Privacy
In short: we use cookies and local storage in four groups: necessary, preferences, analytics and marketing. Necessary always runs. The other three only run if you allow them, and you can change that at any time with the icon at the bottom left.
Current status, kept up to date (21 August 2026): after you say yes to analytics, we load Google Tag Manager (GTM-T7ZMCXMX). Inside that container a Google tag fires Google Analytics 4 (G-ZDZ8DTLH05). Marketing still has nothing behind it. If you say no, Google is not contacted. The first-party hall log below does not wait for that yes: it never sets anything in your browser.
Who is responsible
McGrinsey operates this site. Contact and full company details are in the imprint. For anything on this page, write to john@mcgrinsey.com.
Stored on your device
| Group | Name | What for | Running |
|---|---|---|---|
| Necessary | gaetw_sess | Keeps you signed in, 30 days, extended on each visit | <span data-store="gaetw_sess">only if you are signed in</span> |
| Necessary | gaetw.consent | Your choice in the cookie box, so we do not ask again | <span data-store="gaetw.consent">only after you answer the box</span> |
| Preferences | gaetw.skin | The look you picked. Saved after you say yes. This visit keeps it either way. | <span data-store="gaetw.skin">only after you pick a look</span> |
| Preferences | gaetw.player | The name you play under on the leaderboard | <span data-store="gaetw.player">only after you set a name</span> |
| Analytics | GTM-T7ZMCXMX, G-ZDZ8DTLH05 | Google Tag Manager. After your yes it fires Google Analytics 4. | after you allow analytics |
| Marketing | Advertising measurement and targeting, recognising returning visitors | not yet |
Necessary storage runs on Art. 6(1)(f) GDPR and §25(2) TTDSG, because without it the site cannot do what you asked. Everything else runs on your consent, Art. 6(1)(a) GDPR and §25(1) TTDSG. Withdrawing is as easy as giving: the icon at the bottom left, or the button at the end of this page. Preferences are deleted the moment you withdraw.
Stored on our server
Scores. When you submit a score we store the name you chose, the score, how long the run took, the time, and a salted hash of your IP address and browser string. We never store the address itself, and the hash cannot be turned back into one. It exists so a single person cannot flood a leaderboard. Legal basis: your request to appear on the board, and our legitimate interest in a board that is not nonsense (Art. 6(1)(a) and (f) GDPR).
Warp doors. When you travel from one game to another we record which game sent you, which received you, the name you travel under, and when. That is what lets a developer see what their portal does. Legal basis: legitimate interest (Art. 6(1)(f)).
Game submissions. If you submit a game we store title, URL, your name, your email, your description and a salted hash of your IP. Your email is only for us and is never published. Legal basis: pre-contractual steps at your request (Art. 6(1)(b)).
Server log. The web server records requests including IP address, in the usual way, to keep the thing running and to notice attacks. Legal basis: legitimate interest (Art. 6(1)(f)).
Hall log. For the machine room we keep a first-party log of HTML page hits and of product events (new account, new game, a score from outside our own arcade, a review, a hand submission). We store path, referrer host, time, and a hashed daily session (sha256 of IP + date + a secret). We do not store the IP. The hash is worthless the next day. Scripts that games embed (gs.js, hiscore.js) are not counted as visits. Legal basis: legitimate interest in seeing whether the hall is actually used (Art. 6(1)(f)). Dropped after 30 days.
How long
Consent record: until you change or clear it. Sign-in session: 30 days, extended on each visit. Scores and warp-door records: as long as the leaderboard exists, because that is what a leaderboard is. Submissions: as long as the game is listed, plus a reasonable period afterwards. Server log: short-lived, rotated. Hall log: 30 days.
Who gets it
The site runs on a server we rent from Hetzner Online GmbH in Germany, which processes on our instructions.
Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) and, behind it, Google LLC in the USA: after you allow analytics, your browser loads gtm.js for container GTM-T7ZMCXMX. That container fires Google Analytics 4 (G-ZDZ8DTLH05). Google then sees that a page was opened, from which address, and the usual request data (IP, browser). Ads tags are not attached yet. Transfer to the USA: Google's EU-US Data Privacy Framework listing. Without your yes, that script is not requested.
The leaderboard names and scores are public, because that is the point of a leaderboard. Pick a name you are happy to have on the internet.
Your rights
Access, rectification, erasure, restriction, portability, and objection to processing based on legitimate interest, under Articles 15 to 21 GDPR. You may also complain to a supervisory authority. Write to john@mcgrinsey.com and say what you want; for scores, tell us the name you played under.
Changes
If we add a measurement or ads tool inside the container (GA4, a conversion tag), it will be named here and in the settings box before it runs.