The standards we meet
Which recognised standard each part of the game is built to, what that means in practice, and what we do not claim.
The game is built to standards that are accepted in the market, not to marketing statements: each field names the standard it targets and the behaviour that actually meets it — accessibility, privacy, security, performance, search and sharing, bilingual support and engineering quality.
Every item here can be checked in the game itself. What we do not have — an accessibility certificate, an external penetration test or a certified ranking — is stated openly in the last section, and is never promised anywhere else. Contact: shahar@rotshtein.com
8 fields are documented in this document.
These are the standards and practices the game is built to. Each one lists what it means in practice inside the app — no promises the code does not back up.
Accessibility
WCAG 2.2 AA · EN 301 549 · Israeli SI 5568 · EAA · ADA
- Full keyboard navigation, a visible focus ring on every control, and a skip-to-content link on every page.
- A focused control is scrolled into view with margins clear of the top bar and the bottom navigation, so neither hides it (2.4.11).
- 44px touch targets for buttons and 24px for icon-only buttons, with a readable name on every icon button.
- No action depends on dragging alone: the map also moves with the zoom buttons, a click and the arrow keys (2.5.7), and no CAPTCHA or cognitive test guards sign-in (3.3.8).
- System or player reduced-motion preference is honoured, and text contrast is checked in both light and dark themes.
- A correct heading structure (one H1 per page), alternative text for meaningful images and status announcements for screen readers.
Privacy & data protection
GDPR and UK GDPR · Israeli Privacy Protection Law
- Data minimisation: profile name, avatar, score and game history — nothing that the game does not need is collected.
- Full data-subject rights: access and download of everything stored, portability, deletion of game data and account closure — on the "My data" page.
- No ads, no tracking pixels and no advertising profiles; no device location permission is ever requested.
- A privacy policy with documented retention periods, and transparency about the external services that receive an IP address as part of a request.
Information security
OWASP practices · row-level permissions
- HTTPS on all traffic, and row-level security (RLS) on every data entity — reads and writes limited to the owner or an administrator.
- Server-side access control: admin statistics return 403 to non-admins, and score and room-chat writes go through a verified function.
- A documented threat model (impersonation, score forgery, data exposure, assistant prompt injection) and a dependency audit that tracks known advisories.
- The assistant runs under hard system instructions: no access to data or code, and no answers in the trivia games.
Performance
Core Web Vitals · mobile-first
- Targets set for the core metrics: LCP up to 2.5 seconds, INP up to 200 milliseconds, CLS up to 0.1.
- Staged loading: every screen loads as its own bundle, and the heavy city catalogue is prefetched only while the screen is idle.
- A mobile-first layout with a bottom navigation bar and no horizontal scrolling at three tested screen widths.
Search & sharing
Open Graph · Twitter Card · semantic HTML
- Bilingual title and description, a canonical address on the live domain, and a 16:9 preview image for social sharing.
- Private screens — login, profile, admin and game rooms — are marked as not for indexing.
- A real 404 page with the correct status code for search engines, and an app manifest for adding the game to a home screen.
Internationalisation
Hebrew RTL · English LTR · WCAG 3.1.2
- A fully bilingual interface, where page direction and text direction switch together with the language.
- The page language tag stays in sync with the active language, so a screen reader pronounces the text correctly.
- All game content — cities, countries and trivia questions — is translated both ways, including numbers and bidi-safe punctuation.
Engineering quality
Automated tests · clean build and lint
- Hundreds of automated tests across seven layers — unit, integration, system, end-to-end, acceptance, security and quality (accessibility, responsiveness, design, performance and documentation currency) — running against the real code without touching player data.
- A release gate: a clean build and lint before every release, with documented architecture, flows, scoring, security and testing.
- Adding a game mode requires data, tests, a guide entry and a release note — so the documentation never lags behind the code.
Transparency & limits
Accessibility statement · terms of use · reported limits
- This standards document, the accessibility statement, privacy policy and terms of use are reachable from the guide and every page — with clear ways to contact us.
- A friendly error screen instead of a crash, and a feedback page for reporting a bug or an accessibility issue.
- What we do not claim, openly: there is no accessibility certificate and no penetration test by an external party; multiplayer room scores are computed from coordinates the host sends, so they never enter the leaderboard and earn no achievements; and the map data can contain errors.
This document is reviewed with every material change in behaviour, and the technical documentation behind it is verified automatically on every test run.