1. Who we are
Games Unleashed (gamesunleashed.com) is run from the United Kingdom by Simon, who is responsible for your data under UK data protection law (the “controller”). “We” on this page means him.
To ask anything about your data, email [email protected] or use the contact form.
2. What we keep, and why
UK data protection law asks us to give a legal reason (a “lawful basis”) for each thing we do with your data. Each item below ends with ours, which is one of these two:
- Contract: what we need to give you the account and the games you signed up for.
- Legitimate interests: keeping the site safe and working, stopping abuse, answering you, and knowing roughly how many people visit. We use these only where they don’t override your own interests, and you can object (see your rights).
- Your account
- Your email address, username and password, when you joined, when you confirmed you’re 13 or older, whether your email is verified, and your settings (such as whether table talk is on). Your password is never stored as you typed it: we keep only a salted, scrambled form of it (a hash), which can check a password but can’t be turned back into one. We email you only to verify your address, when you ask to reset your password or change your address, to tell you your password or address was changed from your profile, and to confirm your account has been deleted: no newsletters, no marketing. Our legal reason: we need this to run your account and the games (“contract”).
- Signing in
- When you sign in we keep a record of the session (a scrambled copy of the key in your cookie, which account it is for, and when it ends) and when you were last on the site. Our legal reason: we need this to run your account and the games (“contract”).
- Your games
- Your results (win or loss, against the computer or a person, when), whether you finished or left your recent online cribbage games, statistics and records, streaks, your rating in each game of two (Pool, Cribbage, Checkers, Backgammon, Dominoes, Gin Rummy, Four in a Row, Shuffleboard, Darts and Bowling), how many rated games you’ve played against each other member today (so the same two players count for less each time), your places in the leaderboards’ top ten as you last saw them (so we can tell you when someone has gone past you), Clubhouse Tokens, the items you’ve unlocked, your progress in the word games, and your coins in the casino games. Coins and tokens are play money with no value outside the site. A game in progress is kept while you play, with the last 40 lines of its table talk. Our legal reason: we need this to run your account and the games (“contract”).
- Your picture
- Adding a profile picture is up to you. We remake it as a small square image: nothing else from the file you chose is kept, so details a phone puts in a photo, such as where it was taken, are gone. Our legal reason: we need this to run your account and the games (“contract”).
- Friends and messages
- Your friends, friend requests, the members you’ve blocked, your private messages, your list of conversations (with the first few words of the latest message), the site alerts in the bell (and which of the club’s announcements you’ve dismissed), and your settings for them. Our legal reason: we need this to run your account and the games (“contract”).
- Reports and moderation
- If you report a message: who reported it, why, and any note you add. If a moderator acts: what they did, to whom, and why (for example a mute and its reason), kept in a log. If you delete your account, these records stay so that decisions can still be checked, but without your name, your notes or the words of yours they quoted: they show “Deleted player”. Our legal reason: keeping members safe (“legitimate interests”).
- Messages you send us
- The contact form keeps your name, email address, topic and message, and your account if you’re signed in, and emails them to our support mailbox so we can reply. It does not keep your IP address: it keeps a scrambled tag made from it (a keyed hash) that can’t be turned back into the address, so we can tell when several messages came from the same place. When we reply from the website, our reply is kept with your message and deleted with it. Our legal reason: so we can answer you (“legitimate interests”).
- Security and abuse prevention
- To stop people guessing passwords or flooding the forms, we count attempts for a short time: per IP address and action, per username when signing in, and per account for things like messages, friend requests and changes to your account. We keep those counts under a hash of the address, username or account, not the address or name itself, and delete them after about a day. Signing up, signing in, resending the verification email, password resets and the contact form also use Cloudflare Turnstile, a check that you’re a person, which sends your IP address and browser details to Cloudflare. Our web server and the site’s own program keep logs for finding faults and attacks. Our legal reason: keeping the site and your account secure (“legitimate interests”).
- Counting visits
- The cribbage page counts visits, so the site’s statistics can show how many people visit and the busiest moment, without a cookie and without storing anything in your browser. The server takes your IP address and your browser’s name and version (its “user agent”), adds a random value that is made fresh each day and never stored, and scrambles them together (a hash). It keeps only that scrambled tag and when it was last seen, for the day: the next day the random value is gone and so is the record, so a visit can’t be linked to you, to your account or to another day. Only the totals are kept. We may also use Cloudflare Web Analytics, which counts page views without cookies. Our legal reason: knowing roughly how many people visit (“legitimate interests”).
