Privacy Policy
Effective date: September 24, 2026
This Privacy Policy explains how GGGL ("GGGL", "we", "us") collects, uses and protects personal data when you use the website gggl.online and the games on it (together, the "Service"). It is written to meet the requirements of the EU and UK General Data Protection Regulation (GDPR), the Swiss Federal Act on Data Protection, the California Consumer Privacy Act (CCPA/CPRA) and other U.S. state privacy laws, Brazil's LGPD, Canada's PIPEDA, Australia's Privacy Act, Albania's Law No. 124/2024 on Personal Data Protection, and similar laws worldwide.
In short: we collect as little as possible. No email, no real name, no phone number, no location. We never sell your personal data.
1. Who we are
The Service is operated by [YOUR FULL NAME], an individual based in [COUNTRY], who is the data controller.
Contact for all privacy matters: [CONTACT EMAIL].
2. The data we collect
| Data | Purpose | Retention |
|---|---|---|
| Player name, avatar, account creation date | Providing your account and showing you on leaderboards | Until you delete your account |
| Password — stored only as a one-way bcrypt hash, never in readable form | Signing in | Until you delete your account |
| Game results (score, lines, level, duration, round, stars) with date and time | Records, rankings, progress and profile statistics | Until you delete your account |
| Session token — stored hashed on the server and in your browser's local storage | Keeping you signed in | Until you sign out, or 90 days of inactivity |
| IP address — only for failed sign-ins and account creation | Preventing password-guessing attacks and mass account creation | 24 hours, then deleted automatically |
| Technical server logs (IP address, browser type, requested page, time), kept by our hosting provider | Operating, securing and troubleshooting the Service | Per the hosting provider's policy, typically up to 30 days |
We do not collect your email address, real name, date of birth, phone number, precise location, contacts, photos or payment data. You can play without an account; your settings and scores are then stored only in your own browser and never sent to us.
3. Cookies and local storage
GGGL itself does not use cookies. We use your browser's local storage only for things that are strictly necessary for the Service: your session token, your game settings and, if you play without an account, your local scores. Under the EU ePrivacy rules these do not require consent.
Our advertising partner Google uses cookies and similar technologies as described in section 6. Where the law requires it, these are only used after you give consent.
4. Legal bases (EU, UK, Switzerland, Brazil and similar laws)
- Performance of a contract (GDPR Art. 6(1)(b); LGPD Art. 7(V)): your account, scores, leaderboards and progress.
- Legitimate interests (GDPR Art. 6(1)(f); LGPD Art. 7(IX)): security of the Service, preventing abuse and cheating, and server logs. Our interest is to keep the Service safe and fair; it does not override your rights because the data is minimal and short-lived.
- Consent (GDPR Art. 6(1)(a); LGPD Art. 7(I)): personalized advertising and related cookies. You can withdraw consent at any time.
5. Information that is public
Your player name, avatar, scores and ranks are visible to everyone on the leaderboards. Please do not use your real name or any personal information as your player name.
6. Advertising
The Service is free and funded by ads served by Google AdSense (including AdSense for Games). Google and its partners may use cookies, device information and your IP address to serve ads, limit how often you see them, measure their performance, prevent fraud and — if you allow it — show ads based on your interests. Google acts as an independent controller for this processing. See how Google uses information from sites that use its services and Google's Privacy Policy.
- EEA, UK and Switzerland: a Google-certified consent message asks for your choice before personalized ads are shown. If you decline, you may still see non-personalized or limited ads.
- United States: you can opt out of the "sale" or "sharing" of personal information for targeted advertising — see section 10.
- Everywhere: you can change your choice at any time with the Ad privacy link at the bottom of every page, and manage Google ads personalization at adssettings.google.com.
Rewarded ads (for example "Watch an ad to continue") are only shown when you choose them.
7. Who we share data with
- Hostinger (hosting provider) — stores our website and database and processes data only on our instructions under a data processing agreement.
- Google — for advertising, as described in section 6.
- Authorities — only if required by law, or to protect the rights, property or safety of the Service or its users.
We do not sell personal data for money and we do not share it with data brokers.
8. International transfers
Our servers are located in [DATA CENTER COUNTRY, e.g. Lithuania (EU)]. Google may process data in the United States and other countries. Transfers outside the EEA, UK and Switzerland rely on adequacy decisions (including the EU-U.S. Data Privacy Framework where applicable) or on the European Commission's Standard Contractual Clauses.
9. Security
We use encrypted connections (HTTPS), store passwords only as bcrypt hashes, store session tokens hashed (SHA-256), limit repeated sign-in attempts and keep the data we hold to a minimum. No system is completely secure; see our Terms of Use regarding security incidents. If a personal data breach occurs that is likely to put your rights at risk, we will notify the competent authority and, where required, affected users, as the law requires.
10. Your rights
Everyone, wherever you live, can:
- Access and download your data — Account page → Download my data.
- Delete your account and all related data — Account page → Delete account, or the account deletion page. Deletion is immediate and complete.
- Correct your data — change your avatar and password on the Account page; contact us to change your player name.
- Withdraw consent for personalized ads at any time — Ad privacy link in the footer.
EEA, UK, Switzerland, Albania, Brazil and similar laws: you also have the right to restriction of processing, to object to processing based on legitimate interests, to data portability, and to lodge a complaint with your local data protection authority (in Albania: the Information and Data Protection Commissioner, idp.al; in Brazil: ANPD; in the UK: ICO).
California and other U.S. states (including Colorado, Connecticut, Virginia, Utah, Texas, Oregon and others with similar laws): you have the right to know what personal information we collect, to delete it, to correct it, and to opt out of the "sale" or "sharing" of personal information for cross-context behavioral advertising. We do not sell personal information for money. To the extent our use of Google advertising cookies counts as "sharing", you can opt out with the Do Not Sell or Share My Personal Information link in the footer, and we honor Global Privacy Control (GPC) browser signals. We will not discriminate against you for using these rights. Categories collected in the last 12 months: identifiers (player name, IP address) and internet activity (game results, server logs), for the purposes listed in section 2.
Canada and Australia: you may request access to and correction of your personal information and complain to the Office of the Privacy Commissioner of Canada or the Office of the Australian Information Commissioner.
To use any right that is not self-service, email [CONTACT EMAIL]. We answer within 30 days (45 days where U.S. state law allows) and may need to confirm that the account is yours.
11. Children
The Service is intended for a general audience and is not directed to children under 13. Accounts may only be created by people aged 16 or older. We do not knowingly collect personal data from children under 16. If you believe a child has created an account, contact [CONTACT EMAIL] and we will delete it promptly. Anyone can play without an account, in which case no personal data is sent to our server.
12. Changes to this policy
We may update this policy. The effective date at the top shows the current version. For material changes we will give notice on the website before they take effect.
13. Contact
[YOUR FULL NAME] · [COUNTRY] · [CONTACT EMAIL]