Privacy policy
1. Data controller
José Antonio Peña Alonso. Data protection contact: [email protected].
The address [email protected] belongs to the owner of this site and is the contact for any privacy matter.
2. What data we process and why
| Data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Name, email and Google account identifier (when you sign in with Google; we never receive your password) | Creating and managing your account | Performance of a contract (Art. 6(1)(b)) | Until you delete your account |
| Chosen username and language | Showing you in the forum and in your language | Performance of a contract (Art. 6(1)(b)) | Until you delete your account |
| Map playthroughs, progress, notes and favourites, completed missions | Saving your progress. They are private: nobody else sees them, not even administrators, unless you share a playthrough | Performance of a contract (Art. 6(1)(b)) | Until you delete them or your account |
| Forum threads and replies, and suggested map points | Publishing your content | Performance of a contract (Art. 6(1)(b)) | Until you delete them or your account |
| Reports you send or receive and moderation actions (blocks, removed content and the reason) | Moderating the community, complying with the Digital Services Act and handling complaints | Legal obligation and legitimate interest (Art. 6(1)(c) and 6(1)(f)) | Reports: until resolved. Moderation log: 2 years |
| Record of acceptance of terms and privacy policy (date and version) | Proving consent and acceptance | Legal obligation (Art. 6(1)(c)) | While the account exists and applicable limitation periods |
| IP address (only as a temporary anti-abuse key) | Security and preventing spam and attacks | Legitimate interest (Art. 6(1)(f)) | 2 hours maximum |
| Our own anonymous, aggregated usage statistics (no cookies): page views and clicks per section. To count distinct visitors we compute a fingerprint of the IP address and browser mixed with a random key that changes every day | Knowing which sections and features are used most | Legitimate interest (Art. 6(1)(f)) | Fingerprint: 2 days. Counters: no personal data |
| Database backups (private Cloudflare R2 storage) | Being able to restore the site and data after a failure | Legitimate interest (Art. 6(1)(f)) | 30 days |
| Google AdSense advertising cookies and identifiers | Showing ads, personalized or not | Consent (Art. 6(1)(a)), requested by Google's consent message | See the cookie policy |
| Inactive accounts | Not keeping data that is no longer used | Legitimate interest and storage limitation (Art. 5(1)(e)) | If you do not sign in for 3 years we email you; if you do not sign in within the next 30 days, the account and all its content are deleted |
Guest data (guest favourites and map preferences) is stored only in your browser and never reaches our servers. Users cannot upload files.
3. Processors and recipients
- Cloudflare, Inc.: hosting, database, storage, backups and security. It processes your IP address only to deliver the site and protect it against attacks and abuse.
- Google LLC / Google Ireland Ltd.: sign-in with Google (it gives us your name, email and account identifier when you choose to sign in), AdSense advertising and measurement with Google Analytics through Google Tag Manager. Advertising and measurement cookies are only used if you accept them in Google's consent notice, certified under the IAB Europe TCF and connected to Google Consent Mode.
- Our own statistics: anonymous cookie-free counters stored in our Cloudflare database; they are not shared with anyone.
- Resend (Plus Five Five, Inc.): sending the site's emails (moderation and inactive-account notices, and report alerts to the team).
- YouTube and Spotify: their players load only when you press play.
- Rockstar Games, Wikimedia Commons and the linked official stores: some images load from their servers, which receive your IP address as with any website visit. We do not send them the page you come from.
International transfers. Cloudflare, Google and Resend may process data outside the European Economic Area, mainly in the United States. These transfers are covered by the EU-U.S. Data Privacy Framework and, failing that, by the standard contractual clauses approved by the European Commission.
We do not sell your data or share it with third parties except where required by law.
4. Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction and portability, and withdraw consent at any time:
- Directly from My account: change your username and language (rectification), download all your data (portability), sign out on all your devices or delete your account (erasure).
- By writing to [email protected].
If you believe we have not handled your rights properly, you can complain to the Spanish Data Protection Agency (AEPD, www.aepd.es) or your local supervisory authority.
You can also complain to the data protection supervisory authority of your country of residence or work, or of the place of the alleged infringement.
5. Children
You must be at least 14 years old to register. If we detect an account of a child under 14 without parental authorization, we will delete it.
6. Security
Traffic is encrypted (HTTPS only), sign-in is only through Google (OpenID Connect), so we store no passwords, and sessions use HttpOnly cookies. We apply rate limits, anti-spam filters, security headers and moderation of published content.
7. Changes
If we make significant changes to this policy, we will announce them on the site.