Home

YOUR DATA

Privacy Policy

How GameFinder.pro handles personal information.

Last updated: October 22, 2026

1. Controller

Lutz Fauska Einzelunternehmen
Owner: Lutz Fauska
Auf der Hüls 308
52068 Aachen, Germany

Privacy enquiries and requests can be submitted through our contact form. Our email address is also available in a spam-resistant format in the Legal Notice.

2. Scope and principles

This policy covers GameFinder.pro, user accounts and the services offered through this domain. We collect only information reasonably needed to operate, secure and improve the service. We do not currently sell personal information, share it for cross-context behavioural advertising, or use it for automated decisions with legal or similarly significant effects.

3. Information we process

Website access and security

Our hosting systems may process IP address, date and time, requested resource, referrer, browser and device information, response status and security events. This is used to deliver the website, diagnose faults, prevent abuse and protect the service. For EU/EEA users, the legal basis is Article 6(1)(f) GDPR (secure and reliable operation).

First-party daily visitor count

Only if you consent to our publisher purposes 1 (device storage/access) and 8 (content performance measurement) in Google’s consent message do we count unique daily visitors and page views to understand use of the service. A random browser value that expires at the next midnight in Europe/Berlin is stored in the database only as a one-way hash. For signed-in visits, the account identifier and current date are used to calculate a daily hash so that the same account is counted only once per day across devices; the direct account identifier is not stored in the counter. We do not store an IP address or full user-agent value in the counter and do not create a visitor history across days. The legal basis is your consent (Article 6(1)(a) GDPR and Section 25(1) TDDDG). Rejection or missing permission for either purpose leaves statistics off. You can change your choice through Privacy settings at the bottom of any page. Withdrawal stops future counting and removes the visitor cookie; processing already lawfully completed is unaffected.

User accounts

When an account is created, we process username, selected country, selected avatar identifier, email address, password hash, account status and relevant timestamps. The avatar is chosen only from images supplied by GameFinder.pro; users cannot upload their own image. Passwords are stored only as one-way hashes. Processing is necessary to provide the requested account and related functions (Article 6(1)(b) GDPR) and to protect accounts (Article 6(1)(f) GDPR).

Authentication and account emails

We process session identifiers, CSRF tokens, verification and password-reset tokens, login events and temporary rate-limit information. Verification tokens expire after 24 hours; password-reset tokens expire after 60 minutes and are single-use. Emails needed to activate or secure an account are transactional service messages.

Scores, settings and local data

For signed-in users, supported games can store private saved games and their game-specific metrics in three shared account slots. Other users cannot open these slots. Local preferences and, where supported by a game, device-only progress remain in that browser. Processing supports the requested account and save functions (Article 6(1)(b) GDPR); browser storage is described in the Cookie Policy.

Friend connections

Signed-in users may generate a random six-character, one-time friend code and share it outside the service. Entering that code creates a reciprocal friendship connection. Connected users can see each other’s username, selected country and supplied avatar. Email addresses and private saved games are not shared. Active codes expire after seven days or immediately after successful use. A friendship remains until either user removes it or an account is deleted. Temporary IP-based rate limits help protect code attempts from misuse. Processing is necessary to provide the requested friend connections and protect them from abuse (Article 6(1)(b) and (f) GDPR).

Private online game rooms

When a private online room is used, we process the chosen display name, room code, participant role, game state, moves and relevant timestamps. A signed-in player is linked to the account; a guest participant is not required to provide an email address or create an account. A random participant token is stored as a one-way hash on the server and temporarily in the browser tab. The other player can see the chosen display name and game actions. IP addresses may be used temporarily to limit room-code attempts and prevent abuse. Processing is necessary to provide the requested game and protect it from misuse (Article 6(1)(b) and (f) GDPR).

Contact form

We process title, name, optional company, subject and message. The IP address is used temporarily to enforce anti-spam limits. Contact messages are processed to answer enquiries, take pre-contractual steps where requested, and protect the form from misuse (Article 6(1)(b) and (f) GDPR).

