Privacy Policy
Hit or Miss
Last updated: 4 November 2026
1. Overview
This Privacy Policy explains how personal data is processed when you visit or use Hit or Miss, an online multiplayer music party game.
Players can create or join game rooms, choose nicknames, search for and submit songs, listen to music through embedded YouTube players, vote on submissions and guess which player selected a song.
You do not need to register with your real name, provide an email address or create a conventional user account to participate. However, certain technical information, online identifiers and game-related data may still qualify as personal data under applicable data protection law.
We process personal data in accordance with the General Data Protection Regulation (GDPR) and applicable German data protection laws.
2. Data Controller
The controller responsible for processing personal data through this website is:
Mika Hans
Trading under the name Hit or Miss
Am Roswith-Denkmal 8A
45527 Hattingen
Germany
Email: hitormiss.info@web.de
For privacy-related questions or requests to exercise your data protection rights, please contact us using this email address.
3. Information We Collect
Depending on how you use the website, we may process the following categories of information:
Technical and connection data
This may include your IP address, browser type, operating system, device information, date and time of access, requested resources, error information and other information necessary to deliver and secure the website.
Anonymous authentication data
Our backend uses Supabase Authentication to create anonymous user sessions. This process may generate a unique user identifier, authentication tokens and other session-related information.
An anonymous authentication account does not require you to provide your real name or email address. Nevertheless, identifiers and associated usage data may constitute personal data.
Game participation data
When you play Hit or Miss, we process information such as:
- Your chosen nickname and room membership.
- Room identifiers and game settings.
- Selected prompts and submitted YouTube video identifiers.
- Song submissions, votes, guesses and scores.
- Round progression and game status.
- Technical timestamps and identifiers necessary to maintain the game.
Your nickname, song submissions, votes, guesses and scores may be visible to other participants in the same game room, depending on the stage of the game.
Please avoid using real names or including sensitive personal information in nicknames or other game inputs.
Website analytics
We use PostHog to measure website usage, such as visits, game activity and interactions with website features. Further information is provided in Section 8.
Contact information
If you contact us by email, we process your email address, the content of your message and any additional information you choose to provide.
4. Purposes and Legal Bases
We process data for the following purposes:
Providing the website and multiplayer game
We process technical information, authentication identifiers and game-related data to create and join rooms, synchronize gameplay, manage song submissions and voting, and display results.
Where processing is necessary to provide game functionality requested by users, the applicable legal basis is Article 6(1)(b) GDPR, insofar as a contractual relationship applies.
Where processing is necessary for the secure and reliable technical operation of the website, our legal basis may be Article 6(1)(f) GDPR, based on our legitimate interest in providing a functional and secure online service.
Security and troubleshooting
We may process technical data to detect errors, prevent abuse and protect the website and its users. The legal basis is Article 6(1)(f) GDPR.
Website analytics
We use website analytics to understand the use of Hit or Miss and improve the service. The applicable legal basis depends on the specific configuration and processing involved. Further details are provided in Section 8.
Responding to enquiries
Where you contact us about the service, processing may be based on Article 6(1)(b) GDPR, if connected with a contractual matter, or Article 6(1)(f) GDPR, based on our legitimate interest in responding to enquiries.
Where a particular processing activity requires consent, we rely on Article 6(1)(a) GDPR and, where applicable, Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG).
Consent may be withdrawn at any time with effect for the future.
5. Website Hosting – Bolt Cloud
Our website is hosted using Bolt Cloud / Bolt.new, a service operated by StackBlitz, Inc.
Hosting providers may process technical information, including IP addresses, browser information, access timestamps and server requests, to deliver website content, ensure availability and maintain security.
The processing is carried out primarily to provide a secure and reliable website, based on Article 6(1)(f) GDPR and, where applicable, Article 6(1)(b) GDPR.
The hosting provider and its subprocessors may process data outside the European Economic Area. Any such transfers must be covered by an applicable transfer mechanism and appropriate safeguards under Chapter V GDPR.
Further information about the provider's processing practices is available at:
https://stackblitz.com/privacy-policy
Hosting data location and contractual safeguards: The specific applicable data processing agreement, hosting locations and international transfer safeguards must be confirmed against the operator's Bolt Cloud agreement before publication.
6. Supabase – Authentication, Database and Multiplayer Functions
We use Supabase to provide essential backend services for Hit or Miss, including:
- Anonymous user authentication.
- Management of rooms and participants.
- Storage of song submissions and game activity.
- Voting, guessing and scoring.
- Database functions and real-time multiplayer synchronization.
- Server-side functions used for song searching and related game features.
Supabase may process anonymous authentication identifiers, nicknames, room identifiers, game activity, technical connection data and associated timestamps.
These functions are necessary to operate the multiplayer game.
