Privacy policy

Who is responsible

SpaceDino Games is the controller for the data described here. Write to privacy@spacedino.fun with any question or request about your rights.

What we measure

For every page view: the page path without its query string, the page title, the referring site, your browser, operating system and device type, screen size, browser language, and an approximate country, region and city.

Which game you open from the catalogue, as the game slug and its category. Nothing that happens inside a game is reported to us.

A pseudonymous visit identifier derived by hashing the site id, your IP address, your browser user agent and a secret salt that is replaced every day. Because the salt changes daily the identifier cannot be linked across days. It is pseudonymous, not anonymous, and we treat it as personal data.

What we store in your browser

No cookies are set, for analytics or anything else on this page. We do use two entries in your browser’s local storage: one remembers the choices you made here, the other is the flag that switches measurement off when you object. Both stay on your device and are never sent to us.

Clearing your site data removes both, and this page will ask again.

What we never collect

Your IP address is used in memory to derive the daily identifier and an approximate location, and is never written to our database.

No session recording, no keystrokes, no form values, no page content. Session replay is switched off in the analytics server configuration and the collection endpoint rejects replay data while it stays off.

No cross-site tracking, no advertising or marketing profiles, no analytics company involved at all, and no analytics data leaving the European Economic Area.

Password reset links carry a token in the address bar. Query strings are stripped from both the page address and the referrer before anything is recorded, so that token never reaches the analytics store.

We do not use any of this for automated decision-making or profiling in the sense of Art. 22 GDPR.

Heatmap, only with your consent

If you turn the heatmap on, we also record the coordinates of your clicks, the size of your window and page, and how far down a page you scrolled. It is aggregated to show which parts of a page get used.

It stays off until you switch it on, and you can switch it back off at any time. Withdrawing stops the collection at once and does not make the earlier collection unlawful.

Why we are allowed to do this

Visit measurement rests on our legitimate interest in understanding and improving our own site (Art. 6(1)(f) GDPR). It is limited to aggregate audience measurement for this site alone, sets no cookie and builds no profile. You can object at any time with one click, and we act on it from that moment; the page views recorded before you objected stay until their retention period runs out.

The heatmap rests on your consent (Art. 6(1)(a) GDPR and Art. 5(3) ePrivacy Directive). Withdrawing it has no consequence other than stopping the collection.

Who else touches the data

Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, hosts the server the site and the analytics run on.

Amazon Web Services EMEA SARL delivers account confirmation and password-reset email from its Frankfurt region (Amazon SES). It processes your email address for that purpose alone and receives no analytics data.

There is no other recipient. Nothing is sold, shared with advertisers or transferred outside the European Economic Area.

Where it is stored and for how long

On a server we rent from Hetzner in Falkenstein, Germany. The analytics software runs on that machine and no analytics data leaves it.

Visit measurement is deleted after 13 months. Heatmap data is deleted after 90 days. Deletion runs automatically every day.

Your account, if you create one

You can play everything here without an account. If you create one, we need your username, email address and a password to give you one — without them the account cannot exist. We store the username, the email address and a hash of the password, never the password itself.

Account data is separate from analytics and is kept until you ask us to delete the account.

Your rights

You may object to visit measurement or withdraw heatmap consent at any time using the button below; both take effect in your browser immediately.

You have the right of access, rectification, erasure, restriction, portability and objection, and the right to complain to a supervisory authority in the country where you live or work.

Analytics data carries no name and no email address, so we normally cannot tell which rows are yours (Art. 11 GDPR). If you want us to try, send us your IP address, your browser user agent and the date: the identifier is reproducible, so we can find and delete records from the same day. Older days used a different secret salt and cannot be resolved. Your rights over your account data are unaffected and always answerable.