Privacy Policy

Who is responsible?

Above Chance is operated by Jesko von Dessauer, a sole proprietor registered in the Netherlands and trading as Luami. Jesko von Dessauer is responsible for the personal data described in this policy and is the controller in data-protection terms.

• Legal name: Jesko von Dessauer
• Trading name: Luami
• KVK number: 88447405
• Business correspondence:
• Privacy email:

What data does Above Chance handle?

Your random number

Above Chance has no accounts. The first time it needs one, the app makes a random number and keeps it in your iCloud Keychain. So it comes back if you reinstall the app, and your devices that share an iCloud Keychain share it. Without iCloud Keychain, each device has its own. It is not your name, email address, advertising ID or Apple ID, and nothing about your phone is in it.

The app sends this number with every request to our server, so that the server can take one cast per player per day and can find your casts when you ask to delete them. The server never stores the number itself. It stores a key made from it with a secret kept apart from the data, so a copy of our data cannot be matched to a phone.

Your casts

When you lock in a cast, the app sends your random number, the day and your four symbols. Nothing else goes with it: not your name, language, time zone, device model or app version.

Our server keeps, under your key, the day, your four symbols and, from the reveal on, your score. Until that day’s reveal, the database also notes when the cast’s record was written. At the reveal the cast moves to long-term storage without that time. No place, device or app version is ever kept with a cast.

We keep your casts because the experiment needs them: to see how single players compare with chance over time, and not only the crowd as a whole. They are kept until you delete them (see Deleting your data).

What we publish is totals. At each reveal, a public file gives the day’s answer, the beacon round it came from, how many cast, how many positions were right, the Collective’s guess and score, how many got all four, running totals since the first round, and how many players are above chance next to how many luck alone would put there. While casting is open, a public file gives the running count of casts, and from 15:45 UTC how the crowd’s casts spread over the symbols. None of these says whose a cast was. On a day with very few casts, though, the totals can show what those casts were.

Your history on your phone

Your history of casts, scores and answers is kept on your phone, where we cannot read it. So are your settings and today’s Practice rounds, which are cleared at midnight. Practice is never sent to our server.

Besides the random number, your iCloud Keychain keeps the day of your last cast, and nothing of the cast itself, so that a phone does not cast twice in one round after a reinstall or a deletion.

Checking that the app is genuine

Each request to our server carries a token from Firebase App Check, a Google service, which shows that it comes from a genuine copy of the app. To get one, the app uses Apple’s App Attest and then asks Google. That request tells Google your IP address, the app’s identifier, your phone’s model and iOS version, the days the app was used since it last asked, and a key that App Attest made for this copy of the app. It carries no random number and no cast.

The answer and the day’s results

At each reveal, and for each round of Practice, the app fetches the beacon’s round from two independent operators: drand’s relays (api.drand.sh, api2.drand.sh, api3.drand.sh) and Cloudflare’s (drand.cloudflare.com). Each request carries the round’s number and your IP address, and nothing about you, your phone or your casts. These operators are independent of us and handle requests under their own terms.

The app reads the day’s result and the live count of casts as public files, delivered by Cloudflare. These requests carry no random number. Cloudflare sees your IP address when it delivers them.

Usage statistics in the app

Separately from your casts, the app sends usage statistics that say what the app did: for example that onboarding was finished, a cast was started or locked in (with the whole hours left before casting closed), a reveal was seen, a cast failed and why, Practice was played, a reminder setting changed, a share button was tapped or a tab was opened. Each comes with the moment it happened, the app version and build, the iOS version, the device model, the language and region setting, and whether the app came from TestFlight or the App Store.

They carry no identifier: only random values that last while the app runs and are replaced after six hours away. They never include your random number, your symbols or your score, and we never combine them with your casts.

So that we can count how many people play and whether they come back, your phone remembers the month (never the day) you first opened the app, in your iCloud Keychain, and when each counted thing last happened. The statistics include that month, and whether something happened for the first time ever, or that day, week or month. The times your phone keeps never leave it. PostHog works out the country from your IP address, then discards the address.

