Hosting and CDN
Serves the site, including TLS termination and DDoS protection
Cloudflare may set __cf_bm for bot mitigation
Cookie Policy & GDPR Compliance
What cookies we use, why we use them, and how you can manage your preferences
Last updated: September 7, 2026
Your Rights at a Glance
Right to Know
What data we collect & why
Right to Access
Request copy of your data
Right to Delete
Request data erasure
Right to Control
Opt out of non-essential cookies
Essential
RequiredRequired for the site to work. These are set by the sign-in system and cannot be turned off without breaking login.
| Cookie Name | Purpose | Duration | Provider |
|---|---|---|---|
| next-auth.session-token | Keeps you signed in | Session or 30 days | Auth.js (self-hosted) |
| next-auth.csrf-token | Protects sign-in and sign-out requests against cross-site forgery | Session | Auth.js (self-hosted) |
| next-auth.callback-url | Remembers where to return you after signing in | Session | Auth.js (self-hosted) |
Analytics (first-party, opt-out)
These let us count page views on our own server. There is no third-party analytics script, no advertising cookie and no tracking pixel anywhere on this site. You can opt out at any time from the "Cookie settings" control in the footer.
| Cookie Name | Purpose | Duration | Provider |
|---|---|---|---|
| analytics_session_id | Groups page views belonging to the same visit | Until you clear your browser storage | TeachMeToGame (first-party) |
| visitor_id | A salted SHA-1 of the session id, so the same browser is recognisable across visits without storing anything about you directly. Derived in the browser, never a fingerprint. | Until you clear your browser storage | TeachMeToGame (first-party) |
| hammy-analytics-optout | Records that you asked us not to measure you. Present only when you have opted out. | Until you clear your browser storage | TeachMeToGame (first-party) |
Functional preferences
Remembered choices that make the site easier to use - your theme, which units you prefer, and what you last selected in a calculator. None of these identify you and none are sent anywhere.
Third-Party Services & Data Transfers
Email delivery (Resend)
Newsletter and transactional email
None - server-side only
RollerCoin
Runs the game. Outbound links carry an affiliate referral parameter (?r=) so commissions can be attributed.
None set by us. RollerCoin may set its own cookies if you follow a link to their site.
GDPR Legal Bases for Processing
Legitimate Interest (Art. 6 GDPR)
- • First-party page-view analytics (opt-out)
- • Security & fraud prevention
- • Site functionality & performance
- • Affiliate referral tracking
Consent (Art. 6 GDPR)
- • Newsletter subscription
- • Marketing communications
Contractual Necessity (Art. 6 GDPR)
- • User account management (future)
- • Points system operation
- • Newsletter delivery
Legal Obligation (Art. 6 GDPR)
- • Tax/compliance records
- • Law enforcement requests
- • Data retention requirements
How to Manage Your Cookie Preferences
Cookie Banner (Our Site)
Click the cookie icon in the bottom corner or visit this page to change your preferences at any time.
- Essential cookies: Always on (cannot be disabled)
- Analytics: Toggle on/off
- Advertising: Toggle on/off
- Functionality: Toggle on/off
Browser Settings
- Chrome: Settings → Privacy → Cookies and site data
- Firefox: Options → Privacy & Security → Cookies and Site Data
- Safari: Preferences → Privacy → Manage Website Data
- Edge: Settings → Cookies and site permissions
- Brave: Shields → Cookie controls
How to Opt Out
First-party analytics are opt-out. Use the "Cookie settings" control in the site footer to switch them off - your choice is stored in this browser only, and takes effect immediately.
- Footer "Cookie settings" — the on/off switch for this site's analytics.
- Clearing your browser storage for this site removes the analytics ids entirely.
Data Retention Periods
| Data Type | Retention Period | Legal Basis |
|---|---|---|
| Newsletter subscription data | Until unsubscribe + 30 days | Consent |
| User account & points data | Active + 1 year after deletion | Contract / Legitimate Interest |
| First-party analytics ids (analytics_session_id, visitor_id) | Until you clear your browser storage | Opt-out via the footer "Cookie settings" control |
| Analytics preference (hammy-analytics-optout) | Until you clear your browser storage | Opt-out |
| Ad impression/click data | 13 months | Legitimate Interest |
| Analytics opt-out preference | Until you clear your browser storage | Opt-out |
| Server access logs (IP hashed) | 30 days (IP hashed after 7 days) | Legitimate Interest |
| Affiliate referral tracking | Session only | Legitimate Interest |
International Data Transfers
Our servers are hosted in the United States via Cloudflare. If you access from the EU/UK/EEA, your data transfers internationally under these safeguards:
- Standard Contractual Clauses (SCCs): With all US-based processors (Google, Cloudflare, Resend)
- EU-US Data Privacy Framework: For certified participants (Google, Cloudflare)
- Adequacy Decisions: Not applicable for US transfers post-Schrems II
- Supplementary Measures: Encryption in transit (TLS 1.3), at rest (AES-256), pseudonymization (IP hashing)
Your Right: You can request details of transfer mechanisms. Contact [email protected].
Contact & Data Protection Officer
For cookie questions, GDPR requests, or to exercise your rights:
Privacy & GDPR
[email protected]
Data requests, deletion, access
Data Protection Officer
[email protected]
Compliance, audits, breaches
Cookie Questions
[email protected]
Consent, categories, opt-out
Response Time: We respond within 30 days (GDPR) / 45 days (CCPA). You also have the right to lodge a complaint with your supervisory authority (e.g., ICO UK,CNIL France, your state AG in US).
Take Control of Your Privacy
Your data, your choice. Manage cookies, exercise your rights, or contact us anytime.