Privacy Policy

In short

We give each visitor a random ID, kept in a cookie, so we can count plays and see whether people come back. If you subscribe, we keep your email address, or the address your browser gives us for notifications, so we can send you the day’s game. We use our own software and a handful of hosting and email companies to do it. No advertising, no ad networks, no selling your data, no third-party trackers.

The rest of this page says exactly what we keep, why, who else handles it, and how to have it deleted.

Who this covers

Merchants of Play Inc. ("we", "us", "our") runs gameaday.xyz and the games it lists. This policy covers the site, the emails and notifications it sends, and the games it links to. A game may say more on its own page about what it saves.

It applies wherever you are. We aim to meet Canada’s Personal Information Protection and Electronic Documents Act and anti-spam law (CASL), the General Data Protection Regulation in the European Union and the United Kingdom, and the California Consumer Privacy Act.

Your player ID

The first time you visit gameaday.xyz we make a random ID for your browser and keep it in a cookie called "gad_pid" for 400 days, renewed each visit. It is not your name, your email, or anything about your device: just a random number.

When you follow one of our links to a game, the ID travels in the link. The game keeps it in its own browser storage ("gad_pid") and takes it out of the address bar, so a link you share does not carry it. A game you open directly makes its own random ID the same way.

We use the ID to count plays, to see how many players come back the next day or the next week, to tell whether our emails and notifications bring people back, and to avoid asking you to subscribe more than once a day or at all once you have.

What we record when you play

When a game starts and ends it tells gameaday.xyz: which game, your player ID, how you got there (for example "email", "today", "hub" or "direct"), and the times. We also record when the subscribe box was shown or closed, when you pressed a subscribe button, and when you tapped one of our notifications.

Separately, every page loads our own analytics script. It records which page, the site that linked you, your screen size, touch or mouse, your browser’s language, clicks on buttons and links, how long the page was open, JavaScript errors, and game events such as starting, winning, losing or sharing. To tell visitors apart it keeps only a short hash of your IP address and browser mixed with a secret that changes every day; the IP address itself is not stored by this script.

If you subscribe by email

We keep: your email address; daily or weekly; whether you have confirmed, unsubscribed, or your address bounced; the date, time and IP address when you signed up; the exact words you agreed to; where you signed up (the site, the subscribe page, or a game, and which one); and your player ID. We keep the consent record because Canadian law requires us to be able to show you asked.

Nothing is sent until you press the link in the confirmation email. After that you get one email a day (or one a week), and nothing else.

We send email through Resend, in the United States. Resend records whether each email was delivered, opened (through a small image in the email) and whether a link was clicked, and tells us, so we can count opens and clicks. If a message bounces or is reported as spam, we stop sending to that address.

Every email has an unsubscribe link. It works in one click and takes effect immediately. We keep a record that you unsubscribed so we never email you again by mistake.

If you turn on notifications

Your browser gives us an address at its push service (Google, Apple, Mozilla or Microsoft, depending on the browser) and two keys that let us send to it. We keep those, your browser’s user-agent string, where you turned notifications on, and your player ID. We send at most one notification a day.

Turn notifications off in your browser’s site settings to stop them. When the push service tells us an address no longer works, we delete it.

Your IP address

When you sign up we keep your IP address for up to an hour to stop anyone signing up more than five times an hour, and then delete it. The IP address at the moment you consented is kept with your subscription, as above. Otherwise we do not store IP addresses.

Cookies and browser storage

"gad_pid" is your player ID, as above.

"gad_backroom" remembers that you entered the back room password. "gad_admin" is only set for the people who run the site.

In games, "gad_pid" and "gad_pid_origin" hold your player ID and whether it came from gameaday.xyz; "gad_subscribed" and "gad_dismissed" remember that you subscribed or closed the subscribe box, so it is not shown again. "tally_ignore" and "tally_ab" belong to our analytics (see opting out). Games may also save your progress in your browser; clearing your site data removes all of it.

What you give games

A few games ask you to type something: a display name, a room code, a message to another player. We store what you type for as long as that game needs it to work.

Games that run inside Telegram receive the account identifiers Telegram passes to them, and we store those to keep your progress attached to you. Telegram’s own privacy policy governs what Telegram does.

Why we use it

To send you the game you subscribed to.

To see which games people play and come back to, so we know which ones to keep working on, and whether our emails and notifications are worth sending.

To find and fix faults, and to keep the Services working and stop abuse.

Where the law requires a legal basis: your consent for emails and notifications; our legitimate interest in understanding and improving games we give away, for the player ID, play records and analytics; and performing the service you asked for, for anything you type into a game.

Who else handles it

Nobody buys it, and we do not share it with advertisers or data brokers.

Railway (United States) hosts the site and its database, and most of the games. Fly.io (United States) hosts a few. Resend (United States) sends our email. Your browser’s push service delivers notifications. Some games keep saved data in a hosted Postgres database (Neon).

Pages load fonts from Google Fonts, so Google receives your IP address when a page loads. Some games embed YouTube or other players, which may set their own cookies. Those are governed by those companies’ policies, not ours.

We may disclose information if the law requires it, or to protect our rights or someone’s safety.

How long we keep it

Subscriptions are kept until you unsubscribe or ask us to delete them; after unsubscribing we keep only what shows you did. Push addresses are deleted when they stop working. Signup IP addresses kept for rate limiting are deleted after an hour.

Player IDs and play records are kept for as long as we run the site, because they are how we measure it. Analytics events are kept indefinitely at present. We will say so here if that changes.

Opting out

Unsubscribe from email with the link in any email; turn notifications off in your browser.

Clear your cookies and site data for gameaday.xyz to drop your player ID; a new, unconnected one is made on your next visit.

Open any of our pages with ?tally=ignore on the end of the address to stop our analytics counting that browser, and ?tally=track to turn it back on. An ad blocker or a browser set to block trackers will usually stop the analytics script loading at all, and we do not work around it.

Your rights

Depending on where you live you may ask us for a copy of what we hold about you, ask us to correct or delete it, object to or restrict how we use it, withdraw consent, or ask for it in a portable form.

If you give us your email address, we can find your subscription and everything tied to its player ID. Because analytics keeps only a daily hash, we usually cannot find your analytics rows.

Write to officialstuff@merchantsofplay.com. We answer within thirty days. If you are not satisfied, you may complain to your data protection authority, or in Canada to the Office of the Privacy Commissioner.

Children

The Services are not directed at children under 13, or under 16 where local law sets that age, and we do not knowingly collect their personal information.

If you believe a child has given us personal information, write to officialstuff@merchantsofplay.com and we will delete it.

Security

Our sites are served over HTTPS, our data is stored on servers we control or rent, and access is limited to the people who run the site. Email links that change your subscription are signed so they cannot be guessed.

No system is perfectly secure, and we cannot guarantee that these ones are.

Where the data goes

Our servers and providers are in the United States and the company is in Canada, so your information is processed outside your country if you live elsewhere. Where the law requires a transfer mechanism, we rely on the European Commission’s standard contractual clauses.

Changes

We will post any change here and update the date at the top.

Contact

Merchants of Play Inc., 3170 Horn Street, Abbotsford, BC V2S 8H7, Canada. Write to officialstuff@merchantsofplay.com.