Depending on the particular processing activity, the legal basis is Article 6(1)(b) GDPR or Article 6(1)(f) GDPR.
Supabase is operated by Supabase, Inc. and uses infrastructure and subprocessors to provide its services.
Data location: Our primary Supabase database is hosted in the European Union, specifically in Ireland (West EU, AWS region eu-west-1). This identifies the primary database region only; it does not mean that all Supabase-related processing takes place exclusively within the European Union.
Supabase may also process certain service-related information outside the primary project region, subject to applicable contractual safeguards.
Further information is available at:
https://supabase.com/legal/privacy-resources/data-residency-and-transfers-faq
7. Authentication and Browser Storage
Hit or Miss uses anonymous authentication so that players can participate without providing an email address or password.
Authentication sessions may involve browser storage, including local storage, to maintain session credentials and enable players to remain connected to their game sessions.
We may also use browser storage for necessary game functionality or preferences.
Where storing or accessing information on a user's device is strictly necessary to provide a service expressly requested by that user, an exemption from consent may apply under Section 25(2) TDDDG.
Other storage technologies or accesses that are not strictly necessary require prior consent under Section 25(1) TDDDG, unless another statutory exemption applies.
The exact browser storage keys, purposes and retention periods must be verified against the deployed website.
8. PostHog – Website Analytics
We use PostHog to understand how visitors use Hit or Miss and to improve the website and game experience.
Our intended configuration uses PostHog Cloud EU in a cookieless mode, without session recordings.
Depending on the implementation, the information processed may include:
- Page visits and interaction events.
- Timestamps and requested pages.
- Browser and device information.
- IP address and user-agent information processed by PostHog for cookieless measurement.
- Technical and event information necessary to produce aggregated usage statistics.
PostHog's cookieless measurement can generate short-lived, privacy-preserving identifiers without storing a persistent tracking identifier in the user's browser.
Cookieless analytics does not automatically mean that no personal data is processed. In particular, IP addresses and user-agent information may still be processed by the service provider.
We use this information to measure website usage, identify technical problems and improve the user experience.
The intended legal basis for strictly cookieless, privacy-conscious audience measurement is Article 6(1)(f) GDPR, subject to a documented balancing of interests and verification of the actual implementation. If the implemented analytics processing requires consent, it will be activated only after valid consent.
We do not intend to use PostHog for session recordings, advertising profiling or persistent cross-session identification.
Further information:
https://posthog.com/docs/privacy
Configuration verification required: The actual deployed PostHog settings, event properties and any identification calls must be checked before relying on this description.
9. YouTube – Embedded Music Playback
Hit or Miss uses YouTube to play songs selected by participants.
YouTube is operated in Europe by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
When an embedded YouTube player is loaded, your browser may establish a connection to Google's servers. This may involve transmitting information such as your IP address, browser details, the page being accessed and other technical data.
Google may use cookies or similar technologies, and information may be linked to a Google account if you are signed in to Google or YouTube.
We do not host or redistribute the selected music files ourselves. Playback takes place through the embedded YouTube player.
YouTube content and associated data processing are governed by Google's applicable privacy information:
https://policies.google.com/privacy
Consent requirement
Embedded YouTube content may involve non-essential storage technologies or the processing of personal data that requires prior consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG.
Our intended implementation is to load YouTube players that require consent only after the user has given valid consent through a consent management interface.
Current implementation status: A consent management system has not yet been installed. Accordingly, this statement describes an intended safeguard rather than an already operational restriction.
Until appropriate consent controls are implemented and verified, the use of YouTube embeds may not meet all applicable data protection requirements.
10. YouTube Music Search and Server-Side Requests
Hit or Miss allows players to search for music and select songs for the game.
Search queries are sent to a server-side function operated through our Supabase backend. This function uses a technical integration to retrieve music-related search results from YouTube services.
Search queries, related technical request data and returned video information may be processed for the purpose of displaying relevant search results.
Selected video identifiers and associated song information may be stored as part of the relevant game session.
The legal basis for game-related search processing is Article 6(1)(b) GDPR, where applicable, or Article 6(1)(f) GDPR.
The exact processing by the external search service, including any transferred identifiers, must be verified against the deployed integration.
11. Cookies and Consent Management
Our website and its integrated third-party services may use cookies, local storage or comparable technologies.
Some technologies are required to provide essential functions, including maintaining authentication sessions and operating the multiplayer game.
Other technologies, particularly those associated with embedded third-party media or advertising, may require your prior consent.
Under Section 25 TDDDG, storing information on or accessing information from a user's device generally requires consent unless a statutory exception applies.
We intend to implement a consent management system that allows visitors to accept or reject non-essential technologies and subsequently change their preferences.
Current status: No consent management platform has yet been deployed. We therefore cannot currently identify a specific consent provider, claim that choices are being stored, or provide an operational consent-settings link.
