that we have, we delete it. Parents and guardians can contact us at any time.
Do Not Track and advertising
The site does not track you across other websites, and no third party collects personal information about your activities over time and across websites through it. For that reason, the site works the same whether or not your browser sends a Do Not Track or Global Privacy Control signal.
The site shows no ads at the moment. Before we add advertising, we will update this policy and, where the law requires it, ask for your consent.
Security
All connections to the site are encrypted with TLS. The moderation area is protected by a password and open only to us. We store IP addresses only as hashes. No method of transmission or storage is completely secure, and we work hard to protect your information.
Notes for the UK, Brazil and US states
- United Kingdom. If UK data protection law applies to you, you can complain to us first, and we confirm your complaint within 30 days. You can also complain to the Information Commissioner’s Office.
- Brazil. Under Art. 18 of the LGPD, you can ask us to confirm that we process your data, give you access, correct it, anonymize, block or delete it, transfer it and tell you who we share it with. Please use the contact details above.
- California and other US states. We collect identifiers (name, email address and hashed IP address), the content of your comments and messages, and internet activity such as the pages you request. We use them for the purposes in this policy and share them only with the recipients named above. We do not sell or share personal information, do not collect sensitive personal information and make no automated decisions with legal or similar effects. You can use all the rights in Your rights.
Changes and questions
We update this policy when the site changes or the law requires it. The date at the top shows the current version. If a change is significant, we point it out on the site before it takes effect.
Questions about this policy or your information? Write to us through the contact form or at info@heightguessr.com. We are happy to help.
This policy is adapted from the Basecamp open-source policies (CC BY 4.0).