Privacy notice
SHORT VERSION
- No cookies, no ads, no third-party trackers or analytics, no accounts.
- The games keep a random device id in your browser so a device is counted once. Our server stores only a salted hash of it, never your IP address.
- You can switch the counter off for this device, or delete everything tied to it, right here.
- If you join the waitlist, we keep your e-mail address only to tell you when the Starter Kit and course are ready.
1. WHO IS RESPONSIBLE
The controller of your personal data is:
fixli.eu Korlátolt Felelősségű Társaság (fixli.eu Kft.)1125 Budapest, György Aladár utca 27/D, Hungary
Company registration number: 01-09-444326
Tax number: 32820175-2-43
E-mail: gary@garygitpush.com
Gary Gitpush is an AI-generated character published by fixli.eu Kft. Messages to Gary reach the people at fixli.eu Kft. We have not appointed a data protection officer, as the law does not require one for this processing; write to the address above with any question.
2. THE PLAYER COUNTER
What is processed
- On your device: a random device id (22 characters, made by the game, not derived from anything about you) and the date it was created, stored in your browser's local storage under
gary.pid.v1. If you opt out, a flaggary.telemetry.optoutis stored next to it and nothing is sent while it is set; the id itself stays on your device until you press FORGET THIS DEVICE or clear the site data. - Sent to us when you play: the device id, which game, a random id for the game round, the map seed (e.g. today's date), how long the round was played and a checksum. While a game is open and visible, a short "still here" signal every 30 seconds.
- Stored on our side: not the device id itself but a one-way hash of it combined with a secret value (SHA-256 with a salt). Next to that hash: first and latest day you finished a round, on how many days, how many rounds, open rounds (start time, seed, duration), the time of the latest "still here" signal, and per-minute request counters for rate limiting.
Not processed by us: your IP address is never stored by our application, no cookies are set, no browser fingerprinting, no tracking across other websites, no names or accounts. Request logging for the site's API is switched off.
Why, and on what legal basis
To show public, honest player numbers per game (the whole point of the challenge), to keep bots and replays out of those numbers, and to keep the service stable. The legal basis is our legitimate interest (Article 6(1)(f) GDPR) in running a public, verifiable player count for the games. We keep this interest small: pseudonymous data only, the shortest storage that works, and a one-click opt-out.
Storing the device id on your device is done because it is strictly necessary for the game feature you use, the public player count (Section 155(4) of the Hungarian Electronic Communications Act, Article 5(3) of the ePrivacy Directive). If your browser sends a Global Privacy Control signal, or you opt out, the games send nothing.
How long
| "STILL HERE" SIGNAL | Counts as online for 90 seconds, then deleted at the next sweep (within about two minutes). |
|---|---|
| ROUND RECORDS | Removed by the daily clean-up once they are 24 hours old, so within 48 hours of the round starting. |
| RATE-LIMIT COUNTERS | Per-minute counters, deleted within two days. |
| PLAYER RECORD | Kept while the device keeps playing. Deleted 13 months after its latest finished round; only the anonymous total stays in the count. |
| DEVICE ID ON YOUR DEVICE | Replaced with a new random id after 13 months. You can delete it any time (button below, or by clearing site data). |
3. THE WAITLIST
What: your e-mail address, the time you agreed and the version of the consent text you saw, where on the site you signed up, and the status of your signup (pending, confirmed, unsubscribed). When confirmation e-mails start, also a hashed one-time confirmation token and the times it was sent and clicked.
Why and legal basis: to e-mail you about Gary's AI Dev Starter Kit and course: a confirmation link first, then launch news. Basis: your consent (Article 6(1)(a) GDPR). You can withdraw it at any time by writing to gary@garygitpush.com or with the unsubscribe link in every e-mail; withdrawal doesn't affect what happened before it. Keeping the record of your consent is based on our legal obligation to be able to prove it (Articles 6(1)(c) and 7(1) GDPR).
How long: until you withdraw consent or we drop the product, then deleted within 30 days. An address that is never confirmed is deleted 30 days after the confirmation e-mail was sent. No e-mails are being sent yet; until they are, unconfirmed signups are deleted 90 days after you signed up.
The waitlist is for people aged 16 or over. Spam protection works without storing anything about you: a hidden form field, a minimum fill time, and a short-lived counter that Cloudflare keeps for 60 seconds under a salted hash of your connection address.
4. WHO ELSE SEES THE DATA
The site, the API and the database run on Cloudflare (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA), acting as our processor under its data processing agreement. Data is stored in Cloudflare's EU jurisdiction. Cloudflare necessarily sees your connection's IP address in order to deliver the site and protect it from attacks; how Cloudflare handles that is described in its own privacy policy. Where data reaches Cloudflare outside the EU, the transfer relies on the EU–US Data Privacy Framework and the European Commission's standard contractual clauses.
Before the first confirmation e-mail goes out, this notice will name the e-mail delivery provider we use. We don't sell or share data with anyone else, and nothing is used for advertising. No decisions with legal or similarly significant effects are made automatically; the anti-bot rules only decide whether a round counts.
5. YOUR RIGHTS
You can ask for access to your data (Article 15 GDPR), correction (16), deletion (17), restriction (18) and a portable copy (20), object to processing based on legitimate interest (21), and withdraw consent (7(3)). Write to gary@garygitpush.com; we reply within one month.
About the counter: from the stored hash we can't tell who you are, so we can only find your record if you give us your device id (shown below). The button below deletes it directly, without writing to anyone (Article 11 GDPR).
6. COMPLAINTS
If you think we handle your data unlawfully, please tell us first so we can fix it. You also have the right to lodge a complaint with the Hungarian supervisory authority:
Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)1055 Budapest, Falk Miksa utca 9–11, Hungary · postal: 1363 Budapest, Pf. 9.
Phone: +36 1 391 1400 · E-mail: ugyfelszolgalat@naih.hu · naih.hu
You can also complain to the supervisory authority of the EU country where you live or work, or go to court; in Hungary the regional courts (törvényszék) hear these cases, and you can choose the one where you live.
7. SECURITY AND CHANGES
Traffic is encrypted (HTTPS). Device ids are stored only as salted one-way hashes; the salt is a secret held outside the code. Access to the database is limited to the fixli.eu Kft. team running the site. If this notice changes, the new version is published here with a new date; for waitlist members, significant changes are announced by e-mail.