Legal
Privacy policy
Last updated: 27 October 2026
In short
- No ads, and we don't sell your data. We count visits without cookies or tracking you.
- We need your email, nickname and the game's scans. Contacts only if you add them.
- Nickname, avatar and points are public: leaderboard, the /live screen and Instagram.
- To stop cheating we log scans, IP address and browser.
- We keep the data until 29 October 2027, then delete it.
- To see, fix or delete your data: [email protected].
This notice explains what personal data we collect when you visit zeroshot.it or play Zero Shot on app.zeroshot.it, why we use it, who we share it with and how long we keep it. It is written under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003.
Zero Shot is an unofficial fan-made game for Codemotion Milan 2026 (28 and 29 October 2026). It is not run by Codemotion, and we don't pass your data to Codemotion.
1. Who handles your data
The data controllers are, jointly (joint controllers under Art. 26 GDPR), the three people who made Zero Shot: Davide Ghiotto, Andrea Mazza and Yi Zhang. We have agreed to answer any request together: for anything about your data, write to [email protected]. You can still exercise your rights against each of us. We have not appointed a data protection officer (DPO), as one is not required for a project like this.
2. If you only visit the site
zeroshot.it is a static site: no accounts, forms, advertising or social network pixels, and the fonts are served from our own server, not from Google Fonts. Like any website, the server and the network that protects it (Cloudflare) log each request for technical and security reasons: IP address, date and time, page requested, browser and operating system. We use these only to run the site and defend it from abuse.
The site remembers in your browser which team you picked to colour the page. This stays on your device and is never sent to us: see the cookie policy.
Visit statistics
On the site and in the app we count visits with Umami, installed on our own server: no data goes to third parties. It records the page viewed, the site you came from, browser, operating system, device type, language, approximate country and city, and a few actions (signing up or a scan, for example, without saying whom you scanned). It uses no cookies or other data stored on your device and doesn't keep your IP address: it only uses it to work out the country and a code that recognises the same visit and changes every month. We strip login codes, invites and ids from addresses, and staff screens aren't recorded. This tells us how many people play and where they come from, not who you are.
3. If you play: the data we collect
Account and sign-in
- Email, to open your account and send you the 6-digit sign-in code. The code is valid for 10 minutes.
- Session: a sign-in identifier, with the IP address and browser you opened it from. You stay signed in while you use the app; after 30 days without using it you sign in again.
- Where you came from: if you joined from a flyer QR, which flyer print run; if another player brought you in, who it was.
Game profile
- Nickname, chosen team, pixel-art avatar, date you joined the game.
- Points, badges, leaderboard position, treasures and hunts completed, meme cards picked up from the staff.
- The people you scanned and the people who scanned you, with date and time: this is the heart of the game.
- If you link it, your conference badge: we keep only a cryptographic fingerprint (hash) and the 8-character Swapcard code needed to redraw its QR, never the full QR content. If you link a physical NFC card, we keep its number.
Contacts you choose to share
In your profile you can add, if you want, a short bio, LinkedIn, Instagram, TikTok and YouTube profiles, an email, a phone number and up to five links. They are optional. Whoever scans you (collects you) sees them and can download them as a contact file (.vcf). If you linked a physical NFC card, anyone who holds the card to their phone sees them too, without an account: only hand the card to people you want to have them. Once downloaded they are on that person's device: removing them from your profile later doesn't remove them from there.
Security and cheating
Since every scan is worth points and physical prizes, some people try fake accounts or scripts. To catch this we log, for every sign-in and every scan (failed ones too): date and time, outcome, kind of code scanned, whether it came from the camera or was typed, IP address, browser, a random device identifier stored by the app and a technical cookie that recognises the browser (see the cookie policy). We also log the first time you use the app from a browser, requests that hit rate limits, and staff actions on accounts.
Some automatic checks act on their own, without a person looking:
- they refuse sign-up with an email that looks disposable, made up, or whose domain receives no mail;
- they hold back the points for an infection until the new player has met an already verified player in person, and don't count accounts opened from the same browser or device.
A program then cross-checks the data and flags suspicious behaviour to the staff. Blocking an account or hiding it from the public leaderboard is decided by a person after looking at the signals, and may be applied without telling you, so as not to help cheaters. If you think there's been a mistake, write to us: a person will review the case.
Email checks
When you open an account, or add an email to your contacts, we check that the address looks real: that it is not from a disposable email service and that its domain receives mail. The address is also sent to an external verification service, which estimates whether it is made up. During the event we may turn on a check that asks Swapcard, Codemotion's ticketing platform, whether the email is registered for the conference: Swapcard receives the address and only answers yes or no.
If you don't play
A player can scan the QR on the conference badge of someone who doesn't play yet. We then keep only a cryptographic fingerprint (hash) of that QR, linked to whoever scanned it, to know who "infected" you if you join later. We don't keep the QR content and don't know whose it is until you link the badge. The app's agenda shows speakers' names, bios and photos, as published by Codemotion on Sessionize.
