Privacy policy

Last updated: 12 September 2026

This page says what happens to your data when you use this site.

The short version

  • No account, no login, no profile.
  • We do not track you across other websites.
  • Analytics run without cookies unless you allow them. Nothing else loads before you agree.
  • Fonts are served from our own server, so your browser never calls a font provider.
  • Our servers and database are in the EU.

Who is responsible

The controller is the operator named in the legal notice. Use the contact details there for anything on this page.

Visiting a page

Our hosting provider writes a server log for every request. It holds your IP address, the time, the page you asked for, the referring page, and your browser and operating system.

We need this to deliver the site and to spot attacks and faults, and rely on our legitimate interest in a site that works and stays secure (Article 6(1)(f) GDPR).

Cookies and local storage

We store your consent choice in your browser so we do not have to ask again. Anything that is not strictly necessary runs only after you allow it (Article 6(1)(a) GDPR). The cookie policy lists what is stored, and lets you change or withdraw your choice at any time.

Analytics

We measure which pages get used, and record errors, with PostHog. The data is stored on PostHog's EU servers.

Without your consent this runs cookieless. Nothing is stored on your device, and your IP address is only used to tell visits apart for a short time. We rely on our legitimate interest in knowing what works on the site (Article 6(1)(f) GDPR), and you can object at any time (Article 21).

If you allow the measurement category, an identifier is stored in your browser so repeat visits can be recognised (Article 6(1)(a) GDPR). You can withdraw it through the privacy settings in the footer.

Embedded videos and store widgets

Pages on this site can embed YouTube videos and Steam store widgets. Both stay blocked behind a placeholder until you allow functionality cookies.

Once you allow them, your browser connects directly to the provider and the provider receives your IP address, and can set its own cookies:

This happens on your consent (Article 6(1)(a) GDPR). Withdrawing it stops future loads but cannot undo what the provider already received.

Who else processes your data

We do not run our own hardware. Hosting, the database and image storage are handled by service providers that act as processors for us, each under a data processing agreement. Our servers and database run in the EU; images are delivered from a network with locations worldwide. Server logs reach the hosting provider as part of that.

Transfers outside the EU

We keep our own processing in the EU. Some of our providers are US companies, so a transfer can still happen. Those transfers rely on the EU Standard Contractual Clauses, and on the EU-US Data Privacy Framework where the provider is certified.

Loading an embedded YouTube video or Steam widget does transfer data to the US, because those providers serve them from there. That happens only if you allow functionality cookies.

How long we keep things

Server logs are deleted within days, analytics events after a year at most. Both are stored for us by our providers, who delete them on their own schedule. Your consent choice stays in your browser until you clear it.

Anything else we keep only as long as we need it for the purpose it was collected for, or as long as the law requires us to keep it.

Your rights

You can ask us what we hold about you, have it corrected or deleted, have its use restricted, or get it in a portable format.

You can object at any time to anything we base on our legitimate interest, and you can withdraw consent at any time without affecting what was lawful before.

Where we cannot tell who you are — server logs and analytics — there is nothing for us to look up. Where you gave us something that identifies you, these rights apply in full.

Write to the contact address in the legal notice. We answer within one month.

Complaints

You can complain to a data protection authority, in particular the one where you live, where you work, or where the alleged breach happened.