Privacy policy

This site has no accounts, no forms, no newsletter and no advertising. Google Analytics counts visits, with your permission where the law asks for it. Apart from the cookie banner, the only JavaScript runs in the optional game companion described below. The sections below describe the little that does happen.

Who is responsible

The controller for the processing described here is Michał Sadurski, owner of RiddlePortal. You can reach us at [email protected].

This site does not sell anything. It describes the books and links to our Etsy shop, which is where any purchase happens and which carries its own seller information.

No Data Protection Officer is appointed; the processing here does not meet the thresholds in art. 37 GDPR.

What is collected

Server access logs. When you open a page, our hosting provider records the request: your IP address, the time, the page or file requested, the referring page, and your browser's user-agent string. An IP address is personal data, so this policy covers it even though we never link it to a name.

Google Analytics. Google Analytics 4 records the pages you view, how you reached the site (from a search engine or a link, for example), your device type, browser and screen size, and an approximate location that Google derives from your IP address. Google Analytics 4 does not log or store the IP address itself. It gives your browser a random identifier, kept in cookies, so that two page views can be counted as one visit. We see the results only as totals in reports.

In the United States, Canada outside Quebec, Australia and New Zealand, Google Analytics runs from your first visit. Everywhere else, and whenever we cannot tell where you are, it waits until you click Accept in the cookie banner. If you click Reject, or make no choice, it never loads and nothing is sent to Google. We tell which rule applies from the country, and in Canada the province, that Cloudflare reports for your IP address as it serves the page. That lookup is used for the one response and is not stored.

Nothing else. We do not use tracking pixels, embedded video, web fonts loaded from a third party, or social widgets. Downloading a free sample requires no email address and creates no record beyond the access log entry above.

Why, and on what legal basis

Access logs are processed to deliver the site, keep it available, and detect abuse such as denial-of-service traffic. The legal basis is our legitimate interest in operating and securing the service (art. 6(1)(f) GDPR).

Where the banner asks, Google Analytics runs only on your consent (art. 6(1)(a) GDPR and art. 399(1) of the Polish Electronic Communications Law). In the four countries named above it runs on our legitimate interest in knowing which pages are read and how visitors find the site (art. 6(1)(f) GDPR), and it stays off if your browser sends a Global Privacy Control signal, unless you click Accept. In every country, the Cookie settings button in the footer turns it off and deletes the analytics cookies.

How long it is kept

We do not receive, store or have any access to these logs. The site runs on Cloudflare's Free plan, and Cloudflare's raw request logs (Logpush and Logpull) are available only on its Enterprise plan. Nothing about your visit reaches us.

Cloudflare holds that technical metadata at its edge, as our processor, for as long as it needs it to keep the network secure and available. Cloudflare does not publish a fixed period for it, stating that it stores information "for a period of time that is consistent with the business purposes" it was collected for. Those operational and security needs are the criteria; we set no period of our own because we hold no copy.

Google Analytics keeps the events from your visits for two months, the shortest period it offers, and then deletes them. The totals in our reports remain. The analytics cookies expire 13 months after they are set.

Who else sees it

The site is built statically and hosted on Cloudflare Pages, a service provided by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). Cloudflare serves the files and processes the technical metadata described above in its server logs for security, network stability and DDoS protection. It acts as our processor under Cloudflare's Data Processing Addendum, which forms part of its subscription agreement, on the basis of our legitimate interest in hosting a secure and available site (art. 6(1)(f) GDPR).

Cloudflare is based in the United States. Transfers rely on Cloudflare's certification under the EU-US Data Privacy Framework and on Standard Contractual Clauses.

When Google Analytics runs, Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) processes the data described above as our processor under Google's data processing terms. Google may transfer it to Google LLC in the United States, relying on Google's certification under the EU-US Data Privacy Framework and on Standard Contractual Clauses. Google's data-sharing settings and Google signals are turned off for this site, so the data is not used for Google's own products or for advertising.

We do not sell, rent or share personal data with anyone else.

Cookies

This site sets cookies only when Google Analytics runs: _ga and _ga_T00CFKXEEB, which tell visits apart and expire after 13 months. Where the banner asks, neither is set before you accept. The Cookie settings button in the footer lets you change your answer anywhere.

Your answer to the banner is kept in your browser's local storage as rp-consent, so the banner does not ask again on every page. It records only the choice itself, so under art. 399(3)(2) of the Polish Electronic Communications Law it does not require consent.

Separately, Cloudflare may set a strictly necessary cookie, __cf_bm, to tell human visitors from bots; it expires after 30 minutes of continuous inactivity. It is needed to deliver the site you asked for and carries no advertising or profiling function, so under art. 399(3)(2) of the Polish Electronic Communications Law (Prawo komunikacji elektronicznej) it does not require your consent.

Game companion

The game companions for The Midnight Carnival (/apps/midnight-carnival) and The Storm Night (/apps/the-storm-night) each save your game progress, meaning the answers you got right and which hints and solutions you opened, in your browser's local storage so you can close the page and carry on later. That record stays on your device and is never sent to us or anyone else. Resetting the game in the companion (Start over, Reset game or Reset for another group) deletes it, and so does clearing this site's data in your browser. Saving progress is part of the service you ask for when you open the companion, so under the same art. 399(3)(2) it does not require your consent.

Leaving this site

Our PDF books are sold on Etsy, and the complete collection is also sold as a paperback on Amazon. When you follow a link to either store you leave this site, and that store becomes an independent controller of whatever it collects, including any purchase you make there. Its handling of your data is governed by Etsy's own privacy policy (opens in a new tab) or the Amazon.com Privacy Notice (opens in a new tab), not this one. We never receive your payment details.

Your rights

Under the GDPR you may request access to your personal data, its rectification or erasure, restriction of processing, or portability, and you may object to processing based on legitimate interest. Where processing rests on consent you may withdraw it at any time without affecting what was done beforehand. Write to the address above and we will answer within one month.

In practice, an access log entry is usually not enough on its own to identify you, so we may need more information before we can act on a request, or may be unable to act on it at all (art. 11 GDPR).

You also have the right to complain to the Polish supervisory authority: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl (opens in a new tab).

Automated decision-making

There is none, and no profiling.

Changes

If this policy changes we will update the date at the top of the page.