Privacy policy

What this site does with your data, why, and what you can do about it. Written to satisfy Articles 13 and 14 of the GDPR — and kept as short as the one thing that needs explaining, the advertising, allows.

Last updated: 7 October 2026

The short version

Qanat itself keeps nothing about you. Your puzzle progress never leaves your browser, the game runs no analytics, and the only thing you can actively send us is feedback, and only if you fill in the form.

The site is paid for by advertising from Google. That runs only if you agree to it in the dialogue shown on your first visit. You can refuse there with one click, the game is the same either way, and you can change your mind at any time through Privacy settings. Until you have decided, no advertisement is requested and nothing is stored on your device for it.

The rest of this page is the detail the law requires.

Who is responsible

The controller for the processing described here, within the meaning of Article 4 (7) GDPR, is:

Company: Finais Consulting UG (haftungsbeschränkt)
Address: Am Steinernen Stock 1
60320 Frankfurt am Main
Germany
Email: hello.qanatgame@outlook.com

The company's register entry and authorised representative are set out in the legal notice.

We are not required to appoint a data protection officer, and have not appointed one. Use the address above for any question about your data.

When you open a page

Like every web server, the server that delivers this site records each request. That log contains:

your IP address
the date and time of the request
the page or file requested, and whether it was delivered
the amount of data transferred
the browser and operating system your browser reports
the page you came from, if your browser sent one

Why: to deliver the site at all, to keep it working, and to recognise and defend against attacks and abuse. Legal basis: Article 6 (1) (f) GDPR. Our legitimate interest is operating a website that is available and not being attacked. Kept for: only as long as our hosting provider needs them for those purposes. We keep no copy of our own, and the provider deletes them automatically once that period is over.

This data is never used to identify you personally and is never combined with anything else.

What is stored on your device

The game keeps your progress in your own browser, using local storage. It is not a cookie, it is not sent to us, and we cannot read it. It stays on the device you played on. These are the entries it writes:

qanat.progress.v3 — which puzzles you have finished, the score and stars you got, the channel layout you dug, and your daily streak.
qanat.skin — which interface skin you last chose.
qanat.feedbackQueue — feedback that could not be sent because you were offline, held so it can be retried on your next visit. It is deleted as soon as it goes through.
qanat.adFooterClosed — that you dismissed the bottom banner. Session storage, so it is gone when you close the tab.

Why: so the game remembers where you are. Legal basis: § 25 (2) no. 2 TDDDG — this storage is strictly necessary to provide the service you asked for, so no consent banner is required for it — together with Article 6 (1) (f) GDPR.

You can delete all of it at any time by clearing the site data for this domain in your browser settings. Doing so erases your puzzle progress, because that is the only place it exists.

When you send feedback

The feedback page is the one place on this site where you can send us something. If you use it, we receive:

the star rating you chose, if you chose one
the text you wrote, if you wrote any
the address of the site it was sent from, and the time it was sent
your IP address, unavoidably, as part of the request itself

The submission is forwarded to us by email. Why: to read it and improve the game. Legal basis: Article 6 (1) (f) GDPR — our legitimate interest in understanding how the game is received, and yours in being able to tell us. Kept for: as long as the point you raised is still relevant, and at most 24 months.

Filling the form in is entirely voluntary and nothing in the game depends on it. The form asks for no name and no email address — so please do not write anything in the message box that you would not want us to have.

Advertising: Google AdSense

This site shows advertisements from Google AdSense, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). That is what pays for the game. Google is not a service provider working on our instructions: for the advertising it decides for itself what it does with the data, as a controller in its own right. We are jointly responsible with Google for what is collected on this site; what Google does with it afterwards is Google's own processing, described in Google's privacy policy linked below.

Nothing runs before you decide

On your first visit, a dialogue asks whether Google and the advertising partners it lists may store identifiers on your device and read them again, in order to show you advertising, and for which of the purposes it names. It has a button to consent, a button to refuse that is just as easy to find, and a page of options in between. Until you have made a choice, no advertisement is requested and no advertising identifier is stored.

Loading the dialogue itself does contact Google's servers, which receive your IP address and the technical data every web request carries, as described under "When you open a page". That is the one request to Google that happens before you decide, and it exists only to ask you. Legal basis: Article 6 (1) (f) GDPR, our legitimate interest in obtaining a valid consent at all, and yours in being asked before anything else happens.

If you consent

Google and the partners listed in the dialogue store cookies and similar identifiers on your device and read them again on later visits. Third party vendors, including Google, use these cookies to serve ads based on your prior visits to this website or to other websites; Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and to other sites on the internet. With each advertisement, Google receives your IP address, the page you are on, the browser and device data your browser reports, an approximate location derived from the IP address, and the identifiers it stored.

Why: to show advertising, to personalise it and to measure it, as far as you agreed to each of these in the dialogue, and to pay for the game. Legal basis: your consent — § 25 (1) TDDDG for storing identifiers on your device and reading them, and Article 6 (1) (a) GDPR for the processing of the data. Kept for: the identifiers have lifetimes that Google sets and documents at the links below, up to thirteen months for its advertising cookies; your choice in the dialogue is kept for at most thirteen months, after which you are asked again.