Push notifications
If you turn them on, your browser gives us a technical address to send game notifications to. They are delivered by the push service of your browser or phone maker (Apple, Google, Microsoft or Mozilla). You can turn them off at any time in your browser or phone settings.
Camera and NFC
The app uses the camera to read QR codes and, where available, NFC to read cards. The images stay on your phone: only the code that was read reaches us.
If you write to us
If you write to [email protected] or message our Instagram profile, we use your address and what you write only to answer you.
4. What others see
- Nickname, avatar, team and points appear on the in-app leaderboard, which every player sees.
- The public /live screen, shown on the conference monitors and open to anyone on the internet, shows the top of the leaderboard with nicknames and avatars, team totals, recent actions with the nicknames of the players involved (for example who scanned whom), and the contact network with anonymous nodes.
- The Instagram profile @zeroshot.it posts leaderboards, winners and game recaps, with nicknames and avatars.
- The optional contacts in your profile are seen only by people who collected you and by whoever reads your NFC card, if you have one.
Pick a nickname that isn't your full name if you don't want to appear under it. If you don't want to appear on /live or in our Instagram posts, write to us and we'll take you out.
5. Why we use it and on what legal basis
| Purpose | Legal basis |
|---|---|
| Account, sign-in, the game, the leaderboard, handing over cards, sharing the contacts you choose | Providing the service you ask for by signing up (Art. 6(1)(b) GDPR) |
| Security, activity log, catching fake accounts and cheating, email checks | Our legitimate interest, and other players', in a fair game and a service protected from abuse (Art. 6(1)(f)) |
| The /live screen and Instagram posts with nicknames and results | Legitimate interest in telling the story of the game during and after the event (Art. 6(1)(f)); you can object |
| Push notifications | Consent, which you can withdraw at any time (Art. 6(1)(a)) |
| Visit statistics for the site and the app, without cookies | Legitimate interest in understanding how the game is used and improving it (Art. 6.1.f); you can object |
| Technical site logs, answering emails | Legitimate interest in running the site and answering you (Art. 6(1)(f)) |
We don't sell your data, use it for advertising or build commercial profiles.
6. Who we rely on
We use a few providers that process data on our behalf (processors, Art. 28 GDPR) or as independent controllers for their own service:
- Hostinger International Ltd. (Cyprus): the server running the site, the app and the database, in a data centre in Germany.
- Cloudflare, Inc. (USA): DNS, HTTPS and attack protection; traffic to the site and the app goes through its network.
- Resend (Plus Five Five, Inc., USA): sending the emails with your sign-in code.
- An email verification service, based on artificial intelligence, that estimates whether an address is made up.
- Swapcard SAS (France): only while the check is on, confirming the email is registered for Codemotion.
- Apple, Google, Microsoft, Mozilla: delivering push notifications, if you turned them on.
- Sessionize: speaker photos in the agenda load from its servers, which see your IP address.
- Meta Platforms Ireland Ltd.: publishing posts on the @zeroshot.it Instagram profile.
- Google: the sign-in email uses Google Fonts, which your email app may download when you open it.
Some of these providers are based in the United States or may process data outside the European Union. In those cases the transfer relies on the EU-US Data Privacy Framework adequacy decision, for companies certified under it, or on the standard contractual clauses approved by the European Commission (Art. 46 GDPR).
Zero Shot staff, in yellow vests, see the data needed to hand you your cards and help you sign in. We don't disclose your data to anyone else, unless the law requires it.
7. How long we keep it
- Sign-in codes are valid for 10 minutes, sessions for 30 days from last use; expired ones are deleted with the rest of the data.
- Account, profile, shared contacts, points, scans and activity log: up to 12 months after the event ends, that is until 29 October 2027. Then we delete them or make them anonymous.
- Push subscriptions: until you turn them off or your browser expires them.
- Technical server and Cloudflare logs: for the short period set by the providers.
- Visit statistics: until 29 October 2027, like the rest of the game's data.
- Emails you send us: as long as needed to answer and handle your request.
- Instagram posts stay up until we take them down, including at your request.
- Database backups delete themselves after 14 days.
You can ask us to delete your account before then, at any time.
8. Your rights
By writing to [email protected] from your account's email you can:
- find out what data we hold about you and get a copy (Art. 15);
- have it corrected (Art. 16);
- have it deleted, including your whole account (Art. 17);
- restrict its use (Art. 18);
- receive it in a machine-readable format (Art. 20);
- object to processing based on legitimate interest, for example appearing in Instagram posts (Art. 21);
- withdraw any consent you gave, without affecting what was done before.
We answer within one month. If you think we handle your data unlawfully, you can complain to the Italian Garante per la protezione dei dati personali or to the authority of the country where you live.
9. Minimum age
Zero Shot is meant for Codemotion attendees. You must be at least 14 to play. If we find an account opened by someone under 14, we delete it.
10. Changes
If we change how we handle data we update this page and the date at the top. For important changes we tell players in the app.