- Backups
- A copy of the whole database is made every night, so that nothing is lost if something goes wrong. Our legal reason: making sure nobody’s account or games are lost (“legitimate interests”).
We don’t sell your data or share it for advertising.
3. Cookies and your browser
The site sets one cookie of its own, to keep you signed in, and no advertising or tracking cookies.
| Name | What it’s for | How long |
|---|---|---|
gu_session | Keeps you signed in. Strictly necessary: without it you can’t use your account. | 30 days, or until you sign out |
The sign-in cookie is strictly necessary, so it doesn’t need your consent. Visits are counted without a cookie (see counting visits). Until 24 October 2026 the cribbage page set a second cookie to count visits; a browser that still has it is told to delete it, and it is never read. Until 4 November 2026 the sign-in cookie was called crib_session: a browser that still has it stays signed in, and the site moves it over to the new name and deletes the old one.
Your browser’s storage. Some games remember your choices in your browser (its “local storage”): sound on or off, the last mode or table you picked, your last bet in the casino games, the pool table’s display options, the word games’ contrast setting, Crazy Golf’s aiming guide and Orbit Ball’s cannon setting. These stay in your browser and are never sent to us. Clearing your browser’s data for the site removes them.
Cloudflare. Cloudflare (see who else handles it) may set its own security cookies, such as __cf_bm or cf_clearance, when it checks traffic for bots or after you pass one of its checks. Cloudflare describes these as strictly necessary. They are not used for advertising. Cloudflare Web Analytics, if we use it, sets no cookies.
4. Who else handles it
A few companies handle data for us, only to provide their service to us, under their standard terms for protecting customers’ data:
- OVHcloud
- Hosts the server the site and its database run on.
- Cloudflare
- Sits in front of the site, so every visit passes through it (your IP address, the pages you ask for, your browser’s details). It also runs Turnstile, forwards email sent to [email protected] to our mailbox, and provides Web Analytics. Cloudflare also uses Turnstile’s checks to improve its bot detection, which it does as a controller in its own right (Cloudflare’s Turnstile privacy addendum).
- Amazon Web Services
- Sends our email (Amazon SES): your verification, password reset and change-of-address emails, the notes that your password or address was changed, the email confirming your account was deleted, the messages you send with the contact form, which go to our support mailbox, and our replies to them.
Outside the UK. These providers work internationally, so your data may be processed outside the UK. Where it is, they rely on the safeguards UK law requires, such as their standard data transfer terms.
We would also share data if the law required us to, for example with the police under a court order.
5. What other people see
- Anyone, signed in or not
- The leaderboards: the top ten in each game, by username, with scores and dates. In the games of two this includes your rating, once you’ve played ten rated games and while you’ve played in the last 60 days.
- Other members
- Your profile card: username, picture, places on the leaderboards, and the month you joined. Your picture can be seen only by members who are signed in. If you go past a member on a leaderboard, the next time they visit the site tells them your username and your score there. Members can find you by your exact username, and by its first letters unless you switch off being found in your settings.
- Players at your table
- Your username and picture, whether you’re connected, and the table talk if it’s switched on (you can switch it off in a game’s settings). In online cribbage, players also see your reliability: a label worked out from how many of your last 20 online games you finished rather than left.
- Your friends
- Roughly when you were last here (online, within the hour, today, this week, this month, or longer ago), never the exact time, and since when you’ve been friends.
- Administrators
- To run the site, the administrators can see your account: your email address, when you were last online, how many devices you’re signed in on, your records, tokens and coins, and what you’re playing. They can’t see your password. They can change your username, and suspend an account that breaks the rules (it can’t be used while suspended). When you ask them to, they can download your data for you, or delete your account.
No other member ever sees your email address.
6. Private messages
- Messages go only between friends. They are kept on our server so you can read them on any device; they are not end-to-end encrypted.
- A message is seen by you and the friend you send it to.
- If the person a message was sent to reports it, the moderators see that message, up to three messages before it in the same conversation (from either of you) so they can judge it fairly, and the report’s note. The site’s tools give moderators no other way to read members’ messages.
- A message a moderator removes is hidden from both of you, but its text stays in our records, and the moderation log keeps its first 120 characters, so that decisions can be checked later.
- As with any website, whoever runs the server could reach the database directly. We don’t read messages outside the reports.
