Privacy policy

Last updated: 28 September 2026

In short: camera images are processed on your phone and not sent to any server unless you choose so. What we store is little, pseudonymous, and you can delete it yourself.

1. Controller

2. What data we process and why

2.1 Camera images

The hand detector runs inside your browser. Camera images are not sent to any server unless you choose so: when you send a challenge with “Send with photo”, or in rooms with the “cut-out” or “photo” modes of Settings → “What others see” (see 2.4). The game does not keep photos on your phone either: each game's image only exists while you are looking at it. In Bugs and Memory games with friends only the skeleton of your hand is sent, and in Tower games only the position of your tray and pieces, with no image (see 2.5).

2.2 Leaderboards

At the end of each solo game we send your score for the leaderboards (world, country, city): a random identifier of your browser (not linked to your identity), your nickname if you chose one, the score, the hand used, the language and the country and city: the ones you set in Records or, if you set none, the approximate ones our provider derives from your connection (the IP address is not stored with the record). To check that the score is genuine, the server also receives the geometry of the final pose (21 points in 3D, no image), recomputes the points and discards it, unless you gave the consent in section 2.3. Leaderboards show the nickname (or “—”), the score and the city or country.

In Bugs, Memory, Tower, Palette, Twists and Tides, at the end of each game we send your score for that game's leaderboard: your browser identifier, your nickname if you chose one, the score, a summary of the game (in Bugs, the time and bugs squashed; in Memory, the level, the sequences you got right and whether you played without sound; in Tower, the highest stack, the pieces dropped and the time; in Palette, the level, the orders delivered and the time; in Twists, the puzzles solved, the stars and the time; in Tides, the level, the full fingers and the time), the language and the country and city, as in the previous paragraph. A 0-point game does not enter the leaderboard: it only counts as a game played. No image and no hand geometry is sent.

Legal basis: performance of the service you use when you play, which includes the leaderboards (art. 6(1)(b) GDPR). You can delete your entries for every game at any time from Settings → “Delete my data from the server”.

2.3 Research and comparisons (with your consent)

If you tick “Donate my hand geometry (no photos) to research”, unticked by default, we also keep a record of each game with the geometry of the final pose, the relative distances, the palm width if you measured it, the hand shape at calibration and the browser model. Purposes: improving the measurement and scientific research on aggregated or anonymised data.

Your age and sex are only stored if you choose to enter them in “Compare”, with your score, for the comparisons by age and sex.

Legal basis: your consent (art. 6(1)(a) GDPR): ticking the box or entering your age and sex. You can withdraw it at any time by unticking the box in Settings, and delete what was stored with “Delete my data from the server”.

2.4 Challenges and rooms

When you create or join a room or challenge we store your nickname, avatar, scores and the skeleton of your hand (2D points) to show them to the other participants; in rooms, also the image you choose in “What others see” (“cut-out” or “photo”). When you send a challenge you choose, with both cards in view, what goes with the link preview: the real photo of your game, exactly as taken or just the skeleton, with no camera image at all. Anyone with the link can see the card. This data is linked to the room or challenge code and deleted automatically: images when it expires; everything else 7 days after the room or challenge ends or expires and, in any case, after 30 days without activity. Legal basis: performance of the service you request (art. 6(1)(b)).

2.5 Games with friends

When you create or join a game with friends (Bugs, Memory, Tower, Palette, Twists or Tides) we store, linked to the game code, your browser identifier, nickname, avatar, whether you are ready, and your points and lives (in Memory, also each round's result), to show them to the other players. During the game your phone sends about 15 times per second the skeleton of your hand (21 2D points in your screen's coordinates, with no image) and what happens in your game (in Tower, instead of the skeleton, about 8 times per second the position of your tray and pieces; in Palette, Twists and Tides, at most 5 times per second, a summary of your board: the colours of your pots, balls or tubes); our server forwards it immediately to the other players of that game and does not store it. The game's data is deleted automatically one hour after it ends, or after two hours without activity. In Bugs, Tower, Palette, Twists and Tides, the score you get counts for your leaderboard like any other game (2.2); Memory games in rounds do not count for the leaderboards. Legal basis: performance of the service you request when playing with others (art. 6(1)(b) GDPR).

2.6 Service usage and security

We log usage events (visit, start, result, share…) with your browser identifier, approximate country and city, language, device type and the page you came from. Our infrastructure provider also processes IP addresses to protect the service from abuse. Purpose: measuring usage, detecting errors and protecting the service. Legal basis: legitimate interest (art. 6(1)(f)). This data is not used to build personal profiles.

2.7 Advertising

Gummano is funded by Google AdSense ads. In the European Economic Area, the United Kingdom and Switzerland we will ask for your consent before using cookies or identifiers for advertising; if you do not give it, non-personalised ads are shown. Google acts as an independent controller for that processing: see how Google uses information from sites that use its services. You can change your choice at any time with the “Ad privacy” link at the bottom of the site.

3. Data that stays on your device

Your game history (scores and hand geometry, no photos), your Bugs, Memory, Tower, Palette, Twists and Tides records, the fingertip calibration that Bugs, Memory, Palette, Twists and Tides use (distance thresholds computed from your hand, no images), nickname, avatar, preferences and ongoing rooms are stored in your browser's storage. You can delete them from Settings → “Delete my games from this phone”. More in the cookie policy.

4. Recipients and international transfers

The service is hosted by Cloudflare, Inc. (USA), acting as processor under the EU–US Data Privacy Framework and standard contractual clauses. Ads are served by Google Ireland Ltd. Beyond these cases we do not share data with third parties, except where required by law. Any research data published will always be aggregated or anonymised.

5. Retention

• Leaderboard entries (for each game): until you delete them from Settings or ask us to.
• Research records (pseudonymous, with your consent): until you delete them from Settings or ask us to, and at most while the game is active; afterwards only in anonymised form.
• Rooms and challenges: images until they expire; the rest 7 days after they end or expire, and at most after 30 days without activity.
• Games with friends: one hour after they end or after two hours without activity. The hand skeleton and what is shown of your board (Tower's pieces, the Palette, Twists and Tides summary) are not stored.
• Usage events: 3 months in detail; afterwards only aggregates.

6. Your rights

You can access your data, rectify it, erase it, object to or restrict its processing, request portability and withdraw consent. The fastest way is Settings → “Delete my data from the server” (removes your entries from every game's leaderboards and your research records) and unticking the donation box. For any other request write to info@gummano.app quoting your browser identifier (shown in Settings). If you believe we have not honoured your rights you can lodge a complaint with the Spanish Data Protection Agency (aepd.es) or your local authority.

7. Children

Gummano is a general-audience game, not aimed at children. The minimum age to consent to data processing by information society services is 14 in Spain (art. 7 LOPDGDD); elsewhere in the European Economic Area it ranges from 13 to 16 depending on the country. If you are younger, do not tick the donation box or enter your age and sex. We do not ask for identifying data: if a parent or guardian believes a child has provided data, they can write to us to have it deleted.

8. Changes

Any change to this policy will be published here with its date. If a change affects processing based on your consent, we will ask for it again.