Legal

Privacy policy

Last updated: 28 September 2026

Who we are

The controller for personal data processed in connection with this site is [legal entity name], registered at [address]. For anything in this policy, or to exercise your rights, write to [privacy@yourdomain.com].

At this scale of processing we are not required to appoint a data protection officer, so correspondence is handled by the controller directly.

What we don't collect

This list is longer and more useful than the list of what we do collect:

• Accounts and registration data — there is no sign-in system, so there is no way to give us a name, an address or a phone number.
• Payment data — we take no deposits and process no transactions.
• Form submissions — the site has no contact form and no newsletter sign-up.
• Advertising data — no ad-network pixels, no heatmaps and no session recording. Google Analytics runs here only with your consent and with its advertising features switched off; there is a section on it below.
• Bought-in data — we buy nothing from data brokers and match you to no external profile.

We do not profile you, we build no advertising segments, and we make no decisions about you by solely automated means within the meaning of Article 22 of the UK GDPR.

What stays in your browser

The site stores one thing: the list of games you have starred. It goes into your browser's local storage (localStorage, key favourites) and contains nothing but technical game identifiers — no data about you.

It is not a cookie and it is not attached to any request sent to the server, so we have no technical access to that list and don't know what is on it. It belongs to one browser on one device: another browser shows an empty list, and clearing site data deletes it for good.

One other thing goes into local storage: your answer to the consent bar (key consent), so you are not asked again on every page. That is local storage too, not a cookie. Actual cookies are set only by Google Analytics, and only once you have accepted — see the next section.

View and clear your favourites →

Analytics — Google Analytics 4

If you press Accept on the consent bar, the site loads Google Analytics 4 (a service of Google Ireland Limited) and starts counting your visit. Until you do — or if you press Decline — the Google script is never fetched and your browser makes no request to Google at all.

Once you have accepted, Google Analytics sets its own cookies (_ga and _ga_*) so it can recognise your browser on a later visit. What it records: the pages you open, the referring page, an approximate city-level location, device and browser type, time spent on the page, and clicks on outbound links. We send Google no name, no email address and nothing else that would identify an individual — we hold no such data in the first place.

Google’s advertising features are switched off for good: no data goes to remarketing, Google Signals is off, and we build no advertising audiences. The analytics exist so we know which articles get read.

Google acts as our processor under the Google Analytics data processing terms, and may transfer the data to servers in the United States under the standard contractual clauses, the UK International Data Transfer Addendum and the Data Privacy Framework that Google LLC is certified under. Event data in our property is retained for 14 months, after which Google deletes it.

You can withdraw consent at any time, without giving a reason: use the "Cookie consent" link in the footer and the bar comes back. From the next page load the Google script is no longer fetched, and any cookies it already set go when you clear this site’s data in your browser.

Server logs

Like every site on the web, this one runs on a server that writes technical access logs: IP address, date and time of the request, the URL requested, browser and operating system type, and any referring page. Those logs are kept by our hosting provider, [hosting provider name], as a processor acting for us.

An IP address can count as personal data, which is why the logs are listed here even though we only look at them after an outage or an abuse incident. We don't combine them with other data, we build no visitor statistics from them and we make no attempt to work out who you are. Retention: [period], per the provider's terms.

Demo games embedded from the studios

Slots run in an iframe loaded from the servers of the studios that made them — Pragmatic Play, Play’n GO and BGaming. That frame is only inserted after you click the button to launch the demo, so until you do, your browser makes no connection to the studio at all.

Once it launches, the game operates under those studios' own privacy policies and may set its own cookies and browser storage, for things like demo session state or sound settings. We have no access to them and no control over what they contain.

Affiliate links to casinos

Casino links are affiliate links. Clicking one takes you off this site: you pass through a redirect that counts the referral and then arrive at the operator's site. From that point your data is processed by the operator and its partners under their own privacy policies.

We have no visibility into what you do at a casino: whether you open an account, what you deposit or what you play. The affiliate programme gives us aggregate figures only — clicks and settled referrals — with nothing that identifies an individual.

Legal bases for processing

The UK GDPR requires a stated basis for each purpose. Ours are:

• Legitimate interests (Article 6(1)(f)) — server logs, keeping the site secure, preventing abuse, and replying to messages you choose to send us.
• Legal obligation (Article 6(1)(c)) — situations where the law requires us to retain or disclose particular data to a competent authority.
• Consent (Article 6(1)(a)) — Google Analytics, and nothing else. We ask before the tag loads, declining costs exactly one click just as accepting does, and you can withdraw at any time from the footer (Article 7(3)). We run no marketing and no newsletter, so there is nothing else to consent to.

If you email us, we process your address and the contents of your message solely in order to reply, and we add you to no mailing list.

Who we share data with

We don't sell data and we pass none to data brokers or ad networks. The technical data in the logs is processed on our behalf by the hosting provider under a processing agreement.

The one other processor is Google Ireland Limited, and only for visitors who consented to analytics. The detail, including the basis for transfers outside the UK and the EEA, is in the Google Analytics section above.

[If the server, CDN or mailbox sits outside the UK or the EEA, set out the transfer safeguard here — usually the International Data Transfer Agreement or standard contractual clauses.]

How long we keep it

• Server logs — [period], held by the hosting provider.
• Google Analytics — 14 months, after which Google deletes the event data. If you never consented, nothing exists to keep.
• Email correspondence — [period] after the matter is closed.
• Favourites list — until you delete it yourself. It sits with you, not with us, so we can neither erase nor restore it.

Your rights

The UK GDPR gives you a set of rights against a controller. You can:

• ask for access to your data and a copy of what we process (Article 15);
• ask us to rectify data that is inaccurate or incomplete (Article 16);
• ask for erasure — the "right to be forgotten" (Article 17);
• ask us to restrict processing (Article 18);
• receive your data in a commonly used format and port it to another controller (Article 20);
• object to processing based on legitimate interests (Article 21);
• not be subject to solely automated decisions, including profiling (Article 22) — we make none;
• withdraw consent at any time, if we ever ask for it (Article 7(3)).

We respond to any request without undue delay and within one month of receiving it (Article 12(3)).

In fairness, here is what an access request will usually get you: since we run no accounts, in practice we hold no data about you. The technical logs can't be tied to a particular person, and the Google Analytics reports we look at are aggregate and name nobody either. "We have nothing that relates to you" isn't a brush-off — it is a fact about how this site is built.

Complaining to a supervisory authority

If you think we are handling your data unlawfully, you can complain to a supervisory authority. In the UK that is the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF (ico.org.uk).

Complaining is free and doesn't require you to contact us first, though writing to us is usually quicker — if the mistake is ours, we'll fix it straight away.

Children

This site is for adults aged 18 and over. It isn't directed at children, we don't knowingly collect their data, and we run no marketing aimed at under-18s. If you believe a child has given us any information, contact us and we'll delete it.

Security

The site is static: pages are generated ahead of time and served with no database, no forms and no login panel. We don't claim credit for that — it's a consequence of the architecture. There is simply nowhere here from which user data could be stolen, because we don't gather any. The connection is encrypted (HTTPS).

Changes to this policy

We update the date at the top whenever the text changes. Anything significant — adding analytics, a contact form or a newsletter — will be flagged on the site beforehand, together with the legal basis it would rest on.

18+ only. Demo games use credits with no cash value. Play responsibly.