Privacy Policy

Version 1 · Effective October 16, 2026

This Privacy Policy explains how we collect, use and protect your personal information when you play Why Human Ask at whyhumanask.com, on a phone, a computer or a TV screen. We have tried to write it plainly. If something is unclear, write to us at contact@hazerim.com.

Who We Are

Why Human Ask (whyhumanask.com) is operated by Hazerim Interactive Entertainment, UAB, a private limited company registered in Lithuania, at Ukmerges g. 228a-8, 07161 Vilnius, Lithuania. We are the controller of the personal data described here, which means we decide why and how it is used.

You can reach us about anything in this policy at contact@hazerim.com.

Information We Collect and Why

Why Human Ask is a party game about what the world searches for. We collect only what the game needs to run, to keep it fair, and to understand whether people actually play it. We do not sell, rent or lease your personal data.

Playing without an account

• A random device identifier. The first time you open the game, your browser creates a random id and keeps it on your device. It is not linked to your name or to anything outside the game. It is sent with some requests so we can enforce one Daily challenge per day, avoid repeating the first-game tips, and limit support spam. For our room measurements and support messages we store only a one-way hash of it, not the id itself. For the Daily one-shot rule we store the id next to that day's result.
• The name you type. You join a room with any name you like. Other players in the room, and the TV screen if one is connected, see it. We do not need your real name.
• Your answers and scores. The answers you type, the scores they earn and the final standings are stored by the game. Answers that are scored with real search data are kept in an archive, together with the name you played under, the challenge and the score. The archive powers the “ghost” players in Play solo (the public queue), who replay real past answers under made-up names such as “Ghost Otter”, and the history shown for each challenge. In party rooms with fewer than five answers, the reveal can also show earlier answers to the same challenge from this archive, under the display name their player chose, marked as ghosts and not counted. Pick a display name you are happy to see next to your answers.
• Rooms. A room’s live state (room code, the names and answers in it) is kept in memory and in a short-lived database copy so a room survives a server restart. It is deleted when the room has been empty for 10 minutes or idle for 45 minutes. A summary of each finished game (room code, names and points) is kept for statistics.
• Date of birth, if you enter one. Some optional challenge packs are for adults only. If you enter a date of birth, it stays on your device (or on your account if you are signed in) and is used only to decide whether those packs can be offered in a room where everyone has declared they are adults. We never verify it, and the game itself is never locked behind it.

Signing in with Google

Signing in is optional; it lets you keep a profile and climb the ranked ladder. When you sign in, Google tells us your Google account id, your email address, your name and the address of your profile picture. We store these on your account, with:

• a custom display name and an uploaded avatar, if you choose to set them;
• your rank points, tier, match history, badges, records, the players you have played with and challenges between players;
• your settings (chart style, splash frame, custom emotes, streamer mode) and your date of birth if you entered one.

Your display name, avatar or Google picture, rank and badges are visible to other players: in rooms, on the public leaderboard, on profiles and on rivalry pages. Your email address is never shown to other players. We use it to identify your account and, if you buy a pass, to pre-fill Stripe’s checkout.

Hosting a party room

When you create or join a party room, your device can carry a short tag saying how you arrived (for example from a friend’s “Host your own” link or a streamer’s link), with the time. These tags, the hashed device identifier and a few events about the room (created, a second player joined, a game started, a round finished, a rematch) are used to count how many rooms are started and finished by real groups of friends. See “Measurement” below.

The Party Pass

Payments are handled by Stripe. When you buy a pass, you pay on Stripe’s own checkout page; your card details go directly to Stripe and never reach our servers. We send Stripe your account id, your email address and which pass you chose. We store your Stripe customer id, whether you hold a pass and until when, and whether you bought the Founder pass. The subscription details (status, renewal date) are read from Stripe when you open your profile. Stripe’s own use of your data is described in Stripe’s privacy policy.

Support messages

If you write to us through Help & Support, we store the topic, your message, the email address you give us (optional), your account if you are signed in, the room code you were in, a hash of your device identifier and your browser’s user agent, so we can understand and answer the problem. Messages may also be forwarded to a private channel on Discord that our team reads.

Measurement

Apart from the product analytics and Google Analytics described next, we do not use third-party analytics. We keep our own small log of party-room events, described above, to measure whether rooms are created and finished without our team being in them. It uses the hashed device identifier, never the raw id, and does not include names or answers. Play solo, the Daily challenge and Practice are not logged. Raw events are deleted after 90 days; what we keep after that is weekly totals that do not identify anyone.

