Privacy policy

Last updated: 19 October 2026.

The Short Version

• You can play without an account. Then we keep only a count of the requests from your IP address, for a short time.
• An account stores your email address, a display name and a scrambled form of your password.
• The words you type into a quiz you create are sent to OpenAI, which can process them in the United States, and are kept on our server.
• Your quizzes are private unless you share them or submit them to the public game.
• The site runs on servers in Frankfurt, Germany, rented from a company in the United States. Data can therefore reach the United States.
• You can delete your account yourself at any time. A forgotten password cannot be recovered.
• Accounts are for people aged 16 or over. Younger players can play without one.

Who Runs This Site

Semantics.fun is run by one person, named with a postal address on the Legal notice. “We” on this page means that person, who is responsible for your data here (the “controller” under the GDPR). For anything about your data, write to the address on the legal notice.

If You Only Play

Playing needs no account and sets no cookie. It stores nothing in your browser, unless you switch between “Pick one” and “Rank them all” on a start screen: the site then remembers that choice on your device (see One cookie and two browser entries). Your answers and your place on the scale stay in the page you have open: they are not sent to our server, and they are gone when you reload. Playing sends nothing to OpenAI.

The “Share” buttons (under a result, on your cover and beside a collection) do nothing until you press them. They open a window with a link to copy, for a result or your cover also a short text (the quiz, the word you circled or that you ranked them all, and your figure on it), and for a public quiz or a collection the code to show it on another website. You copy what you want, or hand it to your device’s own share function. A result’s link opens the quiz on that result: its address says which option was picked, or in which order the options were ranked, as numbers, and nothing about who did it. Nothing in that window sends anything to our server, and it loads nothing from a social network. Where the text goes after that is your choice and the chosen app’s business.

Our database keeps, for a short time and under your IP address, only counts: of quiz fetches, of attempts to log in or sign up, and of reports (see IP addresses), not which quizzes you fetched or played. Each page view is counted (see Page views), and, as on every website, your request reaches our hosting company (see Hosting).

If You Create an Account

Accounts are for people aged 16 or over. We do not ask for a date of birth or check anyone’s age, so we rely on you here. If we learn that an account belongs to someone under 16, we delete it. Younger players can play without an account: on this site, through a link to a collection or a single quiz that a teacher or someone else gives them, or where a quiz is shown on another website. For them as for every player, this site stores nothing on the device but a playstyle they switch to themselves (never inside a frame on another website), answers stay in the page, and our server keeps only the short-lived count of requests from the IP address (see IP addresses). The request also reaches our hosting company, and on this site, though not inside a frame on another website, the page-view script is loaded (see Page views).

An account is needed to create quizzes and collections. It stores:

• your email address, which is your login name;
• the display name you chose;
• a scrambled form of your password (a bcrypt hash). The password itself is never stored, and nobody can read it, us included;
• whether the account is an ordinary one, an editor’s (which may write notes for its own quizzes’ results) or an admin’s;
• when the account was created.

An account stays until it is deleted, by you or by us when you ask; an unused account is not removed after some time.

For each login the server keeps a scrambled form of the cookie’s value, when you logged in, roughly when the login was last used, and when it ends; no IP address and nothing about your browser or device. A login ends when you log out, when the account’s password is changed (the device you change it on stays logged in), after about a week without use, and 90 days after you logged in at the latest. An account keeps its 20 most recent logins: one more ends the oldest.

The site sends no email by itself, so there is no password recovery either. We write to you only to answer a message you sent us. Your address is used to log you in and to recognise you when you write to us.

The sign-up form refuses an email address that already has an account, and says so. Anyone who types your address there can therefore learn that it has an account here.

The site’s admins (the operator, and anyone the operator makes an admin) can see every account’s email address, display name, role and creation date, every account’s quizzes and collections with the collections’ share links, and the reports visitors made about quizzes with what their senders wrote (see Reporting a quiz). They can set a new password for an account, change its role (ordinary, editor or admin), and delete any account, quiz or collection; removing a user’s quiz or collection leaves its author a notice (see When we remove a quiz). They cannot see a password. We do not set a new password because somebody asks for one (see A forgotten password).

