Privacy policy

1. Who is responsible

The controller of your personal data on unblockedio.games (the “Service”) is:

We have not appointed a data protection officer, as we are not required to. Contact us at the address above about anything in this policy.

2. What we collect and why

Visiting the site (everyone)

When you load a page our hosting provider processes technical data that every browser sends: IP address, browser type, the page requested and the time. We use it to deliver the site, keep it secure and stop abuse (for example, rate limiting).
Legal basis: our legitimate interest in operating a secure website (Art. 6(1)(f) GDPR).

Your account (if you sign in)

• Email address — to sign you in with a one-time link and to contact you about your submissions or claims.
• Google or Discord sign-in — if you choose it, we receive your email address and profile picture from that provider. We never receive your password.
• Your activity — games you submit, votes you cast, reports you send and ownership claims you make.

Legal basis: performance of our agreement with you, i.e. the Terms of use (Art. 6(1)(b) GDPR).

Developers who claim a game

If you verify ownership of a game we store the verification method and time. Contact details you add to a game page (email address, website) are published on that page because you ask us to show them. You can remove them at any time.
Legal basis: performance of our agreement with you (Art. 6(1)(b) GDPR).

Moderation and safety

We review submitted games and reports, and may restrict accounts that break our rules. For this we keep the content concerned, our decision and its reasons.
Legal basis: our legitimate interest in keeping the Service safe, and our obligations under the EU Digital Services Act (Art. 6(1)(c) and (f) GDPR).

Analytics

We use Google Analytics to understand how the Service is used — pages viewed, games played, searches and the device and approximate location (country/city) derived from your IP address. We do not use it to identify you.
In the EEA, the UK and Switzerland this happens only with your consent; until then Google Analytics runs without cookies and only receives anonymous, aggregated signals.
Legal basis: your consent (Art. 6(1)(a) GDPR).

Advertising

The Service is free and funded by ads from Google AdSense. With your consent Google and its advertising partners may use cookies and similar identifiers to show personalised ads and measure their performance. If you do not consent, Google may still show non-personalised ads, which are based on the page you are viewing rather than on your browsing history, without advertising cookies.
Legal basis: your consent (Art. 6(1)(a) GDPR) for personalised advertising and ad cookies.

3. Cookies

Visitors in the EEA, the UK and Switzerland are asked for consent through Google’s certified consent management platform (CMP), which lists our advertising partners and lets you accept, reject or customise their use of your data. We set non-essential cookies there only after you agree. The full list is in our cookie policy.

4. Who we share data with

We do not sell your personal data. We use these service providers, who process data on our behalf or as independent controllers:

• Supabase Inc. — database, sign-in and file storage (processor).
• Netlify Inc. — website hosting and delivery (processor).
• Google Ireland Ltd / Google LLC — Google sign-in, Analytics, Tag Manager, AdSense and our consent dialog (processor for Analytics; independent controller for sign-in and advertising).
• Advertising partners — the ad technology vendors listed in the consent dialog, only with consent (independent controllers).
• Meta Platforms Ireland Ltd — Meta Pixel ad measurement, only with consent (joint controller for the collection of data via the Pixel).
• Discord Inc. — Discord sign-in, if you choose it (independent controller).
• Email delivery provider — to send sign-in links (processor).

We may also disclose data where required by law, for example to a court or authority with a valid request.

Games are third-party websites

Games listed here are made and hosted by independent developers. When you play a game — on its own site or embedded in our player — that developer’s website receives your data directly and processes it under its own privacy policy. We are not responsible for how game websites handle data.

5. Transfers outside the EU

Some providers above are based in, or may access data from, the United States. Where that happens the transfer is protected by the EU–U.S. Data Privacy Framework (for certified companies) or by the European Commission’s Standard Contractual Clauses (Art. 46 GDPR).

6. How long we keep data

• Account data and votes — while your account exists. When you ask us to delete your account we erase it within 30 days.
• Submitted games — while the game is listed. If you delete your account, games you submitted may stay listed but are no longer linked to you.
• Reports and moderation records — up to 12 months after the case is closed, or longer if needed to defend legal claims.
• Unfinished ownership claims — expire after 7 days.
• Server logs — kept by our hosting provider for a short period, normally no longer than 30 days.
• Analytics data — 14 months.
• Your cookie choice — 6 months, after which we ask again.

7. Your rights

You have the right to:

• access the personal data we hold about you and get a copy of it;
• have inaccurate data corrected;
• have your data erased (including deleting your account);
• restrict or object to processing based on our legitimate interests;
• receive your data in a portable format;
• withdraw consent at any time — this does not affect processing before withdrawal.

To use these rights, email hi@giffi.ee from the address linked to your account. We reply within one month.

You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), www.aki.ee, or to the supervisory authority where you live.

8. Children

Anyone can browse and play games without an account. To create an account you must be at least 16 years old, or have consent from a parent or guardian. If you believe a child under 16 has given us personal data without that consent, contact us and we will delete it.

9. Security

We protect data with encryption in transit (HTTPS), strict access controls, sandboxing of third-party games and regular updates. No system is perfectly secure; if a breach affects your rights we will tell you and the authorities as the GDPR requires.

10. Changes

We may update this policy. The date at the top shows the latest version. If we make significant changes we will tell signed-in users and, where needed, ask for consent again.