Privacy policy
What we collect, why, who we share it with, how long we keep it, and how you say no. Covers the GDPR for European visitors and the CCPA/CPRA for California residents.
Working draft
The site is not public yet. Each {{TO BE COMPLETED}} marker is a fact that has not been decided, and the sections marked planned, not yet deployeddescribe processing that does not happen today. A lawyer must review this text before publication.
1. The short version
- Reading the site requires no account and no form. We do not ask for your name or your email to let you read an article.
- Our host, Cloudflare, logs technical request data (including your IP address) to deliver and protect the site. That is the only processing that happens on every visit.
- Your cookie banner choice is stored in your own browser, under the key
consent. It never leaves your device. - Advertising and audience measurement are planned but not live. When they are switched on, nothing non-essential loads before you have accepted.
- Clicking a partner link sends you through
/go/<game>/and then on to the game's own site, which has its own privacy policy and its own tracking.
2. Who is responsible
| Item | Value |
|---|---|
| Controller | {{TO BE COMPLETED: legal name of the operating entity}} |
| Address | {{TO BE COMPLETED: full registered address}} |
| Privacy contact | {{TO BE COMPLETED: contact email address for privacy requests}} |
| Data protection officer | {{TO BE COMPLETED: DPO name and contact, or a reasoned statement that no DPO is required}} |
| EU / UK representative | {{TO BE COMPLETED: Article 27 representative if the controller is established outside the EU/UK}} |
Company identification details are also on the legal noticepage.
3. What we process, why, and on what legal basis
One row per purpose. The legal basis refers to Article 6 of the GDPR; where the purpose involves storing or reading something on your device, the ePrivacy Directive applies on top and consent comes first.
| Purpose | Data | Legal basis (GDPR) | Status |
|---|---|---|---|
| Delivering the pages and the images, and keeping the site up | IP address, date and time, URL requested, HTTP status, user agent, referrer, approximate country, Cloudflare Ray ID | Legitimate interest, Art. 6(1)(f) — serving a site that works | Live |
| Security: blocking bots, abuse, denial of service | Same technical request data, plus Cloudflare's own risk signals | Legitimate interest, Art. 6(1)(f) — protecting the service | Live |
| Remembering your cookie choice and proving it | The single value accepted or declined, stored locally in your browser | Consent, Art. 6(1)(a); storing the choice itself is strictly necessary and exempt from consent | Live |
| Loading a video only when you ask for it | Nothing on our side; clicking the thumbnail loads a YouTube player from youtube-nocookie.com and your IP goes to Google at that moment | Consent, Art. 6(1)(a) — the player loads on your click, never before | Live |
| Measuring which partner links are clicked | Game, placement code (?p=), timestamp, coarse technical data; a click identifier may be stored on your device | Legitimate interest, Art. 6(1)(f) for aggregate counting; consent where an identifier is stored on your device for attribution | Planned, not yet deployed |
| Audience measurement (analytics) | Depends on the tool: either aggregate, cookieless counts, or a per-visitor identifier | Legitimate interest for cookieless aggregate measurement; consent for anything that stores or reads an identifier | Planned, not yet deployed — {{TO BE COMPLETED: analytics provider}} |
| Display advertising, including personalised ads | IP address, device and browser data, pages viewed, advertising identifiers, inferred interests | Consent, Art. 6(1)(a) — refused by default | Planned, not yet deployed — {{TO BE COMPLETED: advertising network / SSP}} |
| Newsletter | Email address, double opt-in timestamp and IP, open and click events | Consent, Art. 6(1)(a) | Planned, not yet deployed — {{TO BE COMPLETED: email service provider}} |
| Answering your messages and rights requests | Your email address and whatever you put in the message; for a rights request, what we need to identify you | Legitimate interest, Art. 6(1)(f) for ordinary correspondence; legal obligation, Art. 6(1)(c) for rights requests | Live once a contact address exists |
We do not ask for, and do not want, special category data (health, beliefs, sexual orientation, biometrics). Please do not send it to us. We do not knowingly process data about children under 16, and the site is not directed at them.
We take no automated decision that has a legal or similarly significant effect on you. Ad personalisation, once live, profiles your interests for the purpose of choosing which ad to show, and nothing else.
4. Where the data comes from
From your browser, when it requests a page or an image. From your own actions, when you accept or decline cookies, click a video thumbnail, click a partner link, or write to us. We buy no data and we enrich our logs with no third-party dataset.
Our paid acquisition campaigns bring visitors from advertising platforms. Those platforms may add parameters such as utm_source to the landing URL. Those parameters travel in the URL and therefore appear in the technical logs described above; they identify a campaign, not a person. The platforms themselves process your data under their own policies, as their own controllers.
