TAPSIXTY is a game site, not a data business. Playing requires no account and sends us nothing. Your scores live in your own browser. If you create an account, we store your email, display name and scores so they can sync. Advertising and third-party analytics cookies run only if you click "Accept" on the consent banner — rejecting changes nothing about the games. We also keep our own anonymous, cookie-free tally of which games get played (no IP, no identifier, nothing that points to you). You can see, download, or delete everything we hold about you.
The operator of TAPSIXTY (tapsixty.com) is the data controller for any personal data processed here. Contact for all privacy matters: contact@tapsixty.com.
| Data | Where it lives | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|---|
| Scores, streak, settings, display name (no account) | Your browser only (localStorage). Never transmitted to us. | Making the games work: personal bests, history charts, themes | Not applicable — this data never reaches us. Storage is strictly necessary for the service you request (ePrivacy exemption). |
| Email address, hashed password, display name, per-game results (with an account) | Our database at our hosting provider | Providing the account you asked for: sign-in and syncing your history across devices | Contract (Art. 6(1)(b)) — we can't provide accounts without it |
| Advertising cookies & identifiers (Google AdSense) | Google's systems | Funding the site through ads | Consent (Art. 6(1)(a)) — only after you click "Accept" |
| Anonymous usage statistics (Google Analytics 4, IP anonymised) | Google's systems | Understanding which tests are popular so we can improve | Consent (Art. 6(1)(a)) — only after you click "Accept" |
| Anonymous usage events (which page is viewed, which game is started/finished and its score, share clicks, daily-challenge plays) — no cookies, no IP, no user-agent, no identifier, just counts | Our own database (first-party) — never shared with a third party | Seeing which tests are used so we can improve them, without tracking anyone | Legitimate interest (Art. 6(1)(f)) — the data is anonymous and stores nothing that could identify you, so it needs no cookie and no consent |
| Server logs (IP address, request time) kept briefly by our hosting providers | Hosting infrastructure | Security, abuse and denial-of-service protection | Legitimate interest (Art. 6(1)(f)) — keeping the service online |
Passwords are stored only as strong one-way hashes (PBKDF2-SHA256) — we cannot read them. We never sell personal data.
| Name | Type | What it does | Consent needed? |
|---|---|---|---|
| sixty.v1 (localStorage) | Functional | Your scores, streak, theme and settings on this device | No — strictly necessary for the service |
| sixty.session (localStorage) | Functional | Keeps you signed in (exists only if you sign in) | No — strictly necessary for the sign-in you requested |
| Google AdSense cookies | Advertising | Ad delivery, frequency capping, personalisation | Yes — set only after "Accept" |
| Google Analytics cookies | Analytics | Anonymous visit statistics | Yes — set only after "Accept" |
Your consent choice: the banner offers "Accept all" and "Reject non-essential" as equal choices; your decision is remembered on this device. Change it any time in Settings → Privacy → Change choice — withdrawing consent is as easy as giving it and takes effect immediately (the page reloads so no tracker keeps running). Until you choose, no advertising or analytics code loads at all, and we send Google Consent Mode v2 "denied" signals by default.
Fonts are self-hosted — visiting TAPSIXTY makes no request to Google Fonts or any other font CDN.
Some providers (Google, US-based hosts) may process data outside the EU/EEA. Where that happens it relies on the EU–US Data Privacy Framework and/or Standard Contractual Clauses.
You have the right to access, rectify, erase, export ("data portability"), and restrict or object to the processing of your personal data, and to withdraw consent at any time without affecting prior processing. In practice:
You also have the right to lodge a complaint with your local data protection authority (in the EU, see the EDPB members list).
TAPSIXTY is a general-audience site and does not knowingly collect personal data from children. Accounts are not intended for users below the age at which they can consent to data processing in their country (13–16 in the EU depending on member state). If you believe a child has created an account, email us and we will delete it.
All traffic is encrypted (HTTPS). Passwords are hashed, never stored or transmitted in plain text. API access is authenticated per user and rate-limited; users can only ever access their own data.
We'll update the date at the top when this policy changes and highlight significant changes on the home page. Continued use after changes means the new version applies.
contact@tapsixty.com — privacy questions, rights requests, or anything unclear above.