The statistics are handled by PostHog, which acts only on our behalf, uses no cookies and no tracking across apps, and stores the data in the European Union.

Reminders and share cards

Reminders are set on your phone, and our server sends none. When you share a card, it goes only where you send it. If you save one to your photos, the app asks to add it there and reads nothing else.

Our server’s logs

Like any server, ours sees your IP address. Google Cloud, which runs it, keeps a standard log of each request, with the IP address and the app’s name, for 30 days. Our own logs hold counts and coarse facts only: never your random number, your key, your symbols or your IP address.

This website

This website measures how its pages are used, so we can tell which parts people read and which links they follow. While analytics are on, it records page views, how long you stay and how far you scroll, and what you click or change on a page, with the page’s address, the page you came from, your browser and system, your device type and screen size, your language setting and your time zone. There is no session recording, no advertising or cross-site tracking, and no profile: we never ask it to identify you. PostHog handles these statistics in the same project as the app’s, marked as coming from the website, and works out the country from your IP address, then discards the address.

Whether we need your permission first depends on where you are, so we ask Cloudflare which country, and in the US which state, the request arrives from. That happens at Cloudflare’s own network edge, where your request already is: nothing is sent to a third party to look you up, and the answer is not stored. In the EU and EEA, the United Kingdom, and California, Colorado, Connecticut, New Jersey and Oregon, nothing is measured and nothing of PostHog’s is loaded or stored unless you choose Allow analytics, and declining collects nothing at all. Elsewhere, measurement is on when you arrive, and a notice offers a one-click opt-out that we remember for that browser. A Global Privacy Control signal from your browser is treated as an opt-out everywhere, whether or not you have been asked.

What this keeps in your browser: your choice, in a cookie for six months where you were asked, or in the browser’s storage elsewhere. While analytics are on, PostHog also keeps a random ID for this browser in a cookie, for up to a year, so that it can tell a returning visit from a new one. Once analytics have run, PostHog also keeps its own note of whether they are on, which holds no ID.

You can change your choice at any time with Website privacy choices at the bottom of any page.

Cloudflare, which hosts the website, receives ordinary request data such as your IP address, browser and the time of the request. Apart from the analytics and one page, the website loads nothing from other sites.

That page is the one that recomputes a day. As soon as it opens, and each time you pick a day, it fetches that day’s round from drand’s relays (api.drand.sh, or api2.drand.sh and api3.drand.sh if it does not answer) and from Cloudflare’s (drand.cloudflare.com), right from your browser. They receive your IP address, your browser’s usual request details and the round asked for.

Support

If you email us, we receive your email address and what you write.

Why do we use this data?

• to take your cast, score it and count it in the Collective;
• to run the experiment the app is about: how players, alone and all together, compare with chance;
• to publish each day’s answer and totals;
• to make sure requests come from a genuine copy of the app, prevent misuse, keep the service secure and fix failures;
• to understand how the app is used, from the usage statistics;
• to measure how the website is used, where you allow it or have not opted out; and
• to reply when you contact us or exercise a privacy right.

For people covered by the GDPR or similar laws, our legal bases are: performing the service you ask for, when you cast and see your score; our legitimate interests in running the open experiment, in security, misuse prevention and reliable operation, in understanding how the app and the website are used, and in answering you; your consent for website analytics wherever consent is required for them; and compliance with legal obligations where required.

Your choice about website analytics is changed with Website privacy choices at the bottom of any page. Turning it off stops any further measurement in that browser and clears the analytics cookies it had set.

Where does the data go?