If you refuse

Google stores nothing on your device and builds no profile of you. Google may still show an advertisement chosen from the page alone, without any identifier; that request carries your IP address like any other web request and nothing else, on the basis of Article 6 (1) (f) GDPR. Your refusal is remembered in your browser so that you are not asked on every page (§ 25 (2) no. 2 TDDDG: remembering a choice is necessary to respect it).

Changing your mind

Privacy settings reopens the dialogue, here and in the footer of the game. Withdrawing your consent is as easy as giving it and takes effect from that moment; what was done before remains lawful (Article 7 (3) GDPR). You can also delete Google's cookies in your browser settings at any time, and turn personalised advertising off for your Google account at adssettings.google.com.

Where the data goes

Google Ireland Limited passes data to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States, and to other Google companies, so your data is transferred to a third country. Google LLC is certified under the EU–U.S. Data Privacy Framework, so the transfer rests on the adequacy decision the European Commission adopted on 10 July 2023, and Google additionally offers the standard contractual clauses under Article 46 (2) (c) GDPR. The partners listed in the dialogue have their own policies, linked from there.

More from Google: how Google uses information from sites that use its services, Google's privacy policy, and how Google uses cookies in advertising. You can opt out of personalised advertising by many vendors at once at youronlinechoices.com (Europe) or aboutads.info.

What this site does not do

No analytics and no tracking of our own. There is no Google Analytics, no pixel, no fingerprinting, and we keep no profile of you anywhere.
No cookies of our own. The only cookies on this site are the advertising ones described above, and only if you consented to them.
No third-party requests apart from the advertising. The fonts, the stylesheets, the scripts and the puzzles are all served from this domain — in particular, no request goes to Google Fonts. Google's advertising, described above, is the one exception, and the game itself is complete without it.
No accounts. There is nothing to sign up for.

Who else processes your data

We use two service providers. Both act only on our instructions, under a data processing agreement pursuant to Article 28 GDPR.

Hosting: Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, United States
Delivers this website and keeps the server logs described above.
Email delivery: Plus Five Five, Inc., trading as Resend, 2261 Market Street #5039, San Francisco, CA 94114, United States
Delivers feedback submissions to us as email.

Both providers are based in the United States, so your data is transferred to a third country. Both state that they are certified under the EU–U.S. Data Privacy Framework, so the transfer rests on the adequacy decision the European Commission adopted on 10 July 2023, which finds that the United States affords an adequate level of protection to data transferred to organisations certified under it. Our data processing agreements with both providers additionally incorporate the standard contractual clauses adopted by the Commission under Article 46 (2) (c) GDPR, decision 2021/914.

You can ask us for a copy of those clauses at any time. Write to the address at the top of this page and we will send them to you.

Your rights

You have, in respect of the data we hold about you, the right to:

access it, and to receive a copy (Article 15)
have it corrected if it is wrong (Article 16)
have it deleted (Article 17)
have its processing restricted (Article 18)
receive it in a portable form, or have it sent to someone else (Article 20)
withdraw any consent you have given, at any time and with effect for the future (Article 7 (3)) — for the advertising, through Privacy settings

Write to the address at the top of this page. Exercising any of these rights is free and costs you nothing.

We will answer within one month of receiving your request, as Article 12 (3) GDPR requires. If a request turns out to be unusually complex we may take up to two further months, and we will tell you within that first month if we need them, and why.

Your right to object

Where we process your data on the basis of our legitimate interests under Article 6 (1) (f) GDPR — which covers the server logs, the feedback form and the loading of the consent dialogue described above — you have the right to object to that processing at any time, on grounds relating to your particular situation (Article 21 (1) GDPR).

If you object, we will stop processing your data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or unless we need it to establish, exercise or defend legal claims. An objection is made informally: an email to the address above is enough.

Complaining to a supervisory authority

If you believe we are handling your data unlawfully, you can complain to a data protection supervisory authority — in the member state where you live, where you work, or where the suspected infringement took place (Article 77 GDPR). The authority responsible for us is:

Supervisory authority: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Gustav-Stresemann-Ring 1
65189 Wiesbaden
Germany

Automated decision-making

We do not use your data for automated decision-making or profiling within the meaning of Article 22 GDPR. The game scores your puzzle; it does not draw conclusions about you. If you consent to personalised advertising, Google builds an advertising profile to choose which advertisement you see; that is Google's processing, described above, and no decision with a legal or similarly significant effect on you follows from it.

Do you have to provide any of this?

No. The server log is a technical consequence of your browser requesting a page, and cannot be avoided by any website. Everything else is optional: you can play every puzzle without sending us anything at all, and without agreeing to the advertising.

Changes to this policy

We will update this page when the site changes — as this version was, before the advertising was switched on. The date at the top says when this version was published. The current version always applies.