YOUR PRIVACY

Privacy, in plain language.

Page last updated: 2026-10-03.

Who operates this service?

My Game Rewards is an independent guide to public game rewards. The data controller is Vichitar Dagar.

For the operator’s full legal details, see the legal notice. The email above handles privacy requests and questions.

What we process

You do not need an account. We do not ask for your name, email address, contacts, precise location or game login. Saved rewards and their details stay on your device. We do not sync them to our server.

When your app or browser contacts the service, our server logs operational request details: the connecting IP address, request time, path, response status and user agent. We use these logs to keep the service running, fix problems and stop abuse. We do not use them to build advertising profiles. Our web server also keeps a security log of each request for 10 days. It records the time, IP address, request method, page path without any query string, response status, size, user agent, and the host (not the full address) of the referring site. It does not record cookies or other request headers, and it is not included in backups. We rely on our legitimate interest in keeping the service secure and available (Article 6(1)(f) GDPR) for this log. The log needs no cookie or storage on your device, so it is separate from your analytics choice. To stop abuse, the server also applies request rate limits. It may temporarily block an IP address that sends an abnormal volume of requests or probes for vulnerable pages. Blocks use only this log and expire automatically, usually after one hour and at most after 24 hours. Configured service log retention: Web server security log kept for 10 days (time, IP address, request method, path without query string, response status, size, user agent and referring host only); application Docker logs rotate at 10 MB per file, up to 3 files per service; host system journal capped at 100 MB with 14-day maximum retention.. The default Docker setup rotates each service’s logs at 10 MB per file and keeps up to three files. This is a size limit, not a fixed number of days. A hosting company, network provider or separately configured reverse proxy may keep additional logs under its own retention rules. Those providers are named below.

We gather reward listings from public pages run by game publishers and publications. They describe games and promotions, not individual users.

For editorial updates, we may keep source URLs, short factual notes and observation times as private evidence attached to a draft or published post. This evidence supports corrections and is not shown on public pages. Only the signed-in editorial workspace and database operators can access it. Evidence is kept with its post in the application database and follows the database-backup retention described below.

Reward buttons lead to game publisher services. On a desktop, our server generates the QR code locally, so you can open the publisher’s reward URL on your phone. We do not send it to a third-party QR service. Opening that URL connects your device to the publisher or its app-link provider, whose own privacy terms apply. We never receive your game login or any confirmation that a reward was redeemed.

Reward feedback is optional. After you open a reward link, you can report whether it worked, expired or was invalid. To stop one browser from counting more than once, the site stores a random browser token in that browser’s local storage. On our server, we keep a one-way hash of the token together with your current vote and reward ID. The token is not an account or a name, but it is a pseudonymous online identifier. You can change your vote from the same browser. We show only totals labelled as user reports. They do not verify redemption. Reports stop appearing in totals after 180 days and are deleted on a later feedback submission. To limit automated submissions, the server temporarily processes a keyed HMAC of the connecting address in memory. These short-lived entries are pruned regularly and are not saved to the report table. Ordinary server access logs may still process connection details as described above. Clear this site’s local storage to remove the browser token.

Hosting and service providers

Current environment: HostBRR Value 8GB VPS, Frankfurt, Germany; Caddy reverse proxy on this VPS The named hosting and reverse-proxy providers may process connection and security information to deliver and protect the service. They do so under their own published terms and the retention settings described above.

Database backups are encrypted on the VPS with age before they go to a private Oracle Cloud Infrastructure (OCI) Object Storage bucket. The backups hold reward listings, source evidence and operational database state. Device-local saved rewards and application access logs are not in these backups. OCI Vault supplies runtime secrets. The backup decryption key is stored separately from the backup objects.

Backup location: Oracle Cloud Infrastructure Object Storage, Frankfurt, Germany (eu-frankfurt-1). Backup retention: Oracle lifecycle policy expires sqlite/ encrypted backups after 30 days; deletion follows Oracle scheduling and may occur later. Local encrypted copies are removed after more than seven full days.. Oracle may process technical service and account metadata under its cloud-service terms. See Oracle cloud-service terms and HostBRR privacy information.

Optional website analytics

Separately from Google Analytics, we count overall visits with a first-party server-side aggregate. For successful public HTML page requests, we add counts for the UTC day, a page category (or known game page), a broad referral category such as search, social, other site or direct, and an approximate country. To work out the country, our server temporarily processes the connecting IP address with a locally stored IP-to-country database. It does not send the address to a geolocation service. The country estimate may be wrong, for example when someone uses a VPN, a proxy or a mobile network. We do not store the IP address, a visit-level record, raw URL or referrer, a browser identifier or a user agent in these aggregates. The country report contains only daily country totals, including an “unknown” bucket where lookup is unavailable. Known crawlers, health and API requests, static files and prefetch requests are excluded. These are page-view counts, not counts of unique people. We also count successful clicks on our PixSweep house promotion by UTC day and broad referral category. These click totals hold no visitor identifiers and no country. The redirect request is also recorded in the standard server access log, with its client IP address, user agent and referring host. Those logs are access restricted and retained for up to 10 days. Aggregate rows are retained for up to 400 days and pruned when a new page view or promotion click is recorded. These counts run regardless of your optional Google Analytics choice. They do not use browser storage or load a third-party analytics tag. Country data is provided by DB-IP under CC BY 4.0.

