Effective 27 September 2026 · gamesay.org
Gamesay has no user accounts, sets no cookies, runs no analytics or advertising scripts in your browser, and makes no third-party request when a page loads. There is exactly one place where you can give us a piece of personal information, and that is the newsletter form. This policy describes that, the records our host keeps, and what we do with the public posts we count.
Gamesay ("Gamesay", "we", "us") is an independent, ad-free reference site. We are the controller of the personal data described in this policy. We are not a registered company; there is no separate legal entity or office address behind Gamesay to disclose.
Privacy questions and requests: info@gamesay.org. We answer every request, including from people outside the regions whose laws require us to.
We have not appointed an EU or UK representative under Article 27 of the GDPR.
This is the complete list. There is nothing held back for a catch-all clause.
| Data | When | Why, and for how long |
|---|---|---|
| Your email address | Only if you type it into the newsletter form and confirm by clicking the link we email you. | To send you the newsletter. Held until you unsubscribe or ask us to delete it. Unconfirmed addresses are discarded. |
| Request records (IP address, browser user-agent, page requested, referring page, timestamp) | Automatically, every time any browser or crawler requests a page — this is how the web works, not a choice we made about you. | Serving the site, security, abuse prevention, and counting page views. Held by our host on a rolling window, currently 30 days, then deleted. |
The PNG download button draws the image inside your own browser and hands the file to you. Nothing is uploaded, and we do not know that you used it.
| Purpose | Ground (UK/EU GDPR Art. 6) |
|---|---|
| Sending you the newsletter | Your consent, given by confirming your address. You can withdraw it at any time; withdrawal does not affect anything sent before. |
| Serving pages, keeping the site up, blocking abuse, counting page views | Our legitimate interests in operating and protecting a public website. |
| Producing our published statistics | Our legitimate interests in publishing aggregate, public-interest statistics. We publish counts, never identities, and hold nothing that would let us identify the people behind them. |
Two companies, both acting on our instructions under a written data processing agreement. Nobody else.
We also call the public YouTube Data API ("YouTube API Services", Google LLC). By using Gamesay, you are also agreeing to be bound by the Google Privacy Policy. We use nothing else on YouTube: no sign-in with Google, no OAuth, and no access to anyone's account.
We do not sell personal information, and we do not share it for cross-context behavioural advertising — as those terms are defined in the California Consumer Privacy Act. We have never done so and have no plan to. We do not disclose personal information to data brokers, advertisers, or AI training providers.
We will disclose data if a valid legal order compels us, or to establish or defend a legal claim. Where we are lawfully able to tell you first, we will.
Gamesay is operated from the United States and both processors are United States companies, so personal data covered by this policy is processed in the United States.
If you are in the United Kingdom, the European Economic Area or Switzerland, that is an international transfer. We rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) in our agreements with our processors, together with the safeguards those agreements require. You can ask us for the details of the mechanism used for any particular transfer.
The site is static files served over HTTPS, with HTTP requests redirected to it. Every page is sent with X-Frame-Options: DENY, X-Content-Type-Options: nosniff, a strict referrer policy, and a permissions policy that switches off geolocation, microphone, camera and interest-cohort tracking. There is no database, no login and no user-generated content on the public site, which removes most of the ways a site like this leaks data. Access to the newsletter list and the host account is limited to people who need it and protected by multi-factor authentication.
No method of transmission or storage is perfectly secure, and we do not claim otherwise. If a breach occurs that is likely to result in a risk to your rights, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, and notify you directly where the law requires it.
We extend the rights below to everyone who writes to us, wherever you live, rather than checking first whether a particular statute covers you.
If you believe our published statistics reflect your own public activity somewhere and you want it excluded, write to info@gamesay.org. We retain no identifiers, so we usually cannot locate one person's activity inside an aggregate figure; what we can do is stop reading a specific public source, correct a figure, and tell you plainly what we hold.
You may also complain to your data protection supervisory authority. In the UK that is the Information Commissioner's Office (ico.org.uk). We would rather you came to us first, but you do not have to.
To the extent the California Consumer Privacy Act applies to us, the categories in section 2 are the only ones we collect: identifiers (an email address you give us; an IP address in a request record) and internet activity information (the page requested and the referring page). We collect them for the purposes in section 3, from you directly, and we disclose them only to the two service providers in section 4. We collect no sensitive personal information, we sell nothing, and we share nothing for cross-context behavioural advertising. You may exercise these rights through an authorised agent. Residents of Colorado, Connecticut, Virginia and other states with comparable laws have equivalent rights and the same route to using them.
Email info@gamesay.org. We reply within 30 days, and tell you if we need longer. We may ask you to confirm control of the email address in question — for a list of one email address, that is the only identity check available to us, and we will not ask you for identity documents. If we refuse a request, we say why and tell you how to challenge it.
We honour the Global Privacy Control signal. In practice it changes nothing about what happens, because we do not sell or share personal information in the first place. We do not respond to Do Not Track headers, because the industry never settled on what responding would mean; the absence of tracking on this site is the answer.
Gamesay is a reference tool for people who work in or write about games. It is not directed at children, and we do not knowingly collect personal information from anyone under 16. Do not subscribe to the newsletter if you are under 16. If you believe a child's information reached us, write to info@gamesay.org and we will delete it.
Some pages link to storefronts, platforms and press articles. Those sites have their own privacy practices and we are not responsible for them. Aside from submitting the newsletter form, which goes straight to Buttondown (section 4), following a link is the only way a page on this site results in a request to anyone but us.
If we change it, we change the effective date at the top. If a change materially affects what we do with data you have already given us, we will say so on the home page and, for newsletter subscribers, in the newsletter, before it takes effect. Earlier versions are available on request.
Gamesay
info@gamesay.org