Privacy notice
What personal data the Sanamahti website processes, on what legal basis and for how long, and what rights you have.
Effective date: 22 October 2026
This notice covers the Sanamahti website: the contact form, the visit counter and the technical log of the hosting platform. The site has no user accounts and no sign-in.
The Sanamahti game has a privacy notice of its own, which is available in Finnish. The Finnish page also covers Sanaraati, the word jury of the site, which is open by invitation only and is in Finnish.
Controller
The controller is Alex Liao. Email: tuki@sanamahti.fi.
Cookies and browser storage
The site sets no cookies. Pages load no scripts, fonts or images from third-party servers.
If you switch between light and dark mode, the choice is stored in your browser so that the site remembers it on your next visit. The choice is not sent to the server. This storage is necessary for the function you asked for, so no consent is requested for it.
Visit counter
The site has its own visit counter. Nothing is sent to an outside analytics service. For the counter, your browser sends the site a request that contains the address of the page without its query string and fragment, the domain of the site you came from and the name of the event. Nothing is stored in your browser for the counter.
The counter adds to daily totals of
- how many times each page was opened;
- which site visitors came from (the domain only, not the full address);
- how many times the Play button and the app store links were pressed;
- how many times the contact form was sent and how many raters started the word jury.
The counter stores no IP address, cookie or other identifier that could tell visitors apart. The totals do not show who visited and contain no personal data. The request is processed momentarily on the basis of our legitimate interest in knowing which pages are read. The totals are kept until further notice.
If your browser sends a Global Privacy Control or Do Not Track signal, your visit is not counted.
Abuse prevention
Submissions of the contact form are limited per sender. For this, a hash is computed from your IP address with a secret key. The hash expires at the end of the same day in Finnish time, and the database deletes it automatically, usually within a day of expiry. The hash is used only to limit the number of submissions. Your IP address is not stored as such for the limit. The legal basis is our legitimate interest in protecting the form from abuse. The technical log of Google’s platform, which can contain an IP address, is described under Service providers and transfers.
The form also has a hidden field that reveals automated submissions, and its fields have length limits. Submissions also have a daily maximum. When it is reached, the form closes for the rest of the day. The site uses no reCAPTCHA or other outside bot protection.
Contact form
With the form you give your name, your email address, your role (player, researcher, student, teacher, supporter, media or other), the subject of your message and the message. Name, email address, role, subject and message are required: the form cannot be sent without them. The time of sending and whether you sent the form from the Finnish or the English page are stored as well.
We process your message on the basis of our legitimate interest in answering it and handling your matter. The data is not used for anything else.
The message is stored in a database of Google’s Firebase service that only the administrator of Sanamahti can access. It is deleted from the database automatically about six months after you sent it: it expires after 180 days, and the database usually removes an expired message within a day. We delete it earlier if you ask.
We reply by email from tuki@sanamahti.fi. Mail sent to that address is forwarded to the administrator’s Gmail mailbox, provided by Google LLC, so emails may be transferred outside the EU and the EEA, to the United States. Google takes part in the EU-U.S. Data Privacy Framework. An email thread is deleted no later than 24 months after its last message.
The administrator sees new messages on an admin page and may get a notice of them in the Telegram messaging service. The notice contains only the role you chose and none of your personal data.
You have the right to object to this processing. You can also ask for your message to be deleted earlier. For either, write to tuki@sanamahti.fi.
Service providers and transfers
The site, its backend functions and its database run on Google’s Firebase service. Google processes your IP address technically when your browser fetches pages or sends data to the site. Google’s platform keeps a technical log of the requests to the backend functions. The log can contain the IP address, the user agent of the browser and the address of the page the request came from. It is kept for about 30 days, and the administrator uses it only to investigate faults and abuse. The legal basis is our legitimate interest in keeping the service working and secure.
The database is located in the EU, and the backend functions run in Belgium and Poland. Pages, and the data you send to the site, pass through the content delivery network of Firebase Hosting. The network is operated by Fastly, a company in the United States, as a subprocessor of Google. It is global, so your request may also pass through a server outside the EU. According to Google, Firebase Hosting keeps IP address data for a few months. Transfers outside the EU are based on the standard contractual clauses of the European Commission, and Google also adheres to the EU–US Data Privacy Framework.
If notices of new contact messages to the administrator are in use, they go through the Telegram messaging service. A notice contains only the role given in the message, so none of your personal data is transferred to Telegram.
Your rights
You have the right to get access to the data about you, to have incorrect data corrected, to have your data deleted, to have the processing restricted and to object to the processing. To use your rights, write to tuki@sanamahti.fi. The totals of the visit counter contain no identifiers, so the data of a single visitor cannot be found in them or deleted from them.
If you consider that the processing of your personal data does not comply with data protection law, you have the right to lodge a complaint with a supervisory authority. In Finland the authority is the Office of the Data Protection Ombudsman (tietosuoja.fi).