Product analytics

To see how the game is played — which screens lead to a finished game, whether a forming match gets joined, whether a Party Pass checkout is completed — we send product analytics events to PostHog, on its EU cloud. Each event carries the hashed device identifier described above (never the raw id, and never your name, email address or picture), the screen or action it describes and a few numbers about the game, such as the round number, the number of players and the mode. The words you answer with and the challenges you see are never sent. PostHog sets no cookie here: the game keeps the identifier in memory for the page only. Session replay is off, nothing you type is recorded, and no page views or clicks are collected automatically. If your browser sends a Global Privacy Control or Do Not Track signal, no analytics loads at all. Events are kept for the retention period set on our PostHog project and then deleted. PostHog’s own policy is at posthog.com/privacy.

Every page of the site also carries Google Analytics 4 (the Google tag, measurement id G-1DE0H3PXGJ), which tells us how many people visit which pages and from where, and whether they come back. It runs in Google’s consent mode with every consent type set to “denied” for everyone by default: until you agree, it sets and reads no cookie and sends only cookieless, aggregated pings that carry no identifier for you. The only place you can agree is Google’s consent message in the Play solo queue, where it is shown; if you accept the storing of information on your device there, Google Analytics may then set its own cookies (_ga, _ga_*) until you change your choice from Privacy & ad choices. Your IP address is anonymised and is not stored by Google Analytics. Google processes this data on our behalf, under Google’s data processing terms; its policy is at policies.google.com/privacy, and its browser add-on for opting out of Google Analytics everywhere is at tools.google.com/dlpage/gaoptout. If your browser sends a Global Privacy Control or Do Not Track signal, the Google tag is not loaded at all.

Checking answers

Two kinds of services see the words you answer with, never who you are:

• Search-interest data. To score a round, the answers and the country setting are looked up against search-interest data to see how much each term is searched. No names, ids or other details about players are sent.
• The Judge. To check that answers fit the challenge, the challenge text, the answers and any extra rule the host wrote are checked by an automated judging service. It receives the challenge and the answers only; no names, ids or account details are sent. Please do not type personal information as an answer.

Ads in Play solo

The game is free, and Play solo is paid for by ads. Ads are shown only while you wait in the Play solo queue, never in party rooms and never for Party Pass holders. These ads come from Google AdSense. Google’s ad script loads only when an ad is about to show in the queue, or when you open “Privacy & ad choices” in your profile. If you are in the European Economic Area, the United Kingdom or Switzerland, Google first shows you a consent message, and personalised ads are only shown if you agree. Some ad spaces show our own “house” ads for the Party Pass; these use no cookies and need no consent. See “Cookies and Local Storage” below.

TV casting

The TV screen at /tv/… only shows what is already shared in the room (names, answers, scores, the room code and QR code). If the host has streamer mode on, the TV hides the room code and QR code. The TV page remembers one display preference on that screen.

Security and logs

To protect the game from abuse, our server uses your IP address as a key for rate limits (for example, how many messages or guesses can be sent per hour). These counters live only in the server’s memory, last at most an hour, and are not written to the database. Like any website, our hosting and network providers process IP addresses and technical request data to deliver the pages and keep the service secure, and our server keeps technical logs, which can include the challenge and answers being scored, for troubleshooting.

Legal Bases

Under the EU General Data Protection Regulation (GDPR, Article 6) we rely on:

• Performance of a contract — running the game you asked to play: rooms, names, answers, scores, the Daily rule, your account and profile, ranked play, and the Party Pass and its payment.
• Legitimate interests — keeping the game secure and fair (rate limits, logs, the answer judge, preventing a second Daily attempt), measuring whether the game works for real groups (the room events), answering support messages, building the answer archive and ghosts, and showing our own house ads. We have weighed these against your interests and kept the data minimal: hashed ids, short retention for raw measurement, and third-party analytics that set no cookie unless you agree.
• Consent — personalised ads, and the cookies of Google Analytics, through Google’s consent message where the law requires it. You can withdraw or change your consent at any time from Privacy & ad choices in your profile.

Your right to object. Where we rely on legitimate interests, you can object at any time by writing to contact@hazerim.com. We will stop unless we have compelling grounds that override your interests, or need the data to establish or defend legal claims.

Cookies and Local Storage

Our own pages set only the two cookies below, both strictly necessary for signing in. Everything else the game remembers is kept in your browser’s local storage on your device. It is not sent to us unless noted, and it stays until you clear your browser’s site data. The game also stores its own files in the browser so it can open offline; those contain no personal data.

