Privacy Policy

The controller for the purposes of the General Data Protection Regulation (EU) 2016/679 (“GDPR”) is:

Boris Stöckle
Tűzoltó utca 37-47, 1094 Budapest, Hungary
Email: contact@medguesser.com

This information is also provided in fulfilment of the service provider disclosure obligations under Hungarian Act CVIII of 2001 on electronic commerce services (Elkertv.).

You can play without registering. In that case your game history, streak and per-case statistics are written to your browser’s localStorage and stay on your device. They are never transmitted to us, are not shared between browsers or devices, and clearing your browsing data deletes them permanently.

One exception: if you later create an account and sign in on that device, the history already saved in the browser is copied up into your account the first time you do, so that registering does not cost you your streak. From that point it is account data and is covered by the section below.

Accounts are deliberately minimal. We ask for a username and a password: no email address, no real name, nothing that identifies you personally unless you choose a username that does.

For each account we store the username, a securely hashed password (we never see or store the password itself), the account creation date, your game results (case, date, whether you solved it, attempts and clues used), and your friend connections. The legal basis is Article 6(1)(b) GDPR: performing the service you asked us to provide.

For technical reasons our authentication provider requires an email address internally, so a synthetic placeholder is generated from your username. It is not a working address, receives no mail, and is never shown to anyone. Because we hold no real email address, a forgotten password cannot be recovered.

Your username is discoverable by other logged-in users through the friend search: that is how people find each other, and searching requires typing at least the first two characters of an existing username. Your game statistics, friend list and account details are not visible to other users.

Your individual results stay private. They do contribute to one shared figure: once you solve a case, the result panel shows the average number of tries taken by everyone who has solved that same case. That average is calculated on the server and released only as an aggregate: no individual result, username or account can be identified from it.

Choose a username that you are comfortable being publicly visible. Avoid using your full real name if you would rather not be identifiable.

Account data, game results and friendships are stored with Supabase, acting as our data processor, in its Frankfurt (Germany) region: a data centre within the European Economic Area.

The site is served by our hosting provider, Vercel, which automatically records technical data each time a page is requested. This typically includes your IP address, the time of the request, the page requested, referring page, and browser and operating system identifiers.

This processing is necessary to deliver the site and to maintain its security and stability. The legal basis is our legitimate interest under Article 6(1)(f) GDPR in operating a functioning and secure service. On our current (Hobby) plan these logs are retained by the provider for around one hour and are not combined with any other data or used to build a profile of you.

MedGuesser sets no advertising or tracking cookies. If you log in, your session token is kept in browser storage so you stay signed in: this is strictly necessary to provide the account you asked for, and is not used for analytics or profiling. The game-history entries described above work the same way.

Account data is kept for as long as the account exists. You can ask us to delete your account and everything attached to it at any time: see the Data Deletion page for exactly how. Data stored only in your browser is deleted whenever you clear your browsing data.

Usage analytics are not currently implemented. If they are introduced, this policy will be updated before they go live, and where consent is required, for example for any non-essential analytics or cookies, it will be requested at that point rather than assumed.

We do not sell personal data or share it for advertising. The third parties involved are our hosting provider and Supabase, both acting as processors on our instructions. Where a provider stores or processes data outside the European Economic Area, transfers are covered by the European Commission’s Standard Contractual Clauses or an applicable adequacy decision.

Under the GDPR you have the right to request access to your personal data, and to request its rectification or erasure, restriction of processing, data portability, and to object to processing carried out on the basis of legitimate interests. You may also withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out beforehand.

To exercise any of these rights, contact us at contact@medguesser.com. If you play without an account we hold no game data about you, since it never leaves your device: you can remove it yourself by clearing your browser storage. The server logs described above are the one thing recorded either way.

If you believe your data has been handled unlawfully, you may lodge a complaint with the Hungarian supervisory authority: Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), Falk Miksa utca 9-11, 1055 Budapest, Hungary, or with the supervisory authority of your country of residence.

MedGuesser is intended for medical students and healthcare professionals. It is not directed at children, and we do not knowingly collect data from them.

We may update this policy as the site develops. The date at the top of this page always reflects the current version.