Privacy
Last updated 6 September 2026. This notice covers roughly.is and its game subdomains (howbig.roughly.is, where.roughly.is and the others). It is written for the Swiss Federal Act on Data Protection (FADP) and, for visitors in the EU and EEA, the GDPR.
Who is responsible
SIGNEX, Esteban Martin
Wolfganghof 19a, 9014 St. Gallen, Switzerland
esteban@signex.ch
Switzerland is the country of the controller. There is no separate data protection officer and no EU representative; write to the address above for anything in this notice.
The short version
No account, no cookies, no advertising, no sale of data. Your rounds stay in your browser. We count visits and rounds and watch how the pages are used without knowing who you are, and without ever seeing what you type. The only personal data we ever hold is what you send us through the feedback or newsletter form.
1. Delivering the pages (hosting)
The site is served by Netlify, Inc., 512 2nd Street, San Francisco, CA 94107, USA. When your browser requests a page, Netlify receives the technical data every web server needs: your IP address, the page requested, date and time, browser type and the referring page. Netlify uses it to deliver the page, to keep the service secure and for short-lived server logs. Purpose and legal basis: delivery of the site you asked for and our legitimate interest in running it safely (Art. 6(1)(f) GDPR; Art. 31(1) FADP). Netlify participates in the EU-U.S. and Swiss-U.S. Data Privacy Framework and offers standard contractual clauses; its own notice is at netlify.com/privacy.
2. Your rounds and results
Each game keeps today's rounds, your answers and your streak in your browser's local storage. That data never leaves your device through us. Clearing the site data in your browser deletes it. Archive days and challenge links work through the address bar (the day and a result in the link), not through a server.
3. Counting play (Supabase)
When a round is revealed, the game sends a small record to a database we run at Supabase, hosted in Frankfurt, Germany (Supabase, Inc.; data region EU): the game, the day, the round number, the result text (for example "1.45x too low" or "748 km"), whether it was an archive day, and a random session number that exists only while the page is open. No name, no account, no cookie, no identifier stored on your device. We use this to see which games are played, how often and how far off guesses land, and later to replace the simulated player curves with real ones. Supabase keeps its API logs, which include IP addresses, for a short time for security. Legal basis: our legitimate interest in understanding and improving the games (Art. 6(1)(f) GDPR; Art. 31(1) FADP). The records cannot be traced to a person, so we cannot single out or delete "your" rows.
4. Usage measurement (PostHog)
We measure how the site is used with PostHog, on PostHog's EU cloud in Frankfurt, Germany (PostHog, Inc.; EU hosting). PostHog is configured without cookies and without persistent identifiers: nothing is written to your device. It receives page views, clicks and the same game events as above, plus technical data such as browser, operating system, screen size, language and a coarse location (country, region) derived from the IP address. We have set the project to discard the IP address after that derivation. To understand where the games are confusing, PostHog also records how a page is used during one visit: taps, scrolls and the layout of the page. It never records what you type: every input field is masked before anything leaves your browser, and the recording ends with the page. The game events additionally carry two small values that live only on your device, whether this device has played on an earlier day and the length of the current streak, so that we can see how many players come back without knowing who they are. There is no cross-site tracking. Legal basis as in section 3. If you use a browser setting or extension that blocks measurement, the games work exactly the same.
5. Feedback and newsletter forms
The two forms at the bottom of the start page are handled by a small function on our host (Netlify, see section 1) that passes your entry to Brevo (Sendinblue SAS, 7 rue de Madrid, 75008 Paris, France), the mailing service we use. We receive what you type: for feedback the message, which Brevo delivers to us as an email; for the newsletter your email address, which Brevo stores in our contact list together with the time of sign-up and the note that it came from roughly.is. Brevo processes this data in the European Union. We use the message to improve the games and the email address only to send the newsletter you asked for; nothing else, and we do not pass it on. Legal basis: your consent when you submit the form (Art. 6(1)(a) GDPR), which you can withdraw at any time through the unsubscribe link in every newsletter or by writing to esteban@signex.ch. We then delete the address from the list. Feedback messages are deleted once dealt with, at the latest after 12 months.
6. What we do not do
No cookies of any kind. No advertising networks, no social media plug-ins, no font networks (the typeface Onest is served from this site), no embedded video. Links to Wikipedia, Wikidata and other sources open those sites, which have their own notices.
7. Data abroad
Supabase and PostHog process data for us in Germany, and Brevo in France; both are countries the Swiss Federal Council recognises as providing adequate protection. Netlify processes data in the USA on the basis of the Swiss-U.S. and EU-U.S. Data Privacy Framework and standard contractual clauses.
8. Your rights
Under the FADP and, where it applies, the GDPR, you can ask us what personal data we hold about you, ask for it to be corrected or deleted, object to processing based on legitimate interest, and receive the data you gave us in a portable form. Write to esteban@signex.ch. Because the measurement data in sections 3 and 4 cannot be linked to a person, those requests can only concern the forms in section 5. You may complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch) or, in the EU, to your national supervisory authority.
9. Children
The games are suitable for all ages and collect no personal data from anyone. The newsletter is meant for adults; if a child has subscribed, write to us and we remove the address.
10. Changes
We update this notice when the site changes, for example when real player data replaces the simulated curves or when the newsletter moves to a mailing service. The date at the top tells you the current version.