Privacy

Short version: no account, no cookies, no advertising trackers. Your quiz answers stay in your own browser. We count page views with our own cookieless analytics, and your result type is only shared if you tap a button to share it.

Who is responsible

The controller under the EU General Data Protection Regulation (GDPR) is the operator of this site, a private individual in Bavaria, Germany. You can reach him for every question and request about your data at:

Florian Breitenberger, Germany. Postal address: see the legal notice. Email:

No data protection officer has been appointed, because the legal requirements for appointing one (Art. 37 GDPR, Section 38 BDSG) are not met. Please send all privacy requests to the e-mail address above.

Hosting

This site is hosted on Cloudflare Pages (Cloudflare, Inc., USA). Cloudflare processes the technical data every web request produces, such as your IP address, the requested URL, the time and your browser’s user agent, in order to deliver the page and to defend against attacks. Legal basis: our legitimate interest in delivering the site securely and reliably (Art. 6(1)(f) GDPR). Cloudflare acts as our processor under a data processing agreement. Because Cloudflare is based in the USA, this involves a transfer outside the EU; it is covered by the standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR). You can request a copy of these clauses by writing to the e-mail address above. Cloudflare keeps this request data only as long as needed to deliver the site and protect it against attacks.

Your quiz answers

The quiz runs entirely in your browser. Your answers and your result are written to your browser’s localStorage under keys beginning with enneatype so you can close the tab and continue later. Your answers are never sent to a server, and we cannot read them. Clearing your browser storage deletes them permanently. Saving them in your browser is strictly necessary for the quiz you chose to take (Section 25(2) no. 2 TDDDG); since we never receive them, the GDPR does not come into play.

Working out which type fits you best also happens only in your browser. We receive no answers, and we do no profiling and make no automated decisions about anyone.

Soul Corner and little games

The Soul Corner (/play/) opens after your test. Your game progress (sparkles, stars, unlocked outfits, best scores and the day of your last visit) is saved in your browser’s localStorage under the key ninelings.play.v1, so it is still there next time. A friend’s challenge link that you opened before taking the test is kept in sessionStorage under ninelings.challenge until you come back to it, and the “Find all nine” game on the home page counts the eggs you found in sessionStorage under ninelings.nine.v1. None of this is sent to a server. sessionStorage ends when you close the tab, and clearing your browser storage deletes all of it. Storing it is strictly necessary for the games you choose to play (Section 25(2) no. 2 TDDDG).

A challenge link you send to a friend contains only the level number and your points, after a “#” (for example #catch/level-2/beat-42). The part after “#” is not sent to our server or to Matomo.

Sharing and groups

When you share your result or a comparison, the link points to a small preview page whose address names the shared type number, for example /s/4/ or /s/4-9/, so chat apps can show the matching picture. Like every request, opening it reaches Cloudflare (see Hosting). Our analytics is not loaded on these pages; they send you straight on to the test page. Everything after the “#” in the address, such as the result code, is never sent to a server by your browser, and our analytics never receives it.

Share links also carry a label for how the link was passed on (for example “whatsapp” or “copylink”), which our analytics counts when the link is opened. The app or service you send a link through receives the whole link, including the part after the “#”.

When you compare your result with someone, their result code is kept in your browser under the same keys until you remove the comparison.

Group links: a group link contains the result codes of its members and the names they typed in, after the “#” in the address. We never receive these names or codes. Everyone who has the link sees every name and result in it and can pass it on, and the app you send it through receives it too. A name cannot be removed from links that were already sent, so a first name or a nickname is enough.

When you start or join a group, the group (its members’ names and result codes) is kept in your browser under the same keys, together with the last name you used, so the page can show everyone who joined. Up to five groups are kept. A group is removed 60 days after you last started, joined or updated it, when you tap “Forget this group”, or when you clear your browser storage.

“Guess my Soul”: a guessing link carries your result code after the “#”, like a shared result. Your friend’s guess stays on their screen; it is not sent anywhere or stored.

“Find all nine” on the home page: the eggs you have found are counted in this browser tab only (sessionStorage) and are forgotten when you close the tab. The count itself is never sent anywhere. If you use “Challenge a friend”, the shared link carries the label “nine”, like the labels of other share links.

Anonymous type statistics (only if you choose)

After your result, you can tap a button to add your result type to our statistics on how common each type is. Only then does your browser send these two values to our counting service: your result type (a number from 1 to 9) and the language of the page. No answers, no scores, no identifier. Our counting service stores these two values without your IP address and without a cookie; like every web request, the request itself passes through Cloudflare (see Hosting). A note in your browser’s localStorage remembers that you already shared, so the button does not appear again. We may publish the resulting totals once enough people have shared, together with how they were collected.

Legal basis: your consent (Art. 6(1)(a) GDPR), given by tapping the button. Sharing is entirely optional; if you do not tap it, nothing is sent and the site works exactly the same. You can withdraw your consent at any time with effect for the future, which does not affect the lawfulness of what was shared before. Because the stored values cannot be linked to you, there is nothing we could later find or delete for you.