This section must be updated once a consent management platform has been installed and tested.
12. Advertising – Planned Google Integration
We intend to finance Hit or Miss through advertising, potentially including Google advertising services such as Google AdSense.
At the date of this policy, Google advertising has not yet been activated.
No claim is made here that Google advertising cookies, personalized ads or advertising profiles are already in use.
Before advertising is activated, this Privacy Policy must be updated to describe the actual advertising services, data recipients, purposes, legal bases, applicable international transfers and storage technologies.
Where required by law and applicable Google policies, the appropriate consent management solution must be implemented before advertising technologies are activated.
13. Email Enquiries
If you contact us at hitormiss.info@web.de, we process your email address, any name you provide and the contents of your enquiry.
We use this information only to handle your request, communicate with you and meet any applicable legal obligations.
The legal basis is Article 6(1)(b) GDPR for contractual enquiries or Article 6(1)(f) GDPR for general correspondence.
Email communications are handled using our email service provider and may involve processing by that provider.
We retain correspondence for as long as necessary for the relevant purpose, subject to applicable statutory retention obligations.
We do not operate a separate website contact form at present.
14. Disclosure of Data
We disclose personal data only where necessary for operating Hit or Miss, providing services requested by users, fulfilling legal obligations or pursuing legitimate interests in accordance with applicable law.
Relevant recipients may include our hosting provider, backend provider, analytics provider, email service provider and third-party media services.
Within a game room, information such as nicknames, song submissions, votes, guesses and scores may be shared with other participants.
Where an external provider acts as a processor on our behalf, we are responsible for ensuring that an appropriate data processing agreement is in place where legally required.
15. International Data Transfers
Some service providers and their subprocessors may process personal data outside the European Union or European Economic Area, including in the United States.
Where transfers are subject to Chapter V GDPR, the relevant safeguards may include an applicable adequacy decision, the EU–US Data Privacy Framework where applicable, standard contractual clauses or other legally permitted transfer mechanisms.
The applicable safeguards depend on the particular provider and processing activity.
We do not claim that all data processed through Hit or Miss remains exclusively within the European Union.
16. Data Retention
We retain personal data only for as long as necessary for the relevant processing purpose, unless applicable law requires or permits longer retention.
This may include authentication data, game-room records, nicknames, song submissions, votes, guesses, scores, technical information and analytics data.
The exact retention periods and any automated deletion processes for Supabase game records and anonymous accounts have not yet been confirmed.
We cannot currently guarantee that game data is automatically deleted when a room closes or a game ends.
The retention arrangements must be reviewed and documented. This section must then be updated with the actual retention criteria and, where appropriate, specific time limits.
Requests for deletion may be directed to the contact address listed above, subject to applicable legal obligations and technical requirements.
17. Data Security
We use HTTPS and TLS encryption for communications with the website and its connected services, where supported by the relevant providers.
We also use technical measures such as authentication controls, database access restrictions and access-management mechanisms intended to protect game-related data.
However, no internet-based system can guarantee absolute security.
18. Your Rights Under the GDPR
Subject to the applicable legal requirements, you have the following rights:
- Access (Article 15 GDPR): You may request information about personal data we process about you.
- Rectification (Article 16 GDPR): You may request correction of inaccurate personal data.
- Erasure (Article 17 GDPR): You may request deletion of personal data where the legal requirements are met.
- Restriction (Article 18 GDPR): You may request restriction of processing in certain circumstances.
- Data portability (Article 20 GDPR): You may request applicable data in a structured, commonly used and machine-readable format.
- Objection (Article 21 GDPR): You may object to processing based on legitimate interests on grounds relating to your particular situation.
- Withdrawal of consent (Article 7(3) GDPR): You may withdraw consent at any time with effect for the future.
Where data processing is based on consent, withdrawal does not affect the lawfulness of processing carried out before withdrawal.
You also have the right to lodge a complaint with a competent data protection supervisory authority.
For questions or requests, contact hitormiss.info@web.de.
19. Right to Object
Where personal data is processed under Article 6(1)(f) GDPR, you have the right to object to that processing on grounds relating to your particular situation.
Following an objection, we will stop the relevant processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or unless processing is necessary for the establishment, exercise or defence of legal claims.
Where personal data is processed for direct marketing, you may object at any time. The relevant processing for direct marketing purposes must then cease.
20. Changes to This Privacy Policy
We may update this Privacy Policy when the operation of Hit or Miss changes, when new services are introduced or when legal requirements change.
The version published on this website will reflect the applicable privacy information.
Material changes, such as the activation of Google advertising, the introduction of a consent management system or changes to backend data processing, will be reflected in an updated version of this policy.
Privacy contact: hitormiss.info@web.de
Website: Hit or Miss