5. Who receives the data
| Recipient | Role | What they get |
|---|---|---|
| Cloudflare, Inc. (United States) | Processor — hosting, CDN, R2 image storage, security | All technical request data, necessarily, since every request passes through it |
| Google LLC (YouTube) | Independent controller for the embedded player | Your IP address and player data, only after you click a video thumbnail |
{{TO BE COMPLETED: advertising network / SSP}} | Independent controller or joint controller, depending on the contract | Nothing today. Once live and once you accept: device and browsing data for ad selection and measurement |
{{TO BE COMPLETED: affiliate networks / CPA platforms}} | Independent controllers | Nothing today. Once live: the fact that a click came from a given placement, plus whatever their own tracking collects after the redirect |
{{TO BE COMPLETED: analytics provider}} | Processor, or independent controller depending on the tool | Nothing today |
{{TO BE COMPLETED: email service provider}} | Processor | Nothing today |
| Authorities, courts, our advisers | Recipients where the law requires it or a right must be defended | Only what is strictly necessary in that case |
We do not sell your personal information for money. Once personalised advertising is live, the data flows it involves count as a sale or a share under California law — see section 10.
6. Transfers outside the EU and the UK
Cloudflare is established in the United States and operates a worldwide network, so technical request data is processed outside the EEA. Cloudflare acts as our processor under a data processing agreement, and transfers rely on the European Commission's standard contractual clauses and, where applicable, on its certification under the EU–US Data Privacy Framework:{{TO BE COMPLETED: reference and date of the signed Cloudflare DPA, and the transfer mechanism actually relied on}}.
The YouTube player is served by Google, also established in the United States, and only after your click. Transfers linked to advertising, analytics and emailing will be listed here once those providers are chosen:{{TO BE COMPLETED: transfer mechanism for each future provider}}.
You may ask us for a copy of the safeguards in place, at the privacy contact address in section 2.
7. How long we keep it
| Data | Retention |
|---|---|
| Technical request logs at Cloudflare | Kept by Cloudflare for its own delivery and security purposes, for the period set by the plan in use —{{TO BE COMPLETED: exact log retention of the Cloudflare plan subscribed}}. We set the target at a maximum of 12 months. |
| Aggregate, non-identifying traffic statistics | Up to 25 months |
| Your consent choice in your browser | The current implementation sets no expiry: the value stays until you clear your browser storage or change your choice. Target: re-ask after 6 months —{{TO BE COMPLETED: implement a 6-month expiry on the stored choice}}. |
| Affiliate click records (once live) | 13 months, the usual attribution window; aggregate counts kept longer |
| Advertising and analytics identifiers (once live) | Set by each provider, capped at 13 months for identifiers tied to a device |
| Newsletter subscription (once live) | Until you unsubscribe, then 3 years from the last interaction; proof of consent kept 5 years |
| Emails you send us | 12 months after the exchange ends, or 3 years for a rights request, to prove we answered |
| Accounting records tied to advertising or affiliate revenue | As required by tax law, typically 10 years; these concern our partners, not readers |
8. Your rights under the GDPR
If you are in the EEA, the UK or Switzerland, you have the right to:
- Access — know whether we process data about you, and get a copy.
- Rectification — have inaccurate data corrected.
- Erasure — have data deleted, where no obligation makes us keep it.
- Restriction — have processing frozen while a dispute is settled.
- Portability — receive, in a machine-readable format, the data you gave us on the basis of consent or a contract.
- Objection — object to processing based on our legitimate interest, including security logging.
- Withdraw consent — at any time, and as easily as you gave it. Use the cookie banner controls described in the cookie policy.
Withdrawing consent does not undo what was lawfully done before you withdrew it.
8.1 How to exercise them
Write to {{TO BE COMPLETED: contact email address for privacy requests}}, with the subject line Privacy request. Tell us which right you are exercising. You do not need a form or a template.
We answer within one month. If the request is complex, we may extend by two further months and we will tell you why within the first month. The procedure is free unless a request is manifestly excessive or repetitive.
A practical warning: we hold almost nothing that identifies you. Technical logs are tied to an IP address, not to a name, and we have no way to confirm that a given IP address was yours at a given moment. To act on an access or erasure request about log data, we will ask you for the date, the approximate time and the IP address concerned. If we still cannot identify the data, we will tell you so rather than guess. We will not ask you for an identity document to answer a request about an IP address.
8.2 Complaints
You can lodge a complaint with a supervisory authority. The lead authority for this site is {{TO BE COMPLETED: competent supervisory authority, determined by the place of establishment of the controller}}. Independently of that, you may always complain to the data protection authority of the country where you live or work — the list is published by the European Data Protection Board. UK residents may contact the Information Commissioner's Office.
