Privacy and cookies
Last updated 7 September 2026
The short version
Ghosts of Reykjavik has no accounts, no sign-up, no newsletter and no tracking of its own. The pages are static files. What personal data gets processed comes from the services listed below, and where the law requires your consent first, you are asked first and you can change your answer at any time.
Who is responsible
The controller for this site is the operator named on the legal notice, a private individual in Iceland. Contact: contact@ghostsofreykjavik.com. Full details are on the legal notice.
The site is operated from Iceland, which is in the European Economic Area, so the General Data Protection Regulation applies through Act No. 90/2018 on Data Protection and the Processing of Personal Data.
What is processed, and why
| Data | Why | Legal basis |
|---|---|---|
| Your IP address and browser details, seen by the servers that deliver the pages and images | Sending you the page you asked for, and keeping the site available and secure | Legitimate interest, Art. 6(1)(f) |
| Advertising and measurement identifiers, if ads are running and you have agreed to them | Paying for the site through advertising | Consent, Art. 6(1)(a) |
| A members cookie, if you enter a members code | Keeping you signed in to the members area for 60 days | Strictly necessary for a service you asked for |
| Your email address and whatever you write in it, if you email us | Reading and answering your message | Legitimate interest, Art. 6(1)(f) |
| The link to your clip, the game it is from and the channel name you want credited, if you enter The Cut | Watching the clip, deciding whether to cut it into a video, and crediting you if we do | Performance of the terms you agreed to, Art. 6(1)(b) |
There is no analytics package on this site. Visitor numbers come from YouTube’s own statistics for the channel, which are aggregate counts and identify nobody.
Cookies
Cookies that are strictly necessary are set without asking, because the law allows that and because the site cannot do the job without them. Everything else waits for your consent.
- gor_member, set only if you enter a members code. It holds a signature, never the code itself, lasts 60 days, and exists so you are not asked again on every page. Strictly necessary.
- A first-visit flag in your browser’s local storage, which records that the opening animation has played so it does not play again. It stays in your browser, is never sent anywhere, and identifies nobody.
- Advertising cookies, set by Google and its partners only if ads are running and only after you have agreed. Details below.
Advertising and consent
This site currently shows no advertising and loads no ad code at all. When that changes, a consent message will ask you before any advertising cookie is set, this section will name the network and say how to opt out, and the date at the top of this page will change.
Who else is involved
- Vercel hosts the site and serves every page. It sees the requests that reach it, including your IP address, and keeps them briefly for security and for delivery.
- Google serves the thumbnails on guide pages from YouTube’s image servers, and, once ads are running, the advertising. Loading an image tells Google your IP address and browser, the same as any image on any page.
- Valve serves the game artwork on the homepage board from Steam’s image servers. It is the publisher’s own store art, loaded straight from Steam, and loading it tells Valve your IP address and browser, the same as any image on any page. The pictures are all that is loaded, so no Steam script runs here and no Steam cookie is set.
- YouTube is where the videos live. Following a link takes you to Google’s service, where Google’s privacy policy applies rather than this one. No video is embedded in these pages, so nothing plays and nothing from YouTube is loaded until you choose to go there.
- Tally runs the entry form for The Cut, our clip submission round. It is a company in Belgium and it acts as our processor, which means it holds what you type on our behalf and under our instructions. Responses are encrypted in transit and at rest and are stored in Europe. Its own privacy notice covers what it does as a company in its own right.
The form is a page on Tally’s own site and it opens in a new tab. It is deliberately not embedded here. An embedded form loads that company’s code into this page and sets cookies through it, which is precisely what these pages avoid, so nothing of Tally’s loads unless you click through and choose to fill it in. Entering is voluntary, no part of the site requires it, and you can ask us to delete an entry at any time.
We ask for a link to your clip, the game, and the channel you want credited. We do not ask for your email address, your age, your address or your real name, and there is no account and no file upload. Your clip stays wherever you published it, because we take a link to it rather than a copy of it.
Data leaving the EEA
Google and Vercel are United States companies and some processing happens there. Both rely on the European Commission’s standard contractual clauses, and both are certified under the EU-US Data Privacy Framework, which is the legal route the Commission has recognised for those transfers.
Entries to The Cut do not leave the European Economic Area. Tally is established in Belgium and stores responses in Europe, which is part of why it was chosen over the American alternatives.
How long anything is kept
The members cookie lasts 60 days and then expires. Emails you send are kept while the conversation is useful and deleted after that. Server logs at the host are short-lived and are the host’s to keep. Nothing else is stored, because nothing else is collected.
Entries to The Cut that we did not use are kept for twelve months after the round closes and are then deleted, and you can ask us to drop yours sooner. Where we did publish a clip, we keep the channel name and the link for as long as that video is up, because the credit on the video has to stay accurate and the record of what we were allowed to use has to stay with it.
Your rights
Under the GDPR you can ask for a copy of the personal data held about you, ask for it to be corrected or deleted, ask for its use to be restricted, object to processing based on legitimate interest, ask for it in a portable form, and withdraw consent you have given without that affecting anything done before you withdrew it.
Email contact@ghostsofreykjavik.com. A reply comes within 30 days. Since this site holds no accounts, most of these requests are answered in one line.
If you are unhappy with the answer you can complain to Persónuvernd, the Icelandic Data Protection Authority, or to the data protection authority in the EEA country you live in.
Children
This site is written for people who play the games it covers and it is not directed at children under 13. No age is asked for and none is stored. Advertising served here is set to be treated as non-personalised for anyone Google identifies as a child.
The Cut is the one part of the site that asks anything of you, and it is for people aged 16 or over. Under 16, a parent or guardian enters on your behalf. We ask for no date of birth and store no age, so this is a condition of entering rather than something we verify.
Changes
When this page changes, the date at the top changes with it. A change that affects what is collected or who receives it will be described here before it takes effect.