One Cookie and Two Browser Entries

The first two are set only when you log in; the third only when you switch the playstyle yourself. A visitor who does neither gets none of them. A quiz shown inside a frame on another website sets none of them.

This is why the site shows no cookie banner: the first two exist only to keep you logged in, which you ask for by logging in, and the third only to keep a setting you chose yourself on the page; the law exempts from consent what is strictly necessary for a service a person has expressly asked for (in Germany, § 25 (2) no. 2 TDDDG). None of them is used for statistics or advertising. The page-view script stores nothing on your device, according to the company that makes it (see Page views).

Your Quizzes and Collections

For a quiz you save, we store its keywords and answer options, a second wording that differs by one word if you add one, the results computed for them, its categories and themes, its status, its share link, how it is played and when it was created. If you set how a quiz’s answer is revealed (the AI’s clearly closest options, or a phrase for comparison), we store those settings and, for a phrase, the distances computed for it. If you are an editor, we also store the notes you write for your quizzes’ results, and each earlier version of them with the day it was replaced. Earlier versions are deleted with the quiz, including the version of notes an admin removed. For a collection, we store its name, description and share link, which AI models it shows first if you chose any, how it is played (players choose, one playstyle for every quiz, or each quiz’s own) and how each of its quizzes is played if you set that, and when it was created; for one you fill by hand, also which quizzes it holds in which order. For one you fill by tags (the categories you give your quizzes), we store the tags you chose and whether it also takes in the public game’s quizzes with those tags; which quizzes it holds is worked out each time it is opened.

Your quizzes and collections are private: you see them, and so can the site’s admins. They reach other people in three ways only, each your choice:

• You share a quiz’s own link. Every quiz has a link of its own, shown beside it on My Quizzes. Anyone who has the link can play that one quiz, whatever its status, even while it is private; nobody can guess the link, and it opens no other quiz of yours. The page it opens shows the quiz with both its wordings if it has two, its results, any notes you wrote for it, and its categories and themes and, unless the quiz is in the public game, a note that a user made it and that we have not reviewed it. It shows neither your name nor your email address, nor the quiz’s status or when it was made. The link works until you delete the quiz or your account, or replace it: “New link” beside the quiz ends the old one at once, wherever it was used, for good (a quiz that is in the public game keeps its link). A quiz’s own link cannot be used to show it inside a frame on another website. A collection’s link does not pass on the own links of the private quizzes in it.
• You share a collection’s link. Anyone who has the link can see the collection’s name and description and play its quizzes, private ones included. The link of a collection filled by tags opens every quiz of yours with one of its tags, private ones included, and every quiz you give one of those tags later; the collection’s page says so beside the link. The link shows neither your name nor your email address. It works until you delete the collection or your account, or replace it: “New link” on the collection’s page ends the old one at once, wherever it was used, for good. The same link can show the collection inside a frame on another website (see Quizzes on other websites), where everyone who sees that page can play its quizzes, private ones included.
• You submit a quiz to the public game. An admin reads it. If it is approved, a copy of it joins the public game, where everyone can play it, without your name. The server notes which account submitted it, visible to admins only and removed when you delete your account. The copy stays in the game if you later delete your quiz or your account; write to us if you want it taken out. If a quiz is declined, the admin can add a reason, which you and the admins can see.

The collections offered to everyone on the Play page are made by the site’s admins, hold quizzes of the public game only and belong to no account.

Please do not put personal information, yours or anyone else’s, into a quiz or into a collection’s name or description.

Reporting a Quiz

A quiz outside the public game (a user’s quiz, played through its own link, through a collection’s link or inside a frame on another website) carries a note that a Semantics.fun user made it and that we have not reviewed it, with a link to report it. The link opens our report page in a new tab, a page of this site like any other, the page-view script included (see Page views).

There you pick one of five reasons and confirm that you report in good faith. You can also explain the report and give your name and email address; all three are optional. The report is sent without your login. We store with it which quiz it is, the collection it was seen in (none, if you came through the quiz’s own link), the reason, what you wrote, your name and email address if given, and the day (not the time). We do not store with it your IP address, your account or anything about your browser. Separately, reports from your IP address are counted for one hour (see IP addresses).