- Messages are kept until one of you deletes your account. Unfriending or blocking someone doesn’t delete them. Deleting your account deletes every conversation you had, for both of you: your friends lose those threads too.
7. How long we keep it
Most of what’s tied to your account is kept for as long as you have the account: it isn’t deleted for being old, and accounts aren’t closed for not being used. You can delete your account whenever you like (your rights). Here is what is deleted sooner, and what isn’t:
| What | Kept for |
|---|---|
| Your account, games, statistics, rewards, coins, friends, blocks and messages | Until your account is deleted: then at once (backups: below) |
| An account whose email was never verified | 30 days, then deleted with everything tied to it |
| Email verification link | Works for 24 hours |
| Password reset link | Works once, for 30 minutes |
| A new email address waiting to be confirmed, and its link | Works once, for 24 hours (until then your old address stays) |
| Your signed-in session | 30 days, or until you sign out or reset your password (changing your password ends your other sessions) |
| Your profile picture | Until you remove it (or a moderator takes it down) |
| A game in progress and its table talk | Until the table closes, normally within an hour of everyone leaving |
| Site alerts in the bell | Up to 90 days (at most 50) |
| Announcements you’ve dismissed | 30 days (as long as an announcement shows) |
| Reports, mutes and the moderation log | No automatic deletion (without your name once your account is deleted) |
| Messages sent with the contact form, and our replies | 12 months after we’ve dealt with them, or when you delete your account (the copy in our support mailbox: ask us) |
| The record of a visit (a scrambled tag, no cookie) | The day of the visit |
| Counts of sign-in and form attempts | About a day |
| The site program’s log (usernames for some actions, such as setting a picture or a moderator’s action; no email or IP addresses, and no message text) | Capped at about 50 MB, the oldest lines dropped first; usually started afresh when the site is updated |
| The web server’s log (IP address, time, page asked for, browser) | About two weeks |
| Backups of the database | On the server, one from each of the last 14 days and one from each of the last 8 Sundays (so up to about 8 weeks); on an external backup device, the last 30 nightly copies |
When we delete something, or you delete your account, it is gone from the site at once but stays in the backups until they are replaced: the backups keep a copy for up to about 8 weeks, and then it is gone for good.
8. Children
Games Unleashed isn’t intended for children under 13. To create an account you tick a box to say you’re 13 or older, and we keep when you did; we don’t ask for your date of birth and can’t check it. If you’re under 13, please don’t create an account. If you think a child under 13 has one, tell us and we’ll delete it.
The casino games (Hold’em and Blackjack) use play coins only: there is no real money, nothing to buy and nothing to win.
9. Your rights
Under UK data protection law you can ask us:
- for a copy of the data we hold about you: use Download my data in Profile and settings (a file of everything, in a common format), or ask us;
- to correct it: you can change your email address, password, picture and settings yourself on your profile page; we can change your username for you;
- to delete it: use Delete my account in Profile and settings (you’ll need your password). It happens at once and can’t be undone: you’re signed out everywhere and taken out of any game, and everything that’s yours is deleted, your conversations for both of you. Other players’ results against you stay, as they never name you, and reports, moderation records and any announcements you wrote as an administrator stay without your name. We email you to confirm (if your address was verified). If you can’t sign in, ask us and we’ll delete it within 30 days. Either way it leaves the backups within about 8 weeks;
- to stop or limit something we do on the basis of legitimate interests, if you object to it;
- for your data in a common format, to take elsewhere: Download my data gives you a JSON file.
How: email [email protected] or use the contact form. Write from the email address on your account if you can, so we know it’s you. It’s free, and we’ll reply within a month.
If you’re unhappy with how we’ve handled your data, please tell us first. You can also complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator: ico.org.uk.
10. Keeping it safe
The site is served only over an encrypted connection (HTTPS). Passwords are stored only as a salted, slow hash. The sign-in cookie can’t be read by the page’s scripts and isn’t sent to other sites. Backups can be read only by the server’s own account, and the owner keeps copies on his own computer. No system is perfectly secure, but if something ever went wrong with your data, we’d tell you and the ICO where the law requires it.
11. Changes to this page
When what the site does with your data changes, we’ll update this page and the date at the top. If a change matters to members, we’ll also say so on the site.
Last updated: 4 November 2026. The phone app’s policy: Games Unleashed - Offline privacy policy.