Privacy policy
1. Data controller
José Antonio Peña Alonso. Data protection contact: [email protected].
2. What data we process and why
| Data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Name, email and Google account identifier (when you sign in with Google; we never receive your password) | Creating and managing your account | Performance of a contract (Art. 6(1)(b)) | Until you delete your account |
| Chosen username and language | Showing you in the forum and in your language | Performance of a contract (Art. 6(1)(b)) | Until you delete your account |
| Map playthroughs, progress, notes and favourites, completed missions | Saving your progress. They are private: nobody else sees them, not even administrators, unless you share a playthrough | Performance of a contract (Art. 6(1)(b)) | Until you delete them or your account |
| Forum threads and replies, and suggested map points | Publishing your content | Performance of a contract (Art. 6(1)(b)) | Until you delete them or your account |
| Reports you send or receive and moderation actions (blocks, removed content and the reason) | Moderating the community, complying with the Digital Services Act and handling complaints | Legal obligation and legitimate interest (Art. 6(1)(c) and 6(1)(f)) | Reports: until resolved. Moderation log: 2 years |
| Record of acceptance of terms and privacy policy (date and version) | Proving consent and acceptance | Legal obligation (Art. 6(1)(c)) | While the account exists and applicable limitation periods |
| IP address (only as a temporary anti-abuse key) | Security and preventing spam and attacks | Legitimate interest (Art. 6(1)(f)) | 2 hours maximum |
| Anonymous, aggregated visit statistics (Umami, cookie-free) | Understanding which content is useful | Legitimate interest (Art. 6(1)(f)) | No identifiable personal data |
| Google AdSense advertising cookies and identifiers | Showing ads, personalized or not | Consent (Art. 6(1)(a)), requested by Google's consent message | See the cookie policy |
Guest data (guest favourites and map preferences) is stored only in your browser and never reaches our servers. Users cannot upload files.
3. Processors and recipients
- Cloudflare, Inc.: hosting, database, storage and security. Transfers covered by the EU-U.S. Data Privacy Framework and standard contractual clauses.
- Google LLC / Google Ireland Ltd.: Google sign-in (provides your name, email and account identifier when you choose to sign in) and AdSense advertising with its consent message. Subject to Google's privacy policy and the EU-U.S. Data Privacy Framework.
- Umami: cookie-free analytics without identifiable personal data.
- YouTube and Spotify: their players load only when you press play.
- Rockstar Games, Wikimedia Commons and the linked official stores: some images load from their servers, which receive your IP address as with any website visit. We do not send them the page you come from.
We do not sell your data or share it with third parties except where required by law.
4. Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction and portability, and withdraw consent at any time:
- Directly from My account: change your username and language (rectification), download all your data (portability), sign out on all your devices or delete your account (erasure).
- By writing to [email protected].
If you believe we have not handled your rights properly, you can complain to the Spanish Data Protection Agency (AEPD, www.aepd.es) or your local supervisory authority.
5. Children
You must be at least 14 years old to register. If we detect an account of a child under 14 without parental authorization, we will delete it.
6. Security
Traffic is encrypted (HTTPS only), sign-in is only through Google (OpenID Connect), so we store no passwords, and sessions use HttpOnly cookies. We apply rate limits, anti-spam filters, security headers and moderation of published content.
7. Changes
If we make significant changes to this policy, we will announce them on the site.