Privacy policy
Last updated: Oct 21, 2026
1. Who is responsible
GameDNA is run by the provider below, the controller under the General Data Protection Regulation (GDPR). This policy explains which personal data we process, why, and for how long.
Alexander Knispel c/o GAMPappelallee 6410437 BerlinDeutschland Phone: +49 160 1277603 Email: [email protected]2. In short
GameDNA shows no ads and uses no tracking, analytics or third-party scripts; fonts are served by the site itself. You can use the whole site without an account. We process personal data only to run the site and, if you have one, your account.
3. Data we process and why
Account
Your email address, your username, when the account was created and verified, and your last sign-in. Purpose: your account and voting. Legal basis: Art. 6(1)(b) GDPR. Kept until you delete your account.
Sign-in links
We store a sign-in link only as a fingerprint (hash), never the link itself. It expires after 30 minutes and is deleted when you request a new one. We store no passwords. Legal basis: Art. 6(1)(b) GDPR.
Votes
Your votes are stored with your account and shown publicly only as part of averages, never with your name. Legal basis: Art. 6(1)(b) GDPR. They are deleted with your account.
Sign-in emails
To send a sign-in link, our email service Resend receives your email address and the content of the email. Legal basis: Art. 6(1)(b) GDPR.
Access data
Every request passes through Cloudflare, which processes your IP address, the time, the requested address and browser details to deliver the pages and protect them from attacks. From your IP address Cloudflare derives your country, which we use only to show prices and store links for your country. We keep no access logs of our own. Legal basis: Art. 6(1)(f) GDPR (a secure, working website).
Store links and prices
Links to GOG, Fanatical, Green Man Gaming and Humble first lead to our own redirect and then to the shop; an Amazon search link, shown when no other store has the game, leads to Amazon directly. From then on the shop, and the affiliate network it works with, process data under their own privacy policies; we receive only reports about commissions, without data about you. To show a GOG price, our server asks GOG for the price in your country; GOG learns only the country, never your IP address.
4. Cookies
We use only strictly necessary cookies, never tracking, advertising or analytics cookies. They need no consent (Section 25(2) TDDDG); legal basis Art. 6(1)(b) and (f) GDPR.
- gamedna_csrf protects forms against misuse. Deleted when you close the browser.
- gamedna_auth keeps you signed in. Set only after you use a sign-in link; expires after 30 days.
- If Cloudflare's protection against bots is active, Cloudflare may set its own security cookie (such as __cf_bm) to tell people from bots.
5. Processors
| Provider | Purpose | Data | Location | Transfer basis |
|---|---|---|---|---|
| Cloudflare | Hosting, delivery and database (D1) | IP address and request data; account data and votes | USA / EU | EU-US Data Privacy Framework, standard contractual clauses |
| Resend | Sign-in emails | Email address, email content | USA | Standard contractual clauses |
6. Your rights
Under the GDPR you have these rights:
- Access: ask for a copy of the personal data we hold about you.
- Erasure: delete your account at any time on the account page. This removes all your data at once.
- Rectification: have incorrect data corrected.
- Portability: get your data in a structured, machine-readable format. Write to us and we send it to you.
- Objection: object to processing based on legitimate interests.
- Restriction: ask us to restrict processing in certain cases.
To use any of these rights, write to the address below. We answer within one month.
7. Security
All connections are encrypted (TLS), and Cloudflare encrypts stored data at rest. Access to personal data is limited to the parts of the service that need it.
8. Changes to this policy
When we change this policy, we update the date at the top of this page.
9. Complaints
If you think we handle your data incorrectly, you can complain to a data protection supervisory authority, for example the one where you live or the one responsible for us: the Berlin Commissioner for Data Protection and Freedom of Information.
Contact: [email protected]