Google explains how it uses data on sites that show its ads at policies.google.com/technologies/partner-sites. You can manage personalised advertising across Google at adssettings.google.com. To change your choice for Why Human Ask, open your profile and tap Privacy & ad choices; outside the regions where consent is required, the row tells you no choice is needed.

Third-Party Services

We share personal data only with the service providers we need to run the game, each for its own role below. We do not sell, rent or lease your personal data to them.

• Hetzner Online — hosts our servers and database in the European Union.
• Cloudflare — delivers our pages and protects the site; it sees IP addresses and requests in transit.
• Google — sign-in with Google; AdSense and its consent message in the Play solo queue; Google Analytics on every page, as our processor, cookieless until you agree; the web fonts our pages load (which means Google receives your IP address when a page loads); and Google profile pictures, which load from Google’s servers.
• Stripe — payments for the Party Pass.
• PostHog — product analytics, on its EU cloud (data stored in the European Union), under the hashed device identifier only.
• Discord — a private channel where our team may receive support messages. Links to our public Discord server just take you to Discord, whose own policy then applies.

International Data Transfers

Our servers and database are in the EU. Some of the providers above are based outside the European Economic Area, or may process data there: Google, Stripe and Cloudflare are headquartered in the United States; PostHog, also a US company, processes our analytics on its EU cloud, in the European Union. Where personal data leaves the EEA, we rely on the safeguards these providers offer, such as the European Commission’s Standard Contractual Clauses and, for US providers that participate in it, the EU-US Data Privacy Framework. We keep what we send to providers outside the EU to the minimum: the scoring and judging services receive answer words only, not who wrote them.

How Long We Keep Data

• Room state: until the room is empty for 10 minutes or idle for 45 minutes.
• Rate-limit counters: up to one hour, in memory only.
• Room measurement events: 90 days; after that only weekly totals that identify no one are kept.
• Product analytics events: for the retention period set on our PostHog project, then deleted.
• Google Analytics data: event data for the retention period set on our Google Analytics property, then deleted by Google; the aggregated reports that remain identify no one.
• Your account, with your profile, ranked history, badges and pass status: until you ask us to delete it.
• The answer archive and finished-game summaries: kept for as long as the game runs, because ghosts and challenge history depend on them. You can ask us to remove your name from them.
• Daily challenge results: kept with the day, so the one-shot rule holds.
• Support messages: kept while we need them to handle your request and follow up on it. Ask us and we will delete yours.
• Technical logs: kept for a limited time for troubleshooting and security, then overwritten.
• Everything in your browser’s local storage: until you clear it.

Data Security

All traffic to the game is encrypted (HTTPS). Sign-in sessions are signed so they cannot be forged, device identifiers are hashed wherever we only need to count them, and admin tools are limited to our team. However, no system is completely foolproof, and we cannot guarantee absolute security of data transmitted over the internet.

Your Rights

Under the GDPR you have the right to:

• access the personal data we hold about you and get a copy;
• rectification — have inaccurate data corrected (you can change your display name and avatar yourself in your profile);
• erasure — have your data deleted;
• restriction — ask us to limit how we use your data;
• portability — receive the data you gave us in a common machine-readable format;
• object to processing based on our legitimate interests (see “Legal Bases”);
• withdraw consent at any time, for example to personalised ads through Privacy & ad choices, without affecting what happened before;
• complain to a data protection authority.

To use any of these rights, write to contact@hazerim.com from the email address of your Google account if you have one, so we can find it. To delete your account, ask us: we will delete your account and the data linked to it (profile, ranked history, badges, rivalries, Daily results) and remove your name from the answer archive and game summaries. Removing Why Human Ask’s access in your Google account settings stops future sign-ins, but does not by itself delete what we already hold, so please also write to us. If you play without an account, you can clear your browser’s site data for whyhumanask.com at any time; because we cannot otherwise tie a guest to their data, tell us your device identifier or room details if you want something removed. We answer within one month.

Our lead supervisory authority is the State Data Protection Inspectorate of Lithuania (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt). If you live elsewhere in the EU, you can also complain to the data protection authority in your own country.

Age Restrictions

Why Human Ask is intended for users aged 16 and older. We do not knowingly collect personal data from individuals under 16 years of age. If you believe a child under 16 has given us personal data, contact us and we will delete it. Entering a date of birth only decides whether optional adult challenge packs may be offered; it is not an age check for the game.

Changes to This Policy

We will update this policy when the game starts handling personal data differently. The version and the date it takes effect are shown at the top of the page. If a change matters for how your data is used, we will also tell you in the game before it applies.

Version 1 · Effective October 16, 2026

Contact Us