LAST UPDATED: 12 SEPTEMBER 2026

Privacy Notice

This notice explains how BEAT//MOST handles personal data when you play, use social features, return on another device, or buy a paid feature.

1. Data controller and contact

Possible Solutions Kft. develops and operates BEAT//MOST and is the controller of personal data processed through the service. Privacy requests and problem reports may be sent by post to the address above or through our protected email contact:

Reveal privacy email

No data protection officer has been appointed.

2. Data we process

• Anonymous player data: a random player token stored in your browser and only its keyed hash on the server, an internal player ID, creation date, last-seen date, and optional country code.
• Public profile data: an automatically generated or player-selected display name and a short unique public tag. The name becomes permanent when the first official run starts. These details can appear on leaderboards, private leagues, duel pages, and shared results.
• Game data: Official and Practice challenge answers, timings, normalized and total scores, personal bests, percentiles, ranks, streaks, completion status, source mode, and validation status. Practice results are kept separate and never enter the Official Rank.
• Community data: referral and invite codes, referral status and rewards, league names, league membership and roles, duel participants, linked runs, scores, status, and expiry time.
• Security data: keyed hashes of IP address and user-agent information, request timing, replay attempts, rate-limit events, and anti-automation classification.
• First-party analytics and experiments: a random session visitor identifier, page and game events, traffic source, campaign parameters, completion and abandonment points, Practice usage, sharing and Friend Challenge events, return visits, cohort membership, and the product or pricing variant assigned to the visitor or anonymous player.
• Payment data: Stripe processes payment details. We receive transaction, checkout and customer identifiers, product, amount, currency, payment status, billing name, email, billing address, tax identifiers supplied at checkout, and information needed for invoicing. For subscriptions purchased under an earlier offer, we may also retain subscription, renewal and cancellation status. We do not receive or store full card details.
• Purchase recovery data: the payment email, device-token hashes, and a one-way hash of the current recovery code. We cannot read the saved recovery code.
• Support and legal data: correspondence, problem reports, complaints, withdrawal requests, refunds, and information needed to resolve them.

3. Why we use the data

• to provide one official daily run, calculate real rankings and percentiles, preserve history, and maintain streaks;
• to recognize a returning browser without requiring registration and restore paid access when requested;
• to operate referrals and rewards, private leagues, shared results, and head-to-head challenges;
• to prevent duplicate attempts, manipulation, bots, abuse, and security incidents;
• to measure the conversion funnel, retention, campaign performance, experiments, and product quality using first-party analytics;
• to provide paid features, administer purchases and any earlier subscriptions, prepare invoices, handle refunds, and meet accounting obligations;
• to answer support requests and establish, exercise, or defend legal claims.

4. Legal bases

We process service, community and purchase data, including data about any earlier subscription, to perform a contract or take steps at your request. Security, fraud prevention, anonymous recognition, service improvement, limited first-party analytics, and proportionate product experiments rely on our legitimate interests in operating a fair, secure, and sustainable service. Billing records are processed to comply with legal obligations. Where the law requires consent, we will request it separately and you may withdraw it at any time.

5. Anonymous identity and essential cookies

A page view alone does not create a persistent player record. We create a player identity when you actively start or use a feature that requires saved progress. Before that point, a temporary session visitor identifier may be used for first-party traffic and funnel measurement.

BEAT//MOST does not require an account. The essential hp_player cookie normally lasts for one year and lets us recognize the same browser, enforce one official daily run, connect community and paid features, and show history and streaks. The hp_session cookie lasts for the browser session and protects requests. These cookies are necessary for the requested service and are not used for cross-site advertising.

If you delete cookies, use private browsing, or change browser or device, we may treat you as a new player unless you restore access with your payment email and recovery code. We do not use cross-site fingerprinting, Google Analytics, Meta Pixel, or remarketing cookies.

6. Public, social, and invite features

Public leaderboards and shared result pages can reveal your display name, public tag, score, rank, percentile, and result date. Private leagues are limited by an invite code, but anyone who receives that code may request to join and league members can see one another’s names, tags, and daily scores. Duel links reveal the participants’ public profile details and scores. Treat all invite and share links as shareable information and do not use a real name as your display name unless you want it shown.

When you choose a social sharing option, your browser or device may open a third-party platform or share sheet. Any information you then send is handled by that platform under its own privacy terms. BEAT//MOST does not automatically post to your social accounts.

7. Automated anti-cheat decisions

Automated rules classify runs as verified, unknown, suspicious, or bot-like using timing, request sequence, replay, and rate signals. Suspicious results may be excluded from public rankings and percentile calculations. This classification does not produce legal or similarly significant effects. You may request a manual review if you can identify the affected run.

8. Recipients and service providers

• Rackhost Zrt. (6722 Szeged, Tisza Lajos körút 41., Hungary; company registration number 06-10-000489): hosting, domain, DNS, and email infrastructure;
• Stripe: checkout, payment processing, payment-method eligibility, fraud prevention, and management of subscriptions purchased under an earlier offer;
• Billingo Technologies Zrt.: preparation and management of accounting invoices;
• professional advisers, accountants, authorities, and courts where required by law or necessary to protect legal rights.

These providers may receive only the information needed for their role. Their own notices are available from Rackhost, Stripe, and Billingo. We do not sell personal data or share it for third-party behavioral advertising. Frontend assets are served from our own hosting rather than a public CDN.

9. International transfers

Primary website hosting is in Hungary. Stripe and its affiliates or subprocessors may process data outside the European Economic Area. Where required, Stripe states that it uses recognized transfer mechanisms including the EU–US Data Privacy Framework and the European Commission’s Standard Contractual Clauses. Details are available in Stripe’s Data Transfers Addendum.

10. Retention

• raw security signals and identifiable first-party analytics: up to 90 days;
• experiment assignments and aggregated funnel or cohort statistics: for as long as needed to evaluate the experiment or product, with identifying links removed or anonymized when no longer needed;
• referrals, rewards, league membership, completed duels, game results, streaks, and history: while needed to provide the feature, maintain fair records, or until deletion or anonymization under the applicable schedule;
• open duel links expire at the end of the applicable UTC day; technical records may remain under the general retention schedule;
• support, complaint, dispute, and refund correspondence: normally 90 days after closure, unless a longer period is needed for a legal claim;
• billing and payment records, including records of any earlier subscription: at least for the period required by applicable accounting and tax law;
• aggregated statistics that no longer identify a player may be retained longer.

11. Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, portability, or object to processing, and may withdraw consent where processing relies on consent. Because play is anonymous, we may need the player identifier stored in your browser, a recovery reference, or a relevant invite or run identifier to locate your data. We cannot reliably connect deleted cookies to a person.

You may also lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH), 1055 Budapest, Falk Miksa utca 9–11, Hungary, or with the supervisory authority in your country.

12. Security and changes

We use data minimization, keyed hashes, access controls, prepared database queries, CSRF protection, short-lived challenge tokens, rate limiting, encrypted transport in production, and restricted release packaging. No system can guarantee absolute security.

We may update this notice when the service, providers, or law changes. The current version and effective date will always appear on this page.