This Privacy Policy explains how The Games Project processes personal data when you visit this website, use the live tracker, watch embedded content, contact us, or interact with project-related pages.

This policy is written to comply with the Swiss Federal Act on Data Protection (nDSG) and, where applicable to visitors from the European Economic Area, with the EU General Data Protection Regulation (GDPR). If something is unclear, contact us at team@thegamesproject.net.

1. Who Is Responsible

For privacy-related questions, contact: team@thegamesproject.net

2. What This Website Is For

This website presents The Games Project, including:

• project information and public updates
• selected public-safe aggregate project metrics via the live tracker
• partner information
• embedded media, such as videos or livestreams
• partnership and contact information

The public website is separate from the private case-study and athlete-data systems used internally for The Games Project.

3. Technical Infrastructure

This website is hosted on Cloudflare Pages (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). Live tracker data is served via Cloudflare R2 object storage.

As part of standard infrastructure operation, Cloudflare may process technical data relating to website requests, including IP addresses, request metadata, and traffic patterns. This processing takes place at the network and infrastructure level and is necessary to operate, deliver, and secure the website.

Cloudflare acts as a data processor on our behalf for hosting and infrastructure. For information about Cloudflare's data practices, see cloudflare.com/privacypolicy.

4. What Personal Data We May Process

Technical Request Data

When you visit this website, Cloudflare's infrastructure processes technical data automatically, including:

• IP address
• browser type and version
• device type and operating system
• pages visited
• date and time of access
• referrer URL
• server and network logs

This data is processed to deliver, secure, and maintain the website. It is handled by Cloudflare as described in Section 3.

Analytics

This website does not currently load a client-side analytics beacon or set analytics cookies.

We may enable Cloudflare Web Analytics in the future to understand aggregate website performance. Cloudflare Web Analytics is designed to be cookieless and does not create persistent user profiles. If we enable it, this policy will be kept aligned with the deployed setup.

Data You Send Us Directly

If you contact us by email or through social media, we may process the information you provide, such as:

• name
• email address
• company or brand name
• message content
• partnership interest
• other information you choose to send

We do not operate a contact form. Email contact is managed directly. We use this data to respond to your message and manage the relationship.

YouTube Video Data

This website embeds videos hosted by YouTube (Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA).

To protect your privacy, embedded YouTube players are loaded only after you actively click to play them. Until you click, this website does not load YouTube iframes or remote YouTube thumbnail images.

When you choose to play a video, YouTube may set cookies and process data including your IP address, browser information, and viewing behaviour, according to Google's privacy policy. This may include data processing for YouTube's own purposes, including personalised advertising.

By clicking to play a YouTube video on this website, you acknowledge that YouTube's privacy policy and terms apply to that interaction.

You can review Google's privacy policy at policies.google.com/privacy.

5. Cookies

This website does not use cookies for its own analytics, tracking, or functionality.

YouTube videos, when you choose to play them, may cause YouTube to set cookies in your browser. These are third-party cookies under Google's control. See Section 4 above.

If partner links, campaign URLs, or tracked referral links are used on this website, these may involve redirects or cookies on the destination platform. We do not control third-party cookie behaviour.

6. Public Tracker Data

The live tracker shows selected public-safe aggregate metrics from The Games Project, served as a static data file via Cloudflare R2. Examples include:

• total training sessions completed
• total training hours logged
• total workouts completed
• current public project phase
• selected public milestones and progress indicators

This is curated public project communication, not a live feed from the private case-study database.

Because The Games Project is an n=1 case study, aggregated project data is not automatically anonymous. Public metrics are deliberately selected, reviewed, and approved before publication.

The public tracker does not publish raw private training data, sleep data, readiness data, health notes, injury details, daily context, or raw athlete records.

7. Livestreams and Live Metrics

This website may embed or link to livestreams showing training, testing, competition preparation, or other public-facing content.

Any live metrics shown during a livestream, such as heart rate or training-session data, are intentionally broadcast as public content. They are not medical analysis, diagnostic information, readiness prediction, or a complete picture of athlete health.

Livestreams are provided by third-party platforms. When you interact with a livestream, the platform provider may process data according to its own privacy policy.

8. Partner Links and Campaign Tracking

This website may include partner links, referral links, discount codes, or campaign URLs.

If you click a partner or affiliate link, the destination platform may process data according to its own privacy policy. We are not responsible for third-party data practices.

Where a link is commercial, sponsored, or tracked, we aim to make that clear where appropriate.

9. Why We Process Data

We process personal data to:

• deliver, operate, and secure the website via Cloudflare infrastructure
• understand aggregate website performance if privacy-preserving analytics are enabled later
• publish public-safe aggregate project metrics
• respond to messages and partnership inquiries received by email
• manage partner and sponsor relationships
• enable YouTube video playback when you choose to play a video
• prevent misuse, fraud, spam, or security issues
• comply with legal obligations

Legal bases under GDPR (where applicable):

• Article 6(1)(f) - Legitimate interests: hosting, infrastructure, security, and project communication
• Article 6(1)(a) - Consent: YouTube video playback (click-to-load mechanism)
• Article 6(1)(b) - Pre-contractual or contractual steps: email communication related to partnership inquiries

Under the Swiss nDSG, processing is based on equivalent justifications.

10. Third-Party Service Providers

Provider	Role	Location
Cloudflare, Inc.	Hosting (Pages), CDN, security, R2 storage	USA
Google LLC / YouTube	Embedded videos (click-to-load)	USA

Additional providers may be added if the project setup changes. This policy will be updated accordingly.

11. International Data Transfers

Cloudflare and Google are based in the United States. Data processed through their services may be transferred to and processed in the USA or other countries.

Cloudflare and Google state that they participate in the EU-U.S. and Swiss-U.S. Data Privacy Frameworks where applicable. Where required, we rely on Standard Contractual Clauses or other appropriate safeguards recognised under GDPR and nDSG.

12. Data Retention

We keep personal data only as long as necessary for the purpose for which it was collected.

• Technical infrastructure logs are retained by Cloudflare according to their data retention policies
• Contact and partnership emails may be retained as long as needed for business purposes
• Consent records (e.g. for YouTube playback) may be retained as browser-side session state only

13. Data Security

We use reasonable technical and organisational measures to protect personal data. Cloudflare provides infrastructure-level security including DDoS protection, encryption in transit, and network-level controls.

No website, internet transmission, or digital system can be guaranteed to be completely secure.

14. Your Rights

Depending on applicable law (nDSG, GDPR), you may have the right to:

• request information about personal data processed about you
• request correction of inaccurate data
• request deletion of data
• request restriction of processing
• object to certain processing
• withdraw consent where processing is based on consent
• request data portability where applicable
• lodge a complaint with a competent supervisory authority

In Switzerland, the supervisory authority is the Federal Data Protection and Information Commissioner (FDPIC): edoeb.admin.ch

EEA residents may also lodge a complaint with the data protection authority in their country of residence.

To exercise your rights, contact: team@thegamesproject.net

15. No Affiliation With CrossFit

The Games Project is independent.

CrossFit® and CrossFit Games® are trademarks of CrossFit, LLC. The Games Project is not owned, operated, endorsed, sponsored by, or otherwise legally affiliated with CrossFit, LLC or the CrossFit Games®.

16. Changes to This Policy

We may update this Privacy Policy when the website, infrastructure, embedded services, partner structure, or legal requirements change.

The current version and its date are published on this page.