Privacy
BandyRules (bandyrules.com) is run by Weidhertz AS (org. no. 996 301 524), Dyrefaret 22, 1362 Hosle, Norway. Questions about your data go to post@weidhertz.com.
We collect as little as we can. You can read the rulebooks and take the public quiz without an account.
What we store, and why
| What | When | Why | How long |
|---|---|---|---|
| Your email address, and your name and profile picture if you sign in with Google | You create an account | To sign you in | Until you ask us to delete your account |
| A shortened, one-way hash of your IP address and a daily request count | You ask the AI a question | To enforce the free daily limit | 30 days |
| Your quiz answers and score, and a nickname if you choose one | You take the quiz | To show your result | Until you ask us to delete them |
| Leaderboard entry (nickname and score only) | You opt in and confirm you are 16 or older | To show the public leaderboard | Until you ask us to remove it |
| Question suggestions and reports, with an optional name and a hashed IP address | You send one | To review the suggestion and to limit spam | 12 months |
We do not store your AI conversations. We use no analytics, no advertising and no tracking cookies.
On your device
- A “lang” cookie remembers your chosen language.
- “theme” in local storage remembers light or dark mode.
- Sign-in cookies from Supabase keep you logged in.
- The app keeps a copy of pages on your device so the rulebook works offline.
All of these are needed for the site to work, so we do not ask for cookie consent.
Who processes data for us
| Service | What it does | Where |
|---|---|---|
| Vercel | Hosts the site | USA |
| Supabase | Database and sign-in | EU (Ireland) |
| OpenAI | Turns your AI question into a search vector | USA |
| Anthropic | Writes the AI answer from the rules | USA |
| Sign-in, only if you choose “Sign in with Google” | USA |
Your AI question text is sent to OpenAI and Anthropic to produce the answer. Do not include personal information in questions.
Transfers to the USA rely on the EU Standard Contractual Clauses, or the EU–US Data Privacy Framework where the provider is certified.
Legal basis (GDPR)
- Contract: your account and the AI feature.
- Legitimate interest: rate limiting and spam protection.
- Consent: the public leaderboard. You can withdraw consent at any time.
Your rights
You can ask to see, correct, export or delete your data, and you can object to processing. Write to post@weidhertz.com.
You can also complain to your data protection authority; in Norway that is Datatilsynet.
Last updated: October 5, 2026