Where prior consent is required (the European Economic Area, the United Kingdom, and when our location lookup is unavailable), Google Analytics 4 stays off until you choose Accept. In most other places, a notice tells you that analytics is on and gives you a direct way to turn it off. In Switzerland, analytics stays off until you continue past an information notice or turn it off. We respect the browser’s Global Privacy Control signal and keep analytics off when it is on. These location rules are a practical default based on approximate IP geolocation. They cannot tell which law applies to every person or visit.

Google Analytics helps us understand visits, page use, device and browser information, and referral sources. Google receives technical connection information, including your IP address, when your browser contacts its services. Google Analytics uses cookies such as _ga to distinguish browsers. We do not send your game login or reward redemption results. Rejecting or turning off analytics does not affect your access to the site.

Use Analytics settings in the footer to change your choice at any time. We remember your choice, or that you saw the notice, in this browser for 90 days. Our Analytics cookies are set to expire after up to 90 days, and a visit does not extend that expiry. Turning analytics off stops future collection and removes these cookies. It does not automatically erase data already processed.

Our tag turns off Google Signals and advertising personalization, keeps advertising consent denied, and leaves URL query strings and fragments out of page-location data. Where consent is requested, it is the basis for optional analytics. In notice-and-opt-out locations, analytics may be on by default, subject to your right to object. Google may process data outside your country, including in the United States. See Google’s privacy policy and how Google uses information from partner sites. For requests about data already collected, contact us at the privacy email above. Analytics choices are separate from advertising consent.

Embedded posts and videos

Some news posts embed content from X, Instagram, Reddit and YouTube (served from youtube-nocookie.com). Each embed first appears as a static card with a link to the original. The provider’s script or player loads only after you click Load, after you choose “Always load embeds from this site” next to that button, or automatically. Automatic loading happens only for visitors whose country our server can determine as outside the EEA, the United Kingdom and Switzerland, and whose browser sends neither the Sec-GPC header nor the Global Privacy Control signal. If your country is unknown, if you are in one of those regions, or if Global Privacy Control is on, you see the static card and a Load button instead. This describes what the site does. It is not a conclusion about what any law requires. When an embed loads, the provider receives technical connection information such as your IP address and browser details. It may set or read cookies or similar identifiers under its own policy: X, Instagram, Reddit, YouTube and Google. The optional “Always load embeds from this site” choice is stored only in this browser for 90 days. It is separate from your analytics choice, and it is not offered or applied when Global Privacy Control is on. You can revoke it with the “Stop loading embeds automatically” button on a post page, or by clearing this site’s data in your browser. Embedded videos never autoplay.

Advertising and Google

The My Game Rewards Android app is being prepared for Google Play. Once released, the app is intended to show ads through Google AdMob, using the Google Mobile Ads SDK. It is also intended to use Firebase App Check with Google Play Integrity to protect the API the app calls. AdMob and Google may collect and process device identifiers, such as the advertising ID, your IP address and ad interaction data, for ad delivery, measurement and fraud prevention. Where consent is required, ads appear only after you make a consent choice through Google’s User Messaging Platform (UMP). You can change that choice later in the app under Ad choices.

The app keeps saved rewards, settings, a random feedback token and a list of the reward IDs you have opened or reported. All of this stays on your device. The token and the list drive “Visited” markers and stop the same reward from being reported twice. The token is not an account or a name.

If you report a reward as worked, expired or invalid, the app sends that report to the site’s feedback API, with the reward ID and your choice. The report has no name and no account details. The standard server logs and security log described above apply to these requests.

To tell you about new posts, the app checks the site’s public posts API about once an hour in the background, but only when your device is online. The check is an HTTPS request, and the standard server logs described above apply to it. When it finds new posts, the app shows a notification on your device. You can switch these off in the app’s Settings or in your Android settings.

The app is intended for people aged 13 and over and is not directed at children under 13.

The website currently shows only My Game Rewards house promotions. Third-party ad serving on the website is turned off.

Before third-party website ads go live, the operator must set up a consent experience that fits the visitor’s region and the ad technology. In the EEA, the UK and Switzerland, Google’s publisher requirements include a Google-certified CMP integrated with IAB TCF for personalized ads.

Legal basis, choices, and rights

We process operational logs to run the service, investigate errors and protect the site and API from abuse. You can object to this by contacting us at the privacy email above. We may still need to keep records to protect the service. The aggregate page-view counter exists only to understand general traffic. It does not build visitor profiles. Where data-protection law applies, you can contact us to ask about or exercise your data rights. You can also complain to your local data-protection authority. Advertising consent and privacy choices are requested where applicable rules and Google’s policies require them.

IP addresses and online identifiers can qualify as personal data. “No account” does not mean no data is processed. Hosting and advertising providers may process technical data under their own terms.

Changes to this policy

We may update this policy when the site or the services it uses change. The date at the top shows the latest revision.