Privacy at Boin Games

Information we process

Our analytics records page views using an event identifier, time, page path, URL and referrer with query strings removed. The receiving service also records a coarse country and Cloudflare data-centre code. Boin Games sends no visitor or session identifiers.

To estimate daily visitor numbers, the analytics Worker uses the connection IP address, UTC day and a coarse browser-family bucket as transient input to a keyed calculation. It updates one value in a daily 64-register statistical sketch. No raw IP addresses, complete user-agent strings, HMAC digests or per-person anonymous tokens are stored or logged by our analytics application.

If you email us, we process your email address and the information you include so that we can respond.

Why we process it

We use aggregate statistics to understand whether the site is being used, identify broad page-view patterns and improve the service. Our UK GDPR lawful basis is our legitimate interest in operating and improving the Boin Games website.

For browser analytics technology, we rely on the statistical purposes exception and provide the simple objection control below. We do not use this information for advertising, profiling, automated decisions or tracking people across days.

Browser storage

Anonymous analytics creates no analytics identity cookie, local-storage identifier or session-storage identifier. If you turn analytics off, this browser stores only the value boingames_analytics_opt_out=1. That preference is not an identity, is not sent with analytics events and can be removed by turning analytics on again.

If you choose a different site palette, this browser stores the selected colour palette under boingames_palette. It contains only workshop, signal orbruise. It is not an identity or analytics value and is not sent with analytics events.

Retention

Anonymous raw page-view events are staging data. An hourly job rolls up events older than 48 hours and deletes the raw rows. Daily page totals and visitor-estimate registers are retained within a configured 180-day window, then deleted.

Privacy correspondence is kept only for as long as reasonably necessary to answer the request and meet any legal obligations.

Processors and international transfers

Cloudflare hosts this website, the analytics Worker and its database, and processes the network request on our behalf. Cloudflare and its subprocessors may process information outside the UK. Restricted transfers are covered by Cloudflare's Data Processing Addendum, including the UK Addendum to the standard contractual clauses where applicable.

Apple provides iCloud Mail for correspondence sent to our domain and processes and stores those messages. Apple says that personal data relating to people in the UK is controlled by Apple Distribution International Limited in Ireland, and that its international transfers are governed by standard contractual clauses.

We do not sell analytics information. We disclose information only to service providers operating the site or where the law requires it.

Your rights

Depending on the circumstances, you may have rights to access, correct or erase personal information, restrict its use, receive a portable copy and object to processing based on legitimate interests. There is no automated decision-making or profiling.

Because our analytics does not retain a visitor identifier, we may be unable to connect a particular anonymous event or daily estimate to you. You can object to future analytics at any time using the control above.

Complaints

Please contact us first if you have a concern. You also have the right to complain to the UK Information Commissioner's Office through its complaints service.