We use what you write to assess the report, and your name and email address only to confirm receipt and tell you what we decided. The site sends no email: an admin writes to you by hand from the address on the legal notice, so your address and our exchange also sit in that mailbox. Without an email address, you do not hear back. Please write nothing personal into a report that it does not need.

Admins see each reported quiz with its author, the collection it was reported through with its owner (or that it was reported through its own link), and every report with what its sender wrote. A report is deleted, with your words, name and email address, when an admin has dealt with it, when the quiz or the collection is deleted, and after six months at the latest if nobody has dealt with it; nothing of it is kept in the site’s database. If the owner deletes the quiz or the collection first, you do not hear back. The author is never shown the report or told who sent it; if the quiz is removed, the author is told why (see When we remove a quiz).

When We Remove a Quiz

Admins can remove a user’s quiz, only the notes shown with it, or a collection that breaks our Rules or the law, after a report or on their own. The author or owner then finds on My Quizzes (a removed collection also on My Collections) a notice saying what was removed, on which ground, with the admin’s note if any, whether a report led to it, and how to object. It names nobody who reported anything. We store with it your account, what was removed (the quiz’s keywords, with whether only its notes were removed, or the collection’s name), the ground, the note, whether a report led to it, and the day. It is deleted when you dismiss it, after six months at the latest, and with your account. “Download my data” includes it.

What Is Sent to OpenAI

The game compares your intuition with AI language models made by OpenAI. When you create a quiz, our server sends text you typed to OpenAI:

• When you generate or save a quiz, or add a second wording to one: its keywords (or the second wording) and answer options, which OpenAI’s model turns into the numbers the results are computed from.
• When you ask for an AI suggestion: the type of quiz, the keywords typed so far, the categories and themes you chose or wrote, and your “creative angle”.
• When you set a phrase for comparison on one of your quizzes: the phrase and the quiz’s answer options, and five fixed phrases about people that the comparison is measured against.

The request comes from our server, not your browser, and contains nothing that identifies you or your account: no name, email address or IP address.

OpenAI handles the text on our behalf, as a processor, under the data processing agreement that is part of its terms. Those terms say that for a customer in the European Economic Area, which we are, the contract and that agreement are with OpenAI Ireland Ltd. Our invoices name OpenAI OpCo, LLC, a company in San Francisco, in the United States. OpenAI states, and we cannot check:

• OpenAI’s agreement has every customer, whichever OpenAI company the contract is with, instruct OpenAI Ireland Limited to process data that falls under the data protection law of the European Economic Area. Where that company passes such data to other OpenAI companies or to anyone else outside the European Economic Area, it does so under agreements that contain the European Commission’s standard contractual clauses, or on an adequacy decision of the European Commission.
• OpenAI does not use text sent this way to train or improve its models unless the customer explicitly agrees. We have not agreed.
• OpenAI keeps the text for up to 30 days to detect abuse, and longer where the law requires it or where OpenAI considers it necessary to protect its services or other people from harm.

We found no statement of OpenAI’s on where the text is processed. OpenAI is a group based in the United States, our invoices name its United States company, and its offer to keep processing in a region outside the United States is only for customers it has approved, and this site does not use that offer. So expect the text to be processed in the United States: our conclusion, not OpenAI’s words.

Our server keeps each word or phrase with the numbers OpenAI returned for it, so the same text is not sent and paid for twice. This store holds the text, the model’s name and when the entry was last used, and nothing that says who typed it, so an entry is not removed when you delete the quiz or your account. The store is limited in size; when it is full, the entries unused longest are dropped.

For each paid request we record the time, the model, the amount of text and the estimated cost, to know what the site spends and, when a monthly budget is set, to pause paid requests for the day once the day’s share of it is used up. That record contains no text and no account.

Playing a quiz sends nothing to OpenAI: the results are already stored with it.

IP Addresses

The site itself stores your IP address in one place only: counters that keep one network from overloading the site and slow down password guessing and mass sign-ups.

