Privacy policy

Who is responsible

SpaceDino Games is the controller for the data described here. Write to privacy@spacedino.fun with any question or request about your rights.

What we measure

For every page view: the page path without its query string, the page title, the referring site, your browser, operating system and device type, screen size, browser language, and an approximate country, region and city.

Which game you open from the catalogue, as the game slug and its category. Nothing that happens inside a game is reported to us.

A pseudonymous visit identifier derived by hashing the site id, your IP address, your browser user agent and a secret salt that is replaced every day. Because the salt changes daily the identifier cannot be linked across days. It is pseudonymous, not anonymous, and we treat it as personal data.

What we store in your browser

No cookies are set, for analytics or anything else on this page. We do use two entries in your browser’s local storage: one remembers the choices you made here, the other is the flag that switches measurement off when you object. Both stay on your device and are never sent to us.

Clearing your site data removes both, and this page will ask again.

What we never collect

Your IP address is used in memory to derive the daily identifier and an approximate location, and is never written to our database.

No session recording, no keystrokes, no form values, no page content. Session replay is switched off in the analytics server configuration and the collection endpoint rejects replay data while it stays off.

On our own pages, apart from the advertising network described below: we do no cross-site tracking of our own, build no advertising or marketing profiles of our own, involve no analytics company, and no analytics data leaves the European Economic Area.

Password reset links carry a token in the address bar. Query strings are stripped from both the page address and the referrer before anything is recorded, so that token never reaches the analytics store.

We do not use any of this for automated decision-making or profiling in the sense of Art. 22 GDPR.

Heatmap, only with your consent

If you turn the heatmap on, we also record the coordinates of your clicks, the size of your window and page, and how far down a page you scrolled. It is aggregated to show which parts of a page get used.

It stays off until you switch it on, and you can switch it back off at any time. Withdrawing stops the collection at once and does not make the earlier collection unlawful.

Why we are allowed to do this

Visit measurement rests on our legitimate interest in understanding and improving our own site (Art. 6(1)(f) GDPR). It is limited to aggregate audience measurement for this site alone, sets no cookie and builds no profile. You can object at any time with one click, and we act on it from that moment; the page views recorded before you objected stay until their retention period runs out.

The heatmap rests on your consent (Art. 6(1)(a) GDPR and Art. 5(3) ePrivacy Directive). Withdrawing it has no consequence other than stopping the collection.

Who else touches the data

Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, hosts the server the site and the analytics run on.

Amazon Web Services EMEA SARL delivers account confirmation and password-reset email from its Frankfurt region (Amazon SES). It processes your email address for that purpose alone and receives no analytics data.

Apart from GamePix on partner game pages (see below), there is no other recipient of what we measure. Nothing we measure is sold, shared with advertisers or transferred outside the European Economic Area. The advertising network is not given our analytics: your browser contacts it directly when a catalogue page, an interstitial or a reward link loads.

Where it is stored and for how long

On a server we rent from Hetzner in Falkenstein, Germany. The analytics software runs on that machine and no analytics data leaves it.

Visit measurement is deleted after 13 months. Heatmap data is deleted after 90 days. Deletion runs automatically every day.

Your account, if you create one

You can play everything here without an account. If you create one, we need your username, email address and a password to give you one — without them the account cannot exist. We store the username, the email address and a hash of the password, never the password itself.

Account data is separate from analytics and is kept until you ask us to delete the account.

Advertising

When advertising is enabled, catalogue pages load an advertising script. Our own games use the same network in two separate ways. A reward opens an advertising link in a new tab; you claim the reward in the game after a short wait. Starting play or continuing a level can open an advertising page in a browser tab behind the game; play on this tab continues.

That network receives your IP address and browser details directly from your browser, and it may set its own cookies and build its own profile. We do not receive what you do on the advertising page. Nothing that happens inside a game is added to our analytics. You can play without asking for a reward.

Partner games

Most games in the catalogue come from GamePix S.r.l., Via Marsala 29H, 00185 Rome, Italy. When you open one, its page here loads the game in a frame from play.gamepix.com, so your browser connects to GamePix directly and GamePix receives your IP address, browser details and the address of the page.

GamePix shows advertising in those games and, according to its own privacy policy (gamepix.com/privacy-cookie), uses cookies and partners such as Google Ad Manager and Google Analytics. What happens inside the frame is decided by GamePix and governed by that policy; the choices you make on this site do not reach into it.

We receive nothing about what you do inside a partner game. Our own games, listed as SpaceDino originals, load nothing from GamePix. We link partner games because their advertising lets us offer a large catalogue for free (Art. 6(1)(f) GDPR).

Your rights

You may object to visit measurement or withdraw heatmap consent at any time using the button below; both take effect in your browser immediately.

You have the right of access, rectification, erasure, restriction, portability and objection, and the right to complain to a supervisory authority in the country where you live or work.

Analytics data carries no name and no email address, so we normally cannot tell which rows are yours (Art. 11 GDPR). If you want us to try, send us your IP address, your browser user agent and the date: the identifier is reproducible, so we can find and delete records from the same day. Older days used a different secret salt and cannot be resolved. Your rights over your account data are unaffected and always answerable.