• Google Cloud / Firebase runs our server. The functions and the long-term store of casts are in Frankfurt, Germany, and the database for the day’s round is in a European multi-region. Firebase App Check checks that requests come from a genuine copy of the app.
• Cloudflare hosts this website and the public result files, runs one of the beacon’s relays, and tells the website which country a request arrives from, so the right privacy choice can be offered.
• drand’s relays deliver the beacon’s rounds, to the app and to the page that recomputes a day. They are independent of us.
• PostHog (PostHog Inc.; data stored in the European Union, in Frankfurt) processes the usage statistics of the app and of this website on our behalf. In the app it uses no cookies. On the website it stores its ID in your browser only while analytics are running, after you allow them or until you opt out where they start on, and it never tracks you across other sites.
• Apple delivers the app through TestFlight and the App Store, provides App Attest, and keeps your random number in your iCloud Keychain, all under Apple’s terms. If you send feedback through TestFlight, or share crash reports with app developers, Apple passes them to us.

Google Cloud, Cloudflare and PostHog process data on our behalf under data processing agreements that require them to protect it as this policy describes. Some processing may take place outside your country or the European Economic Area. Where required, those transfers use recognised safeguards such as adequacy decisions or standard contractual clauses; PostHog Inc. is also certified under the EU-U.S. Data Privacy Framework. We may also disclose data if the law requires it, or to protect people, rights and the service’s security.

How long is data kept?

• Your casts on our server: until you delete them with Delete my data.
• After a deletion: our long-term store can bring back a deleted cast for up to 7 days, and Google can restore it for 7 days more. After that we cannot bring it back. Google’s record of the deletion request names your key, but no cast, and is kept for about six months.
• The day’s published totals: kept as the experiment’s public record. They hold no player.
• Request logs at Google Cloud: 30 days.
• Usage statistics: kept by PostHog for up to seven years: the app’s with no identifier, the website’s with the random ID of the browser they came from.
• Your website choice: six months in a cookie where you were asked, or in your browser until you clear it elsewhere. PostHog’s ID in your browser: up to a year, or until you turn analytics off.
• App Check records: kept by Google under its own retention.
• On your phone: your history until you delete it or the app. Your random number, the day of your last cast and the month you first opened the app stay in your iCloud Keychain, even after you delete the app.
• Support email: only as long as needed to answer you and meet legal or security needs.

Deleting your data

In the app, open Settings (the three dots on Today), tap Delete my data, then Delete it all. This deletes the casts our server keeps under your key, then your history on your phone. The app keeps your old random number until the server has confirmed the deletion, so that asking again can finish it, and then makes a new one.

• A cast of a round that is still open is deleted at once, and is left out of that day’s result. The live count of casts may still include it.
• A cast deleted between 15:45 and 16:00 UTC still counts in that day’s result, since the counts are settled when casting closes. It is removed once the reveal has run, normally minutes after 16:00 UTC.
• Totals of days already revealed hold no player, so there is nothing in them to delete.
• If today’s round had your cast, it stays marked as cast on your phone, so it cannot be cast in again.

Deleting the app does not delete your casts on our server. Use Delete my data first. If the app is gone, install it again: your random number comes back from your iCloud Keychain, and Delete my data works as before.

We can find your casts only through the random number on your phone. If it is lost for good, for example after resetting a phone that did not use iCloud Keychain, or if two of your devices each made a number before iCloud Keychain brought them together, we cannot tell which casts under the other number were yours.

For help, or for another privacy request, email . Because Above Chance has no accounts, we may be unable to connect some records to you.

Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, restrict or receive a copy of your personal data, and to object to certain uses. You may also complain to your local data-protection authority. We will not treat you differently for exercising a privacy right.

Above Chance does not sell personal information or share it for cross-context behavioural advertising. It does not use your data for targeted advertising.

Security and children

Neither the app nor anyone outside can read or write our database: only our server and the person who runs it can. Connections are encrypted, and requests that do not come from a genuine copy of the app are turned away. We use providers with technical and organisational security measures. No system is perfectly secure.

Above Chance is not directed at children. If you believe a child has given us personal data, contact us so we can review and delete what we can identify.

Changes and contact

We will update this page when what Above Chance keeps, or who handles it, changes in a way that matters, and will change the date at the top.

Questions, concerns or privacy requests are welcome at .