This policy explains what data the MiDaDiX games portal (midadix.com, "the service", "we") processes, why we do it and how you can manage your data. We try to collect as little as possible: you can play without an account and without giving any personal details.

Who is responsible for your data

The operator (owner) of the service and the party responsible for processing personal data: Роман Евгеньевич, м. Кременчук, Україна.

For any questions about your data, write to zhimchik@gmail.com.

The key points

You can play as a guest: we do not ask for your name, email or phone number.
An account is optional. If you create one, we store your email (or your linked Google, Apple or Telegram login), nickname and year of birth.
We use only essential cookies and our own analytics. There are no advertising cookies or third-party trackers, so we do not show a cookie consent banner.
We do not sell data or share it with advertisers.
Data is stored on our hosting provider's servers in Ukraine.
You can download your data, correct it or delete your account in your profile settings.
Children under 13 use child mode, which has some restrictions (see the "Children" section).

What data we process

If you play as a guest

Guest identifier: a random code in the midadix_guest cookie. The server stores only a hash of it, not the code itself.
Automatic nickname, such as "Guest 1234".
Game data: saved progress, game results, achievements, favourite games.

If you create an account

Email address: if you sign in with a link from an email or with a password.
Password: only as an irreversible hash; we never see or store the password itself.
Year of birth: only the year, not the full date. It is used only for age rules and is not shown on your profile.
Nickname, avatar (chosen from a ready-made set; photos cannot be uploaded), interface language, profile visibility settings.
Linked sign-in methods: if you sign in with Google, Apple or Telegram, the provider gives us the identifier of your account with them and, if the provider shares and has verified it, your email address. We never receive your passwords for those services.

Game sessions and results: score, duration, game statistics and a short log of in-game actions, which we need to check that a result is fair.
Saved progress in games, achievements, tournament entries, and challenge links you have created.
Friends, friend requests and blocks.
Reviews (comments) on games and moderators' decisions about them, and reports you have sent.
On-site notifications and your email notification settings.

Technical data

For security (limiting the number of requests, protecting against hacking and abuse) we briefly use your IP address and information about your browser. The hosting provider's web server logs may contain IP addresses.
Our application logs do not record IP addresses: instead of a player's identifier they store a hash of it, and email addresses, passwords and tokens are hidden automatically.

Our own analytics

To understand which games people like and where something breaks, we record usage events: for example, opening a game page, starting and finishing a game, or sending a challenge link. Events are linked to an internal player identifier, are processed only on our own servers and are not shared with third-party analytics or advertising services.

What we do not collect

Phone number, exact date of birth, location, photos, contacts from your address book, payment details (there are no payments in the service).

Why we process data and on what basis

Purpose	Data	Legal basis
Running the service: launching games, saving progress, signing in to your account	guest identifier, account data, game data	performance of a contract (the Terms of Use)
Age rules and child mode	year of birth	performance of a contract; legal obligation to protect children
Leaderboards, tournaments, checking that results are fair	results, game log	performance of a contract; legitimate interest in fair play
Friends, reviews, reports, moderation	social data, reviews, reports	performance of a contract; legitimate interest in a safe community
Service emails (sign-in, email confirmation, password recovery, data export ready)	email address	performance of a contract
Email notifications about events (can be turned off in settings or via the link in the email)	email address, notification settings	your consent or legitimate interest (to be confirmed by a lawyer)
Security, preventing abuse	technical data	legitimate interest
Improving the service	our own analytics	legitimate interest

The legal bases listed are provisional and will be confirmed after a legal review taking into account the applicable law (in particular, the Law of Ukraine on Personal Data Protection and, for users in the EU, the GDPR).

Cookies and browser storage

We use only cookies without which the service cannot work, and we do not use advertising or third-party analytics cookies. That is why no cookie consent banner is shown.

Name	Purpose	Duration
`midadix_guest`	guest profile: progress and favourites without an account	1 year
`midadix-session`	session: signing in to your account, protecting forms	up to 2 hours of inactivity
`remember_web_…`	"remember me" after signing in to your account	until you sign out, no more than 400 days
`XSRF-TOKEN`	protection against request forgery (CSRF)	same as the session
`midadix_locale`	chosen interface language	1 year
`midadix_staff_session`	staff sign-in to the admin panel (only the `/admin` section)	up to 2 hours of inactivity

As well as cookies, a game page may temporarily keep a save or result in the browser's local storage (localStorage) if it could not yet be sent to the server (for example, if the connection drops). Once it has been sent, the entry is deleted.

