Privacy & Cookie Notice

Effective and last updated: 23 July 2026

In short: GameFoundry does not sell personal data, run behavioural advertising, or use third-party analytics or tracking cookies. We collect only what is needed to provide accounts, host community games, operate ratings and prizes, answer messages, and protect the service.

1. Who controls your data

GameFoundry is an independent project founded and operated by Maksim Ilin ("GameFoundry", "we", "us"). GameFoundry is the controller of personal data described in this notice. For privacy requests, use the Support button available on every page and include an email address at which we can verify and answer your request.

This notice applies to www.gamefoundry.co.uk, the isolated game-content origin, and the related GameFoundry service. A game developer may independently process information through their game or linked service; their own notice then applies.

2. Data we collect and where it comes from

• Account and agreement data: username, email address and verification status, password hash, account dates, administrator status, and the date/version of Terms accepted. We receive these from you. We never store the password itself.
• Public profile and submitted content: optional biography, public contact details and links, wallet/tip links, games, builds, screenshots, trailers, descriptions, reviews, ratings and usernames. You choose what to submit; public fields and published content are visible worldwide.
• Activity and contest data: game plays/download counts, ratings, reviews, voluntary player name and scores, tip-link clicks, prize eligibility, wallet information supplied for a payout, transaction hash, and prize history.
• Support, safety and legal data: messages, contact details, reports, moderation records, evidence of abuse, and correspondence. Reports may include information supplied by another user.
• Technical data: IP address and request metadata processed by our host and temporarily by rate-limiting/security systems, session identifiers, and a limited audit trail of sensitive/account-administration actions. We do not create advertising profiles or use fingerprinting.

Required account fields are marked in the interface. Without them we cannot create or secure an account. Optional profile, support and score fields may be left blank or submitted under a pseudonym where the interface permits.

3. Why we use data and our legal bases

• Contract: create and secure accounts; publish and deliver content; provide profiles, ratings, leaderboards, password recovery and contest administration; respond to service requests.
• Legitimate interests: keep a free community platform reliable and safe; prevent fraud, malware, manipulation and misuse; moderate content; measure aggregate use; defend legal claims; and improve the service. We balance these interests against users' rights.
• Legal obligations: comply with binding law, lawful requests, tax/accounting duties relating to prizes, and protect rights and safety.
• Consent: only where we specifically ask for it for an optional future feature. Consent may be withdrawn at any time without affecting earlier lawful processing.

We do not use personal data for third-party direct marketing.

4. What is public

Usernames, public profiles, published games and media, reviews, ratings, player names/scores, developer tip links, winners and public blockchain transaction hashes may be available worldwide and indexed or copied by others. Do not submit confidential information, another person's data without authority, or a wallet/contact detail you do not want made public.

5. Cookies and local storage

• Session cookie: after sign-in, we set a host-only __Host-gf_session cookie. It is HttpOnly, Secure and SameSite=Lax. It is strictly necessary to authenticate the account. The browser cookie has a maximum lifetime of 90 days; the server session expires after 14 days without activity and never later than 90 days.
• Local preferences: when you choose a language or dismiss the cookie notice, the browser stores those choices locally (gf_lang and gf_cookie_notice). These are functional choices requested by you and are not used to track you.

We currently use no analytics, advertising, social-tracking or cross-site cookies. Because the technologies above are strictly necessary or save an action you expressly requested, they do not require opt-in consent under the UK/EU cookie rules. If optional analytics or advertising is introduced, it will remain off until the required consent is obtained, and this notice and the controls will be updated.

6. Sharing and service providers

• Railway Corporation hosts the application, database, files, backups, security and operational logs in the United States.
• Resend (Plus Five Five, Inc.) processes email addresses and message content in the United States when sending password resets or support notifications. Its email data is ordinarily retained for 30 days.
• Administrators and advisers may access only what is reasonably needed to operate, secure or defend GameFoundry.
• Authorities or other parties may receive data where disclosure is required by law or reasonably necessary to protect rights, users or the public.

External games, Ko-fi, GitHub Sponsors, blockchain networks, wallet software, social networks and other linked services are independent third parties. When you choose to use them, they receive data under their own terms and privacy notices. GameFoundry does not receive card details, private keys or custody user funds.

7. International transfers

The service is available internationally, but its primary hosting and email processing occur in the United States. Where EU/EEA or UK transfer rules apply, providers use recognised mechanisms such as adequacy frameworks, the EU Standard Contractual Clauses and the UK Addendum, plus supplementary safeguards. You may request further information through Support. Public content is, by its nature, accessible from any country.

8. Retention

• Accounts and associated content are kept while the account/service relationship continues, then deleted or anonymised on a verified request unless retention is necessary for security, disputes, legal duties or the rights of others.
• Sessions follow the 14-day idle/90-day absolute limits above. Password-reset tokens expire after one hour; email-verification tokens after 24 hours. Expired or used records are purged.
• Closed support messages and handled reports are normally deleted after 24 months; unresolved safety/legal matters may be kept as long as reasonably necessary.
• Tip-click records are kept for up to 24 months. The limited security/audit trail is kept for up to 12 months. Aggregated non-identifying statistics may be retained longer.
• Reviews, scores and public content remain while the related account/game is published. Prize and blockchain records may be retained for up to seven years or longer where law or a live dispute requires it.
• Provider logs and backups are kept according to provider schedules and are isolated from ordinary use until overwritten.

9. Automated checks and rankings

Uploads undergo automated format, archive-safety and malware checks. A failed or unavailable scan may reject an upload or hold it for human review. Rankings use ratings, counts and the formula published in the contest rules. These systems do not make decisions with legal or similarly significant effects by themselves: moderation and prize eligibility may be reviewed by an administrator, and you can challenge a decision through Support.

10. Your rights

Depending on applicable law, you may ask for access, correction, deletion, restriction, portability, or a copy of your data; object to processing based on legitimate interests; and withdraw consent where consent applies. These rights are not absolute, and we may need to verify identity and retain limited data where the law permits or requires it.

Your right to object: you may object at any time to processing based on our legitimate interests. Explain your situation through Support; we will stop unless compelling lawful grounds or legal claims require continued processing.

You may complain to the supervisory authority where you live, work or believe an infringement occurred. UK users may contact the Information Commissioner's Office; EU/EEA users may contact their national data-protection authority.

11. Children

Accounts, content submissions, ratings and prize participation are for people aged 18 or over. Visitors under 18 may browse or play only with a parent or guardian's permission and must not create an account or submit personal data. If you believe a child has supplied personal data, contact us for prompt review and deletion.

12. Security

We use password hashing, hashed server-side session tokens, TLS, host-only secure cookies, access controls, isolated user-content hosting, upload validation and malware scanning. No internet service is perfectly secure; please use a unique password and report suspected compromise promptly.

13. Regional notice and changes

Local privacy law may grant additional non-waivable rights. The service is not intended to override data-localisation or transfer restrictions that mandatorily apply in a user's country. If use would be unlawful in your location, do not submit personal data. We will post material changes here and update the effective date; where law requires, we will provide additional notice or obtain consent.

14. Contact

Use the Support button on any page and select a privacy-related message. Provide an email address so we can verify and respond. We aim to answer valid privacy requests within the period required by applicable law.

Terms of Service · Acceptable Use Policy