Google AdSense and advertising choices

On the homepage and local game pages, we load Google’s published European consent message through its AdSense tag. Google Advertising Products is provided in the EEA by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. To deliver the message, the browser connects to Google and transmits technical request data such as its IP address and browser information. Google manages the consent record, including the IAB TCF signal, and the storage needed to remember your choice. Advertising requests are paused before the tag loads and are not resumed in this version; no advertisements are served, including after acceptance. The message is not embedded on these privacy/cookie pages, account forms or private online rooms. You can change your choice through Privacy settings in the footer, which opens the homepage when needed. Google’s Privacy Policy explains its processing. Our own statistics use only the publisher-purpose choices for GameFinder.pro, not a general advertising/vendor permission. Both publisher purposes 1 and 8 must be explicitly allowed. The necessary GFCONSENT setting stores only the resulting allow/deny status, its format version and the timestamp of the actual CMP choice for at most 180 days from that choice. It stores neither the TC string nor a visitor identifier. On pages with Google, we await a valid current CMP result before counting; on other public pages, the same still-valid saved choice can be used. The former separate statistics dialog has been removed. Use Privacy settings to revise the choice. The necessary choice-management function is handled separately from optional statistics and advertising under Section 25(2) TDDDG; delivery and documentation of privacy choices rely on Article 6(1)(c) and, insofar as applicable, Article 6(1)(f) GDPR. Optional advertising storage would require consent, and remains disabled here.

Service emails

We do not currently add account email addresses to a marketing list automatically. We send account verification and password-reset messages needed for the service. Registration does not subscribe you to marketing.

4. Hosting and recipients

The providers of our website, database, backups and email infrastructure process data on our behalf where required to deliver these services. Information may also be disclosed to public authorities when legally required, or to professional advisers where necessary to establish, exercise or defend legal claims.

5. International transfers

The core service is hosted in Germany. We do not currently serve advertising or load external analytics or social-media embeds. The Google consent service described above connects to Google and may involve processing outside the EEA under the safeguards described in Google’s Privacy Policy. Ordinary links to other websites do not embed their services into our pages.

6. Retention

  • Unconfirmed accounts are scheduled for deletion after seven days.
  • Active account information and account-based records are kept until the account is deleted, unless a longer period is legally required.
  • Unused friend codes expire after seven days. Friend connections remain until either user removes the connection or an involved account is deleted.
  • Contact messages are normally retained for no longer than 12 months, unless needed longer for an ongoing matter or a legal obligation.
  • Temporary rate-limit records are normally retained for minutes or hours.
  • Hashed daily visitor keys and their first and last paths are removed after 14 days. Aggregated daily totals contain no visitor identifier and may be retained for long-term statistical comparison.
  • Private online rooms and their move data are removed after their operational expiry and cleanup period. A guest participant token normally remains only for the browser-tab session.
  • Server logs and backups are retained only for operational, security and legally required periods under the hosting and backup schedules.
  • Browser storage remains until its stated expiry, the website removes it, or the user clears it.

7. Rights in the EU/EEA and United Kingdom

Subject to applicable law, individuals may request access, correction, deletion, restriction, data portability or object to processing. Consent can be withdrawn at any time. Signed-in users can permanently delete their account and associated account records directly under “My Account” → “Delete account”. Other requests can be made through the contact form; identity verification may be required.

EU/EEA users may lodge a complaint with a supervisory authority. The authority responsible for our place of establishment is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de.

8. United States privacy notice

Residents of US states with applicable privacy laws may have rights to know or access personal information, correct inaccuracies, delete information, obtain a portable copy, and opt out of certain sale, sharing, targeted advertising or profiling. These rights depend on the law and whether it applies to our business. We do not currently sell personal information or use cross-context behavioural advertising. Requests and appeals may be submitted through the contact form.

9. Canadian privacy notice

Where Canadian privacy law applies, individuals may request information about the existence, use and disclosure of their personal information, request access, and challenge its accuracy. We limit collection, use, disclosure and retention to the purposes described here and use safeguards appropriate to the information. Privacy questions or complaints can be submitted through the contact form.

10. Children

GameFinder.pro addresses a general audience and is not specifically designed or marketed for children. We do not knowingly collect personal information from children who cannot validly consent under applicable law. If we learn that such information was submitted without the necessary authorization, we will take reasonable steps to delete it.

11. Security

We use measures including HTTPS, password hashing, prepared database statements, restricted server-side configuration, CSRF and same-origin controls, secure session handling, limited login and contact attempts, and access controls. No internet service can guarantee absolute security.

12. Changes

We will update this policy when the service, legal requirements or data practices change. Material changes will be presented appropriately on the website. Planned advertising, social-media embeds or analytics will require a policy update before activation.