Games are loaded from a separate domain (games.midadix.com) and have no access to the portal's cookies.

Who we share data with

Hosting provider ukraine.com.ua: hosts the servers, database and backups.
The hosting provider's mail server: sends service emails and notifications.
Google, Apple, Telegram: only if you have chosen to sign in with them. They learn that you have signed in to MiDaDiX and handle this under their own privacy policies.
Public authorities: only when the law requires it.

We do not sell personal data or share it with advertisers or data brokers. Service staff (moderators, administrators) can access only the data they need for their work; their actions are recorded in an audit log.

Where data is stored

Data is stored on our hosting provider's servers in Ukraine. When you sign in with Google, Apple or Telegram, data passes through those companies' servers, which may be located outside Ukraine.

How long we keep data

Data	Duration
Account and profile	as long as the account exists
Account after a deletion request	30 days, then anonymised (see below)
Guest profile	the cookie lasts 1 year; how long inactive guest profiles are kept on the server is still being decided
Analytics events	13 months
On-site notifications	90 days
Your data export file	24 hours after it is prepared
Application logs	14 days
Backups	according to the hosting provider's schedule (to be confirmed)

What happens when you delete your account. 30 days after your request we delete your email, password, year of birth, linked sign-in methods, sessions, favourites, saves, friends, friend requests, blocks and notifications, and replace your nickname with an anonymous one (such as deleted-1a2b3c4d). Game results and leaderboard entries are kept under this anonymous nickname so that other players' positions do not change. Published reviews also remain under the anonymous nickname. If you sign in to your account again within the 30 days, the deletion request is cancelled.

Your rights

You can:

find out what data we hold and get a copy of it: in the "Settings" section of your profile, the "Download my data" button prepares a JSON file with your profile, progress, results, reviews, favourites, friends and achievements. You can make a request once a day, and the link to the file works for 24 hours;
correct your data: your nickname, avatar, language and profile visibility can be changed in settings; for anything else, write to us;
delete your account: in settings, using the "Delete account" button;
move your data: the export file is in the machine-readable JSON format;
withdraw consent and unsubscribe from email notifications: in notification settings or via the link in the email;
object to processing or ask for it to be restricted: write to us;
make a complaint to a personal data protection authority (in Ukraine, the Ukrainian Parliament Commissioner for Human Rights; in the EU, the supervisory authority in your country).

Send requests that cannot be handled in settings to zhimchik@gmail.com from the email address linked to your account. We will reply within the time limit set by the applicable law (as a guide, no more than 30 days). To protect your account, we may ask you to confirm that the request really came from you.

Children

MiDaDiX is designed for families. You can play as a guest without giving any personal details.

When an account is created, we ask for the year of birth. Accounts for players under 13 automatically work in child mode:

you cannot write reviews, add friends or send friend requests;
the profile is always private and cannot be opened by other players;
you cannot take part in tournaments or public leaderboards, and you cannot create challenge links;
you can play, save progress, add games to favourites and earn achievements.

Find out more on the "Child Mode" page.

The laws of many countries (for example, COPPA in the USA and Article 8 of the GDPR in the EU) require consent from a parent or legal guardian to process the data of a child under a certain age (from 13 to 16, depending on the country). The service complies with this requirement: the procedure for obtaining and verifying parental consent will be approved after a legal review and introduced before accounts for children are publicly launched.

If you are a parent and think your child has created an account without your permission, write to zhimchik@gmail.com and we will help you delete the account and its data.

How we protect data

Your connection to the site is encrypted (HTTPS), and cookies are sent only over a secure connection and cannot be read by scripts.
Passwords are stored only as a hash; sign-in links can be used once and work for 15 minutes.
Staff sign in with a separate account that requires two-factor authentication; access depends on their role, and their actions are recorded in an audit log.
Backups are made using the hosting provider's tools.

Changes to this policy

This policy has a version number and date, shown at the top of the page. We will announce significant changes on the site in advance and notify account holders with a confirmed email address by email.

Contact

Роман Евгеньевич, м. Кременчук, Україна

Email for questions about your data: zhimchik@gmail.com