Cookies

We set no cookies. localStorage is not a cookie: it is never sent with requests and is only read by this site’s own code in your browser.

Analytics

We use Matomo, an open-source analytics tool, on our own server (metrics.florianbreitenberger.com), reached through this site’s own address. The server is hosted by ALL-INKL.COM (Neue Medien Münnich GmbH) in Germany. Matomo runs without cookies and builds no cross-site profile. It records which pages are visited, the referring site, device and browser type, and ten content-free quiz events (“started”, “completed”, “opened a shared result”, “started a comparison”, “opened a comparison”, “started a group”, “opened a group link”, “joined a group”, “opened a guessing link” and “made a guess”). In the Soul Corner it also records content-free game events: whether the Soul Corner or its preview was shown, which game was opened, which Soul Quest level was finished and with how many stars (0 to 3), when a challenge was sent, opened or beaten, and clicks on the links to the Soul Corner. These events never contain your quiz answers, your result or your Soul. It never learns which Soul was guessed. It never receives your quiz answers, your result, the result codes in share links or the names in group links. Your IP address is shortened before it is stored (the last part is removed), so the full address is never kept. To count visits within a day without cookies, Matomo derives a visitor ID from technical request data; this ID changes daily and is not linked to you.

It also notes when you follow a link to another website or download a file from this site. Each visit is additionally counted, with the same shortened data, in a combined overview of all websites we run, on the same Matomo server.

Raw visit data is deleted after 6 months. The aggregated reports we keep after that contain no personal data.

Legal basis: our legitimate interest in understanding how the site is used so we can improve it (Art. 6(1)(f) GDPR) and, for reading technical device data, Section 25(2) no. 2 TDDDG. No cookie or other storage on your device is used for analytics, except the opt-out entry described below.

Anonymous click heatmaps: with a heatmap plugin for Matomo on the same server, we also record where on a page people click, where the mouse pointer moves (at most every 200 milliseconds) and how far down a page they scroll (in steps of 10 percent of the page). Only positions relative to the page size (numbers between 0 and 1), the page address without the part after “#” (for the scroll depth with a fixed label for the kind of page instead, such as “type page” or “test result”), the device type and the window size are sent. Nothing else is recorded: no screen recording, no typing, no text and no test answers. The points of one page view are tied together by a random ID that exists only in memory and is gone when you leave the page. Nothing is stored in your browser and no cookie is set. A point is only kept if Matomo recorded the page view it belongs to (matched on the server through Matomo's page view ID), so after an opt-out no heatmap points are stored either. Within two hours the points are added to the heatmap totals, after which the individual points are deleted; points without a matching page view are just deleted. Your IP address is shortened before storage, as for the analytics. The purpose is to see which parts of the pages are used or overlooked so we can improve them; the legal basis is our legitimate interest (Art. 6(1)(f) GDPR). The opt-out button below and Do Not Track switch the heatmaps off too. Within the test itself, nothing is captured on the questions, and on the result only how far you scroll, never where you click, so the positions can never give your answers away.

To opt out, use the button below. It saves the entry matomo_optout in this browser’s localStorage (not a cookie), and from then on the analytics script is not loaded at all. Do Not Track and content blockers keep working as well.

Who receives data

Our service providers are only Cloudflare (hosting, as our processor, see Hosting) and ALL-INKL.COM (Neue Medien Münnich GmbH), which hosts our Matomo server in Germany. When you choose a share target yourself (for example WhatsApp, Facebook or LINE), that service receives the shared link directly from your browser, under its own privacy policy. The only transfer outside the EU on every visit is the one to Cloudflare in the USA described above. Nothing else is shared, and we never sell data.

What we do not do

There are no accounts, no newsletter, no advertising and no payments on Ninelings. There is nothing to buy and no payment processing of any kind.

Security

The whole site is served over HTTPS only (with HSTS). Because there are no accounts, there are no passwords or profiles that could leak. IP addresses are shortened for analytics, and we collect only the minimum described on this page.

Children

This site is not directed at children, and we do not knowingly collect data about children.

Your rights

Under the GDPR you have the right to access the personal data we hold about you (Art. 15), to have it corrected (Art. 16) or deleted (Art. 17), to restrict its processing (Art. 18) and to receive it in a portable format (Art. 20). Where processing is based on your consent, you can withdraw it at any time with effect for the future (Art. 7(3)).

Right to object: where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), such as hosting and analytics, you can object at any time on grounds relating to your particular situation (Art. 21). For analytics, the opt-out button above, Do Not Track or a content blocker works immediately.

To exercise any of these rights, write an e-mail to the address under “Who is responsible.” In practice we hold almost nothing that could identify you, and we will tell you exactly what exists.

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA). If you live or work in another EU or EEA country, you can also complain to the data protection authority there; the European Data Protection Board lists all of them on its website.

Changes

If this page changes, the change is made here. There is no mailing list to notify.