9. California residents: notice at collection
This section applies if you live in California, and completes the rest of this policy under the California Consumer Privacy Act as amended by the CPRA. Terms such aspersonal information, sale and share have the meaning given by that law.
| CCPA category | Collected? | Purpose | Sold or shared? |
|---|---|---|---|
| Identifiers (IP address, device and advertising identifiers) | Yes | Delivering the site, security, and — once live — advertising | Not today. Once personalised advertising is live: shared for cross-context behavioural advertising |
| Internet or network activity (pages viewed, referrer, clicks on partner links) | Yes | Delivering the site, measuring which placements work | Not today. Once live: shared with advertising partners |
| Geolocation data, coarse (country or region from the IP address) | Yes | Security, and serving the right language and the right offer | Not today. Once live: shared with advertising partners |
| Commercial information (which game offers you clicked) | Yes, once the redirect route is live | Measuring affiliate performance | Shared with the affiliate network concerned |
| Inferences drawn to build an interest profile | Not today | Ad personalisation, once live | Once live: shared with advertising partners |
| Contact details (your email address, if you write to us or subscribe) | Yes, if you provide them | Answering you; sending the newsletter you asked for | No. Never sold, never shared for advertising |
| Sensitive personal information | No | — | No |
| Biometric, education, employment, precise geolocation data | No | — | No |
We have never received money for your personal information, and we do not intend to. But California law treats the data flows behind personalised advertising as asale or a share even when no money changes hands. Section 10 is how you stop them.
We do not knowingly sell or share the personal information of consumers under 16 years of age.
9.1 Your California rights
- Right to know — the categories and specific pieces of personal information we collected about you, their sources, our purposes, and the categories of third parties involved, for the past 12 months and beyond.
- Right to delete — ask us to delete what we hold, subject to the exceptions in the statute.
- Right to correct — have inaccurate information corrected.
- Right to opt out of sale or sharing — see section 10.
- Right to limit the use of sensitive personal information — we collect none, so there is nothing to limit.
- Right to non-discrimination — opting out changes nothing about the site you get. No paywall, no degraded content, no different pricing. Nothing on this site is behind a login, so there is nothing to withhold.
Send California requests to{{TO BE COMPLETED: contact email address for privacy requests}}. We answer within 45 days and may extend once by a further 45 days, telling you why. We verify a request by matching what you tell us against what we hold; where we cannot verify it, we will say so and explain why. An authorised agent may act for you with written permission, and we may contact you to confirm it.
10. Do Not Sell or Share My Personal Information
This is the opt-out required by California law, and we treat it as applying to everyone, wherever they live.
How to opt out, today
Click Decline on the cookie banner. That is the opt-out signal. Your choice is stored in your browser and no advertising or measurement tag is allowed to load. If the banner is no longer showing, clear the site data formaxedrig.com in your browser settings, reload the page, and the banner comes back — the cookie policy gives the exact steps.
Two further points, stated plainly because they are true today:
- No advertising network is connected yet, so no sale or share is taking place at the moment. Declining now is recorded and will be applied the day one is connected.
- The current banner stores your choice but does not yet gate the loading of third-party tags, because there are none to gate. Consent enforcement — refusing non-essential storage by default and honouring the Global Privacy Control signal — must be in place before the first advertising tag goes live:
{{TO BE COMPLETED: implement consent enforcement and Global Privacy Control, and a dedicated opt-out link in the footer}}.
Opting out is per browser and per device, because the choice is stored on the device. If you use another browser, or clear its storage, tell us again.
11. Partner links and what happens after you click
Our partner links go through /go/<game>/?p=<placement>. The placement code tells us which position on the page was clicked — the intro, the end of the article, the sidebar, a card. It describes the page, not you.
After that redirect, you are on the game publisher's site or on an affiliate network's tracking domain. From that point their privacy policy applies, not ours, and they will set their own identifiers to credit the installation. We cannot switch that off for you, and we do not receive your account details, your email address or your payment data from them — only aggregate reports on installs and revenue.
How we are paid is explained on theaffiliate disclosure page.
12. Security
The site is static and has no visitor database to breach: there is no account, no login and no comment system. Everything is served over HTTPS. Cloudflare provides edge protection against bots and denial of service. Access to the publishing tooling is restricted to the editorial team.
13. Changes to this policy
We will update this page when the processing changes — and connecting an advertising network, an analytics tool or a newsletter provider is such a change. The date at the top is the date of the version you are reading. A substantive change will be flagged on the site before it takes effect, and anything requiring consent will ask for it again.
14. Still to be completed
- Controller's legal name and registered address
- Privacy contact email address
- DPO, or a documented statement that none is required
- Article 27 EU/UK representative, if the controller is established outside the EU/UK
- Advertising network, analytics tool, email service provider, affiliate networks
- Reference of the Cloudflare data processing agreement and the transfer mechanism relied on
- Exact Cloudflare log retention for the plan in use
- Competent lead supervisory authority
- Technical work: consent enforcement, Global Privacy Control, 6-month expiry on the stored choice, footer opt-out link