Privacy policy

Who is responsible

The operator named in the footer is the controller of your personal data. Company name, registration number and address: see the footer and the contact page.

Data protection contact: write to the contact address on the contact page.

What we collect

• Account: your email address, a display name and a password. We store the password only as a hash (a one way scrambled form). We never store or see the plain password.
• Sign up: you tick a box to say you are 18 or older. We do not ask for your date of birth.
• Login: a session record, so you stay signed in. We store a hash of the session token and its end date, not the token itself.
• Reviews: the rating and text you write. Once approved they are shown with your display name, never your email.
• Forum: the topics, replies and reports you write. They are shown with your display name, never your email.
• Bonus votes: if you vote whether a bonus worked, we store your vote with your account.
• Newsletter: your email address, your language, your status (waiting, confirmed or unsubscribed) and the dates you signed up and confirmed. This is our record of your consent.

Visit statistics

We use Vercel Web Analytics to count visits: which pages are viewed, the visitor's country, the type of device and browser, and the page that sent the visitor. It sets no cookies and does not follow you across other websites. The figures are anonymous and we use them only to improve the site.

What we do not collect

• We do not store IP addresses.
• We do not collect payment or card data. We do not take payments.
• We do not ask for your real name, home address or date of birth.
• We do not use advertising cookies or tracking cookies. We do not use advertising trackers.

IP addresses and your country

Your IP address reaches our server with every request, as it does for any website. We do not save it in our database. We use it for two short tasks: to limit how often one visitor can sign in, sign up or use the search or the wheel (we use a scrambled form of it, which cannot be read back), and to keep the site safe.

To decide whether we may show an affiliate link, our host tells our server which country the request came from. We use that country for that request only. We do not save it.

Why we use your data, and the legal basis

• To run your account, sign you in and keep your sessions: needed for the contract with you (Article 6(1)(b) GDPR).
• To show your reviews and forum posts, and to moderate them: our legitimate interest in a useful, safe site (Article 6(1)(f)).
• To send you the newsletter you asked for: your consent (Article 6(1)(a)). You can withdraw it at any time with the unsubscribe link in each email.
• To stop abuse, spam and attacks, and to keep the site secure: our legitimate interest (Article 6(1)(f)).
• To decide where affiliate links may be shown: our legitimate interest, and the need to follow local law (Article 6(1)(f)).

Who handles your data, and where

We use these service providers (processors). We do not sell your data.

• Vercel: hosts the website. Servers in Frankfurt, Germany (EU).
• Neon: hosts the database with your account, reviews, posts and newsletter record. Servers in Frankfurt, Germany (EU). Data is encrypted at rest by the provider.
• Brevo: sends our emails, such as the newsletter confirmation and welcome email. It receives your email address and the email text.
• Upstash: stores short lived counters for rate limits. It holds only scrambled keys, no readable IP address and no email.

How long we keep data

• Account: until you ask us to delete it.
• Sessions: 30 days. Expired sessions are deleted when a new session is created.
• Reviews, forum posts and votes: until you ask us to delete them or until the account is deleted.
• Newsletter: until you unsubscribe or ask us to delete it. Waiting (unconfirmed) sign ups are not used for mailings.
• Rate limit counters: a short time only, up to the length of the limit (minutes to hours).
• Backups: kept by our database provider for a limited time.

Your rights

You can ask us to give you a copy of your data, to correct it, to delete it, to limit how we use it, or to move it to another service. You can object to processing based on our legitimate interest. You can withdraw consent at any time, for example by using the unsubscribe link. Withdrawing does not make earlier use unlawful.

You can complain to a data protection authority. This can be the authority in the country where you live or where you work, or the authority where the operator is established: [SUPERVISORY AUTHORITY, to be named by the owner and the lawyer].

How to ask for deletion

Write to the contact address on the contact page from the email address of your account. Say what you want us to delete. We may ask a question to be sure it is you. We will answer within one month.

If we delete your account, we remove your sessions and your account data. We remove or anonymise your reviews and forum posts. Your newsletter sign up is a separate record: ask us to remove it too, or use the unsubscribe link. Some posts may stay visible if we need them to keep the forum readable or to follow the law.

Children

This site is for people aged 18 and over. We do not knowingly collect data from anyone under 18. If you think a child has given us data, write to us and we will delete it.

How we protect your data

• Passwords are stored with Argon2id, a strong one way hash, and not in readable form.
• Session tokens are stored only as hashes. Our session cookie cannot be read by scripts on the page.
• The private links we use for affiliate partners are stored encrypted.
• Administrator accounts need a second step (a code from an app) to sign in.
• Forms are protected against cross site requests, and sign ins are rate limited.
• Traffic to the site uses HTTPS.
• No security is perfect. If a breach puts your rights at risk, we will tell you and the authority as the law requires.

Cookies and browser storage

We set only what the site needs to work. We use no advertising or tracking cookies. Our visit statistics (see above) use no cookies and no browser storage. This is the full list.

• cr_session (cookie): keeps you signed in. Set when you sign up or sign in. Lasts up to 30 days or until you sign out. HttpOnly, SameSite Lax, Secure on the live site.
• cr_prelogin (cookie): only for administrators, between the password step and the code step. Lasts 5 minutes.
• theme (browser storage): remembers your light or dark choice. Set only when you use the theme switch. Stays until you clear your browser data.
• cr.langbanner (browser storage): remembers that you closed the small language suggestion. The suggestion uses your device's time zone, which is read in your browser and is not sent to us. Stays until you clear your browser data.
• cr.age18, cr.rocket, cr.plinko (browser storage): used only by the free play games, if they are switched on. They remember that you confirmed you are 18 and your play coins (not real money). Stay until you clear your browser data.

Changes

We may change this policy. Last updated: 30 October 2026.