• Loading the game: each time a page fetches quizzes, on this site or inside a frame on another website, the request is counted for 5 minutes per IP address. The counter holds the address and a number, nothing about which quiz or collection was fetched, and nothing about your account if you are logged in.
• Login attempts are counted for 15 minutes, per IP address and together with a scrambled form (a hash) of the email address typed. That is not the address itself, but the same address always gives the same value, so somebody who had these counters and guessed an address could check the guess. This happens for every attempt, also when no account with that address exists.
• Sign-up attempts are counted for one hour per IP address.
• Reports of a quiz are counted for one hour per IP address, apart from the reports themselves (see Reporting a quiz).

An hourly clean-up deletes each counter once its time is over. Of an IPv6 address only the network part is stored. Your IP address is not stored with your account, your logins, your quizzes or a report.

While you are logged in, the server also counts under your account the quizzes you generated and saved and the AI suggestions you asked for in the last hour and 24 hours, the new share links you asked for and the downloads of your data in the last hour, and wrong passwords typed on the account page in the last 15 minutes. These counters are deleted with your account.

Page Views

To see how many people use the site, every page of the site itself, the pages for teachers included, loads a small script from Simple Analytics, a separate company in the Netherlands. Your browser fetches it from Simple Analytics’ servers, which, as with any request on the web, receive your IP address and details of your browser.

Simple Analytics states that it keeps its data on servers in the Netherlands and that the data stays in the European Union; that it sets no cookies, stores nothing in your browser, does not collect or store IP addresses, does not follow individual visitors, and by default leaves out browsers that send “Do Not Track”; and that it records the page’s address (without anything after a question mark), the time of the visit, the site you came from, whether the visit counts as a new one (worked out from the site you came from), campaign parameters in the link you followed, the kind of browser and device, the browser’s language, the size of your screen and window, the country (worked out from your time zone), the time spent on the page and how far you scrolled. These are its own statements, which we cannot check; see its documentation.

We have set the script not to report the address of shared-collection pages, the pages of a quiz shared by its own link, the report page, account pages or admin pages, so the address of a share link is not passed on. The pages made for a frame on another website (see Quizzes on other websites) do not load the script at all. Present mode shows a collection on one screen for a class: its address names the collection only after the “#”, which the script does not send, so its count holds no share link’s code; the show of hands a teacher types into it stays in the page, is sent nowhere and is gone when the page is closed.

Quizzes on Other Websites

Other websites can show a quiz or a shared collection from this site inside a frame. Your browser then fetches the quiz from our server, so your IP address reaches our server and our hosting company. Your browser may also tell us the address of the page you are on; the code we give website owners asks browsers not to send it, though an owner who changes the code can undo that. Our software does not read or record it, and the hosting plan we use keeps no log line per request, according to our hosting company’s documentation (see Hosting).

Inside the frame we set no cookie, store nothing in your browser and load no page-view script, and the quiz does not know whether you have an account here: its requests are sent without your login. Your answers stay in the page. The one thing we store is the counter described under IP addresses. The website around the frame is not ours and has its own privacy rules.

A quiz outside the public game carries a link to report it. The frame sends nothing when you follow it: the link opens our report page in a new tab, outside the frame (see Reporting a quiz).

When a quiz is shown in a frame on another website, our server tells Simple Analytics that it was shown, with the quiz’s number, or for a collection only that a collection was shown. It sends nothing about you: not your IP address, not your browser and not the page you are on. If your browser sends Do Not Track or Global Privacy Control, our server does not report the view. The links out of a frame carry “ref=embed”, so that we can see that a visit to this site came from a frame.

Hosting and Server Logs

The site and its database run on servers rented from Render (Render Services, Inc., 525 Brannan Street, Suite 300, San Francisco, CA 94107, United States), in Render’s region Frankfurt, Germany. Like any web host, Render handles every request to the site, so your IP address reaches it with each one. Render works on our behalf, as a processor, under the data processing agreement that is part of its terms.

The servers are in Frankfurt, but that does not keep the data in the European Union. Render is a United States company, its agreement says that its main processing takes place there, and the companies it uses in turn, listed on its website, are United States companies too. Data from this site can therefore reach the United States. As the safeguard for that, Render is certified under the EU-US Data Privacy Framework at the time of writing (October 2026), and its agreement falls back on the European Commission’s standard contractual clauses wherever that framework does not apply or is no longer available.

For the plan we use (“Hobby”), Render’s documentation says that the lines our software writes to its log (see below) are kept for 7 days, and that no log line is kept per request.

