colon.run

Privacy notice

Last updated 27 October 2026. This notice explains what personal data colon.run (“the game”, “we”, “us”) collects, why, and the rights you have under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

1. Who we are

The data controller is the publisher of colon.run.

2. Player counts

Each day you start a run, the date and a random player ID created by your browser are sent to our database so we can count how many people play each day, week and month. No name, email or location is attached. These records are deleted after 120 days. You can opt out here at any time:

Count me in the player numbers

3. The league (only if you sign the register)

If you choose to put a name on the league, we store: the name you choose; your random player ID; your best score and the distance, polyps, cecums, CO₂ bubbles and tight squeezes of that run; your furthest distance; your career total and number of runs; how your scope looks (scope and hat); where your last run ended on each patient level (shown to other players as a crash marker); and a record of how your best run was steered (press timings, input type and tap positions), used only to detect cheating and automated play.

4. Why we use it (lawful basis)

• Running the league, showing names, ranks, scope looks and crash markers to other players: our legitimate interest in providing the game you asked to join, and in keeping it fair.
• Detecting cheating and abuse (steering records, rate checks, the name filter): our legitimate interest in a fair, safe game.
• Player counts: our legitimate interest in understanding how many people play. You can opt out (section 2).

We have weighed these interests against your rights: the data is minimal, pseudonymous and never used for advertising or profiling.

5. On your device

The game saves your settings, scores, career, challenge progress, unlocked hats and scopes, the name you chose and your player ID in your browser’s local storage, so the game works between visits. This is strictly necessary for the game you have asked to play, so under PECR it doesn’t need consent. We don’t use cookies, analytics trackers, advertising IDs or fingerprinting.

6. Who sees it

Everyone can see league names, scores, distances, grades, scope looks and crash markers. Only the league administrator can see steering records. We use these service providers (processors), who act on our instructions: Supabase (database hosting) and our web host, which processes your IP address and browser details to deliver the site and protect it from attacks. The game’s typefaces are loaded from Google Fonts, so Google receives your IP address when the page loads. If you choose to share a score, the app you share to (WhatsApp, Messenger, Facebook or X) handles that under its own privacy policy. Some providers may process data outside the UK; where they do, transfers are covered by UK adequacy regulations or the UK International Data Transfer Addendum.

7. How long we keep it

Player counts: 120 days. League entries: while the league runs, unless you delete them sooner. We may remove entries that are offensive, inactive for over two years, or that break the rules. Data on your device stays until you delete it or clear your browser data.

8. Your rights

You have the right to access, correct, delete or restrict your data, to object to our use of it, and to data portability. The button below deletes your name, scores, crash markers and player-count days from our database immediately and clears this device. For anything else, use the contact link in section 1. We may need your player ID (shown on reports as the CR code) to find your data, because we don’t know who you are. You can also complain to the Information Commissioner’s Office (ico.org.uk, 0303 123 1113).

9. Children

The game is for players aged 13 and over. If you’re under 13, please don’t sign the register without a parent or carer’s permission. Please use a nickname, never your full name. If you think a child under 13 has given us personal data, contact us and we’ll delete it.

10. Security

Data is sent over encrypted connections (HTTPS). The public can only use a small set of database functions that check every request; nobody but the administrator can read the raw tables. No system is perfectly secure, so please don’t put anything personal in your name.

11. Changes

If we change this notice we’ll update the date at the top. Significant changes will be shown in the game.

Not medical advice. colon.run is a game. It isn’t medical advice or training, and a real colonoscopy is gentler, slower and carried out by trained professionals. If you have bowel symptoms or questions about screening, speak to your GP or visit nhs.uk.