Privacy policy

Updated 2026-10-11

Who is responsible

Bacioiu Constantin-Ciprian PFA, Romania, operates Bearded Giant Games at https://beardedgiantgames.com. For privacy requests, write to contact [at] bacioiu [dot] me, or use Contact.

Anonymous website statistics

With your consent, we count public page views, referring sites and link clicks to help understand which games and articles interest visitors and which sites link to us. A referring URL is reduced to its origin (protocol and domain); full paths, query strings, fragments and URLs containing credentials are excluded. Browsers may omit the referrer, so some traffic is recorded as direct or unknown. Daily totals older than 365 days are deleted from the hosting service when it next handles a request. Aggregate totals downloaded to the studio’s private local app and its backups may be kept indefinitely to compare long-term trends. The statistics do not contain IP addresses, email addresses, cookies, unique visitor IDs, device fingerprints, or individual browsing histories. Counts include opted-in visits; they are not counts of unique people. You can withdraw consent through Privacy settings on any page. Anonymous totals already recorded cannot be associated with an individual.

The mailing list

When you explicitly subscribe, we use your email address to send game announcements and occasional studio updates. The legal basis is your consent. A confirmation email verifies your signup; newsletters are sent only after you confirm. Consent is recorded with its wording version, signup time, and confirmation time. Pending signups expire after seven days and are deleted when the service next handles a request. Active signups stay until you unsubscribe or request removal. We do not sell your address or use tracking pixels in newsletters.

Subscriber addresses and signup details are encrypted at rest. The decryption key stays in the studio’s local Mac app. The host processes your address briefly to send confirmation mail and keeps a keyed address digest to prevent duplicates and match removal requests. Form abuse protection uses a keyed IP digest valid for up to one hour; expired digests are deleted on the next service request. No raw IP address is retained by the signup service. The host sees normal connection data needed to deliver requests.

You can unsubscribe online without signing in, or request removal by email. Newsletter recipients are hidden from each other using BCC. Our email provider and your email provider process messages to deliver them. Deleted list entries are not kept in a separate mailing-list archive; your correspondence and sent messages may remain in the mailbox.

Contact messages

When you submit the contact form, the website sends your name, email address, subject and message through our hosting email service to the studio’s contact mailbox. The form does not create a mailing-list subscription or save your message in the website’s data file. We process your message and address to reply and handle your request, based on our legitimate interest in answering inquiries. The same short-lived form abuse protection described above applies; email providers process messages and connection logs for delivery and security. Routine correspondence is retained only as needed to handle the inquiry; records required for a contract or legal obligation may be retained for the applicable period.

Hosting and third parties

Hosting and email provider: Namecheap, Inc. — Stellar Plus (EU hosting and confirmation mail) and Private Email (contact mailbox). Hosting and email processing locations: Netherlands (website and cPanel confirmation mail); United States (Namecheap Private Email for the studio contact mailbox); Romania (local administration and newsletter sending). Namecheap may also process data in the US under its data-processing agreement.

Hosting security/access logs: Current raw access logs are processed and discarded every 24 hours. cPanel log archives are configured for 30-day automatic retention; previous-month cleanup is also enabled. Provider-managed security, email and backup logs follow Namecheap’s service/legal retention requirements; Namecheap does not publish a single fixed period for those logs. Hosting logs are separate from our anonymous statistics and are used for operating and protecting the service.

Namecheap’s data-processing agreement includes standard contractual clauses for applicable transfers outside the EEA. Its hosting data-processing notice describes hosting, email logs, and backups.

We use consent for optional YouTube and itch.io embeds. External stores and social networks process data under their own policies when you follow their links. Optional embeds may transfer data outside the EEA; check Google’s privacy policy and itch.io’s privacy policy for their recipients, safeguards, and storage practices. You can use direct store links while leaving embeds disabled.

Your rights

Subject to the GDPR’s conditions, you can request access, correction, erasure, restriction, portability, or object to processing based on legitimate interests. You can withdraw consent at any time without affecting the lawfulness of earlier processing. Contact contact [at] bacioiu [dot] me to exercise these rights; we may ask for information needed to verify the request. We normally respond within one month. You may complain to your local supervisory authority or Romania’s ANSPDCP.

Browser choices

The cookies & storage policy explains necessary preference storage and optional content. Open Privacy settings. We do not make automated decisions or profile visitors.