Privacy

This site has no accounts, no login, no database and no server-side code. It is a set of static files. Your streak, your answers and your settings never leave your browser, because there is nothing here for them to be sent to.

Two third parties are nevertheless involved in showing you a page: the company that hosts the files, and iNaturalist, which serves the photographs. Both are described below.

Who is responsible

The controller within the meaning of Art. 4(7) GDPR is the provider named in the Impressum, where you will also find the contact address for any of the requests described under Your rights.

What is stored on your device

This site sets no cookies. It does use your browser’s local storage, which differs from a cookie in that it is never transmitted to any server, it is read only by the page itself, on your own machine.

None of it identifies you and none of it is combined with anything else. Storing it is covered by § 25(2) no. 2 TDDDG as strictly necessary for the function you asked for: a game that forgets your streak between visits is not the game you opened. Clearing your site data in your browser deletes all of it, and the game starts over.

Where you are

Nowhere in this site is it worked out. There is no IP lookup, no location service, and no request that leaves your device in order to place you. Until August 2026 your browser’s own timezone setting was read locally to guess a continent for the deck; that guess is gone along with the per-continent puzzle it fed, and nothing has replaced it. Today’s puzzle is the same eight mushrooms for every player on earth.

Photographs

Photographs are not stored or re-hosted here. Your browser asks the iNaturalist API (api.inaturalist.org) which pictures exist for a species, then loads them directly from iNaturalist’s servers. As with any request to another site, iNaturalist therefore receives your IP address, your user agent, and the fact that the request came from this domain. Nothing about you comes back to us.

iNaturalist is operated by the California Academy of Sciences in the United States, so this is a transfer to a third country under Chapter V GDPR. The legal basis is Art. 6(1)(f) GDPR: a mushroom game that cannot show you a mushroom does not work, and hot-linking credited, openly licensed photographs is the least invasive way to do it. Their privacy policy is at inaturalist.org/pages/privacy.

Hosting and server data

The site is hosted on a server rented from Hetzner Online GmbH, inside the EU. Delivering a web page is not possible without your IP address, and the web server processes the usual connection data, address, time, file requested, user agent, for the technical operation and security of the service. Legal basis Art. 6(1)(f) GDPR. That data is not used for analytics, is not built into a profile, and is not combined with the local storage described above.

Advertising

This site is funded by advertising, served by Adsterra, the trading name of AD MARKET LIMITED (Cyprus) and ADMEDIA LLC FZ (United Arab Emirates). On the pages that carry an advertisement, currently the home page, the daily puzzle and the practice modes, your browser loads a script from Adsterra and then the advertisement itself. Adsterra and the advertisers it works with therefore receive your IP address, your user agent, the page you are on, and may set cookies or read similar identifiers on your device in order to select, cap and measure what you are shown. The UAE has no EU adequacy decision, so this is a transfer to a third country under Chapter V GDPR.

Be clear about what this means. There is no consent banner on this site, and the advertising script loads on those pages whether or not you want it to. Whether any given advertisement is personalised, and on what data, is decided inside Adsterra’s network and is not something this site controls, configures or can switch off on your behalf. If you would rather not load it, a content blocker will stop it and the game will work exactly as it does now: nothing here is gated behind an advertisement. Adsterra’s own description of what it collects is at adsterra.com/privacy-policy.

Nothing else on this page changes because of it: the advertising script is the only third-party code here besides the photographs, it is never given your streak, your answers or anything else from the storage described above, and none of that leaves your browser.

Analytics

There are none. No analytics service, tag manager, pixel, heatmap or A/B testing tool is loaded, and no visitor counter runs. If that ever changes it will be named here first.

Your rights

Under the GDPR you have the right to access your data (Art. 15), to have it corrected (Art. 16) or erased (Art. 17), to restrict its processing (Art. 18), to data portability (Art. 20), and to object to processing based on legitimate interest (Art. 21). Where processing rests on consent, you may withdraw it at any time with effect for the future.

In practice there is very little to hand over or delete: no account exists, and what this site holds about you sits in your own browser, where clearing your site data removes it immediately and completely. Requests go to the address in the Impressum.

You also have the right to complain to a supervisory authority (Art. 77 GDPR), ordinarily the data protection authority of the federal state in which you live.

Children

The game suits all ages, but it is not directed at children and asks no personal data of anyone.

Changes

This page lives in the site’s source repository alongside the code it describes, so a change to what the site does and a change to this page arrive together. Last updated 11 August 2026, when advertising was enabled.