According to Render’s documentation, it also keeps continuous backups of the database, from which the database can be brought back to any moment of the past 3 days. So something deleted is gone from the live database at once, but a copy stays in those backups until they run out. Only the operator and the hosting company can restore a backup, and we would do that only to repair the database after a failure. An export of the database we make by hand is kept by Render for 7 days. Render states that the database’s storage is encrypted, and that it keeps no backups of a database that has itself been deleted.

The site’s own software writes no log line per request, and normally none that contains an IP address, a cookie or what you typed. When something fails unexpectedly, the error message is logged, and it can in rare cases quote part of a request; in particular, when a request to OpenAI fails, OpenAI’s error message can quote a word that was sent.

Why We May Handle This Data

European data protection law (the GDPR) asks for a legal basis for each use of personal data. For the main uses, ours are:

• Your account, your logins, your quizzes and your collections: they are needed to give you the service you signed up for (Article 6(1)(b) GDPR).
• The words sent to OpenAI: they are needed to compute the quiz or the suggestion you asked for (Article 6(1)(b) GDPR). OpenAI and our hosting company handle data on our behalf, as processors (Article 28 GDPR).
• The counters that hold IP addresses: our legitimate interest in keeping the site safe and available, by slowing down password guessing, mass sign-ups, floods of reports and overload (Article 6(1)(f) GDPR).
• Reports, what senders write in them, and removal notices: our legitimate interest in keeping the site free of unlawful or abusive quizzes (Article 6(1)(f) GDPR).
• Counting page views without cookies: our legitimate interest in knowing how much the site is used and which pages are read, in order to improve it (Article 6(1)(f) GDPR).

Where the basis is a legitimate interest, you have the right to object for reasons that arise from your own situation (Article 21 GDPR). To do so, write to the address on the legal notice.

Your Choices and Rights

Delete your account

On your account page, with your password and a typed confirmation. This erases at once, from the live database, your account, your logins, every quiz that is still yours, with its reveal settings, notes and their earlier versions, and your collections, with their share links, any reports of those quizzes or made through those collections, the notices about anything of yours that admins removed, and the counters kept under your account. The hosting company’s backups hold a copy for 3 days longer, and an export made by hand for 7 days (see Hosting); the same is true of a single quiz or collection you delete.

What stays, with nothing linking it to you: copies of your quizzes approved into the public game, with the reveal settings (and notes, if an admin kept them) copied with them, quizzes you published into it yourself if you are an admin, and the words of your quizzes in the store that saves repeated requests to OpenAI. The counters kept under your IP address, among them the login counter with the scrambled email address, are not removed with the account: they run out on their own (see IP addresses).

A forgotten password

A forgotten password cannot be recovered: the site sends no email, and we do not set a new password for you. What we can do is delete the account, so that you can register again with the same email address. For that, write to the address on the legal notice from the email address of your account. Your quizzes and collections are deleted with the account; quizzes of yours that were approved into the public game stay there, with nothing linking them to you.

See, correct or erase your data

Your account page shows the email address, display name and creation date we hold, and the site shows your quizzes and collections. On your account page, “Download my data” saves all of this as one file (JSON): your account’s details, every quiz of yours with its share link, its reveal settings, and your notes with their earlier versions, the public quizzes you submitted, your collections with their share links, and the notices about anything of yours that admins removed. The file also lists what it leaves out and why: the scrambled password, your logins, the short-lived counters, the words in the store of repeated requests to OpenAI, and reports about your quizzes, which hold their senders’ data, not yours.

You can ask us for a copy of everything stored about you, to correct something (email address and display name cannot be changed on the site itself yet), to erase something, including a quiz approved into the public game, to restrict what we do with your data, or to give you the data you provided in a common, machine-readable form. Write to the address on the legal notice.

Object

You can object to the uses that rest on a legitimate interest: the counters that hold IP addresses, reports and removal notices, and the counting of page views (see Why we may handle this data). Write to the address on the legal notice.

Complain

If you think your data is handled wrongly, you can complain to a data protection authority. The one responsible for us is the Berlin authority: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin, www.datenschutz-berlin.de. You can also turn to the authority where you live. We would be glad to hear from you first.