Privacy Policy
Xantoluda is a small, independent editorial site. It collects as little as it can get away with. This policy explains what that means under Canadian law.
Who we are
Xantoluda is an independent, non-commercial editorial guide to mobile simulation and management games, run by an individual in Hamilton, Ontario, Canada. It is not a registered company, so no business or registration number is quoted here. For anything in this policy, contact the person responsible for privacy at [email protected].
What we collect
- Subscription form details. If you submit the form on the contact page, we receive the name and email address you type in. We do not ask for a phone number and there is no field for one. The optional message box is for your own notes and its contents are not sent or stored anywhere.
- Push notification subscription. If you allow notifications, your browser creates an anonymous push subscription (a device or browser token, plus basic technical details such as browser type, operating system, language, approximate region derived from your IP address, and your last visit). This is what lets a notification reach your device.
- Basic server logs. Like almost every website, our host records standard technical data when a page loads: IP address, browser and device type (user-agent), the page requested, and a timestamp. These logs exist for security and to keep the site running.
We do not run advertising, ad profiling or cross-site behavioural tracking, and we do not use advertising cookies. See the Cookie Notice for the technical detail there and for what the push service stores in your browser.
Push notifications
Push notifications are strictly opt-in and off by default. Nothing is sent unless you tick the consent box, submit the form, and then accept your browser's own permission prompt. That prompt is issued by your browser, not by us, and we cannot subscribe you without it.
We use the notifications to tell you when a new game is added to the list, or when a price or rating we have published changes. If you also give us your email address, it may be used to send you the same kind of update.
You can withdraw consent at any time and it takes effect immediately: turn notifications off for this site in your browser settings (Site settings, then Notifications, then Block), use the unsubscribe link in any email we send, or email [email protected] and ask us to remove you. Withdrawing is as easy as signing up was, and costs nothing.
Why we use it, and the legal basis
- To send you the updates you asked for. We use your name, email and push subscription to send site updates by browser notification or email. Under PIPEDA this rests on your express consent, given when you tick the unticked box, submit the form, and accept the browser permission prompt.
- To reply to you. If you email us directly, we use your email address only to answer you.
- To keep the site secure and working. Server logs are kept for legitimate operational and security reasons.
Notifications and update emails are commercial electronic messages under Canada's Anti-Spam Legislation (CASL), so we only send them on express, opt-in consent. The consent box is never pre-ticked, every message identifies us and carries a working unsubscribe, and we action unsubscribes promptly. We do not sell or share your details with advertisers.
Consent, and withdrawing it
You give consent by ticking the box and submitting the form, and, for notifications, by accepting your browser's permission prompt. You can withdraw it at any time, as easily as you gave it: block notifications for this site in your browser, use the unsubscribe link in an email, or email [email protected] and ask us to stop using or to delete your details, and we will.
Who we share it with
We do not sell, rent or trade personal information. Two third parties act as our service providers, under contract and on our instructions only:
- Our web hosting provider, which processes server logs and email on our behalf.
- OneSignal (OneSignal, Inc., United States), which delivers the browser notifications and update emails. It processes your push subscription, your email address if you give one, and the tags we attach to your record, which are your name and this site's domain. OneSignal is contractually bound to use this only to deliver messages for us. Its own privacy policy is at onesignal.com/privacy_policy.
We do not disclose your information to anyone else unless the law requires it.
Where your information is handled
Our hosting and email may be processed on servers located outside Canada, including in the United States. The same is true of notifications: OneSignal stores and processes your subscription, email address and tags on servers in the United States, so submitting the form means your information is transferred outside Canada. Once there, it is subject to the laws of that country, including lawful access by US authorities, and is protected by the provider's contractual safeguards. Quebec Law 25 requires us to tell you about this and to assess such transfers, which is what this paragraph does. If you would prefer not to have your data leave Canada, do not subscribe, and contact us by post through the address available on request instead.
How long we keep it
Your subscription details are kept until you unsubscribe or ask us to delete them, after which they are removed from OneSignal. Emails you send us directly are kept only as long as needed to deal with your enquiry and any reasonable follow-up, then deleted. Server logs are rotated and deleted by our host on their standard short cycle.
Your rights
Under PIPEDA and Quebec Law 25 you can:
- Ask what personal information we hold about you and get a copy of it.
- Ask us to correct anything that is wrong.
- Ask us to delete it, or withdraw your consent.
- Ask a real person how any decision involving your data was reached.
Email [email protected] and we will respond within a reasonable time at no charge.
Complaints
If you are not satisfied with how we handled your information, you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca. Quebec residents may also contact the Commission d'acces a l'information du Quebec (CAI).
Changes to this policy
If this policy changes, the new version and its date will appear on this page. Material changes to how we handle data will be described plainly here.