Privacy policy
A small studio. A small amount of data. Here’s what we collect, why, and how to stay in control.
Updated 2026-10-11
Who is responsible
Bacioiu Constantin-Ciprian PFA, Romania, operates Bearded Giant Games at https://beardedgiantgames.com. For privacy requests, write to contact [at] bacioiu [dot] me, or use Contact.
Anonymous website statistics
With your consent, we count public page views and link clicks to help understand which games and articles interest visitors. Daily totals older than 365 days are deleted when the service next handles a request. The statistics do not contain IP addresses, email addresses, cookies, unique visitor IDs, query strings, URL fragments, referrers, device fingerprints, or individual browsing histories. Counts include opted-in visits; they are not counts of unique people. You can withdraw consent through Privacy settings on any page. Anonymous totals already recorded cannot be associated with an individual.
The mailing list
When you explicitly subscribe, we use your email address to send game announcements and occasional studio updates. The legal basis is your consent. A confirmation email verifies your signup; newsletters are sent only after you confirm. Consent is recorded with its wording version, signup time, and confirmation time. Pending signups expire after seven days and are deleted when the service next handles a request. Active signups stay until you unsubscribe or request removal. We do not sell your address or use tracking pixels in newsletters.
Subscriber addresses and signup details are encrypted at rest. The decryption key stays in the studio’s local Mac app. The host processes your address briefly to send confirmation mail and keeps a keyed address digest to prevent duplicates and match removal requests. Form abuse protection uses a keyed IP digest valid for up to one hour; expired digests are deleted on the next service request. No raw IP address is retained by the signup service. The host sees normal connection data needed to deliver requests.
You can unsubscribe online without signing in, or request removal by email. Newsletter recipients are hidden from each other using BCC. Our email provider and your email provider process messages to deliver them. Deleted list entries are not kept in a separate mailing-list archive; your correspondence and sent messages may remain in the mailbox.
Contact messages
The contact form prepares a draft in your email client. Its contents are not submitted to this website. If you send it, we process your message and address to reply and handle your request, based on our legitimate interest in answering inquiries. Routine correspondence is retained only as needed to handle the inquiry; records required for a contract or legal obligation may be retained for the applicable period.
Hosting and third parties
Hosting and confirmation-email provider: Namecheap, Inc. — Stellar Plus shared hosting (EU datacenter). Hosting and email processing locations: Netherlands (website and cPanel email hosting); Romania (local administration and newsletter sending). Namecheap may also process customer data in the United States under its data-processing agreement.
Hosting security/access logs: Current raw access logs are processed and discarded every 24 hours. cPanel log archives are configured for 30-day automatic retention; previous-month cleanup is also enabled. Provider-managed security, email and backup logs follow Namecheap’s service/legal retention requirements; Namecheap does not publish a single fixed period for those logs. Hosting logs are separate from our anonymous statistics and are used for operating and protecting the service.
Namecheap’s data-processing agreement includes standard contractual clauses for applicable transfers outside the EEA. Its hosting data-processing notice describes hosting, email logs, and backups.
We use consent for optional YouTube and itch.io embeds. External stores and social networks process data under their own policies when you follow their links. Optional embeds may transfer data outside the EEA; check Google’s privacy policy and itch.io’s privacy policy for their recipients, safeguards, and storage practices. You can use direct store links while leaving embeds disabled.
Your rights
Subject to the GDPR’s conditions, you can request access, correction, erasure, restriction, portability, or object to processing based on legitimate interests. You can withdraw consent at any time without affecting the lawfulness of earlier processing. Contact contact [at] bacioiu [dot] me to exercise these rights; we may ask for information needed to verify the request. We normally respond within one month. You may complain to your local supervisory authority or Romania’s ANSPDCP.
Browser choices
The cookies & storage policy explains necessary preference storage and optional content. . We do not make automated decisions or profile visitors.