Legal

Privacy Policy

Last updated: June 10, 2026

This policy describes how Phalangix ("we", "us", "our") collects, uses, and protects personal data when you visit phalangix.com and any subdomain we operate. We follow the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA) as amended by the CPRA, and aim to collect the absolute minimum data required to run the site, regardless of where you are visiting from.

1. Who we are

Phalangix is an independent game studio. Contact for privacy-related questions: contact@phalangix.com.

2. What we collect and why

Contact form

When you send us a message through the contact form, we store the following so we can reply to you and prevent abuse:

  • Name and email address you provide
  • Subject and message body you provide
  • IP address and browser user-agent (rate limiting and spam prevention)
  • Timestamp of submission

This data is stored in a private log file on our hosting server. It is not shared with any third party, not used for marketing, and not sold under any circumstance. We retain contact submissions for up to 24 months and delete them after that, or sooner on request.

Visit statistics

We count page visits to understand which pages are popular. For each visit we keep, as anonymous aggregate totals only:

  • The requested URL path and a daily counter
  • A coarse device type (desktop, mobile, or tablet), browser family (for example Chrome or Firefox), and operating system family (for example Windows or Android), derived from the user-agent string your browser sends automatically with every request
  • An approximate country (for example RO or US), looked up from your IP address at the moment of the request. We store only the two-letter country code in an aggregate counter. Your IP address itself is never written to disk.
  • A separate aggregate count of automated (bot and crawler) traffic, kept apart so it does not distort the visitor figures

These are stored as running totals, never as a per-person record. We do not log or store IP addresses, do not store the raw user-agent, do not set tracking cookies, do not build any profile or fingerprint, and do not use any external analytics service (no Google Analytics, no Plausible, no Cloudflare Analytics). The country lookup is performed on our own server using a local copy of the DB-IP Lite database (CC BY 4.0); your IP address is not sent to any third party. Because the stored data is aggregate and non-identifying, it cannot be traced back to you.

Download statistics

When you download the Phalangix Launcher, or when the launcher installs or updates a game, we record the download as an anonymous event: which file was requested, the time, and the same coarse device, browser, and operating system categories described above. This lets us count how many downloads happen. We do not store your IP address or any identifier with these events, and they are not linked to your visits or to any contact message.

Admin area

If you log into the private admin area (not publicly linked), a server-side PHP session cookie is set so the server can recognise your authenticated session. This applies only to the site operator.

3. What we do not collect

  • We do not use third-party advertising networks.
  • We do not run third-party tracking pixels or fingerprinting scripts.
  • We do not embed social media tracking widgets.
  • We do not sell or share any data with marketing partners.

4. Legal basis for processing

For visitors in the EU/EEA, UK, and Switzerland (GDPR Art. 6)

  • Contact form: Article 6(1)(b) - performance of a request you initiated (replying to your message), and Article 6(1)(f) - legitimate interest in preventing abuse.
  • Visit and download statistics: Article 6(1)(f) - legitimate interest in measuring aggregate traffic and download volume. The user-agent header and IP address are processed only transiently, reduced to non-identifying categories (device, browser, operating system, and country), and discarded; no personal data is retained.
  • Admin session: Article 6(1)(f) - legitimate interest in securing private operator tools.

For visitors in California and other US states (CCPA / CPRA)

We process the limited information described above as necessary to provide the service you request (replying to your message) and to maintain site security and integrity. We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use it to profile you.

5. Your rights under GDPR (EU/EEA, UK, Switzerland)

If you are in the EU/EEA, UK, or Switzerland, you have the right to:

  • Request a copy of personal data we hold about you
  • Request correction of inaccurate data
  • Request deletion of your data ("right to be forgotten")
  • Object to processing or request restriction
  • Receive a portable copy of your data
  • Lodge a complaint with a data protection authority in your country

To exercise any of these rights, email us at contact@phalangix.com. We respond within 30 days.

6. Your rights under CCPA / CPRA (California residents)

If you are a California resident, you have the right to:

  • Right to know what categories of personal information we have collected about you, the sources, the purposes for collection, and the categories of third parties (if any) we share it with
  • Right to access the specific pieces of personal information we have collected
  • Right to delete personal information we collected from you, subject to limited exceptions
  • Right to correct inaccurate personal information
  • Right to opt out of the sale or sharing of your personal information. We do not sell or share personal information for cross-context behavioural advertising, so there is no sale to opt out of - but you are within your rights to confirm this with us
  • Right to limit the use of sensitive personal information. We do not collect sensitive personal information as defined by the CPRA
  • Right to non-discrimination. We will never charge you a different price, deny service, or provide a lower quality of service because you exercised any of these rights

To exercise any of these rights, email us at contact@phalangix.com. We respond within 45 days as required by California law. You may also authorise an agent to submit a request on your behalf.

7. Where data is stored and international transfers

The Phalangix website is hosted on shared infrastructure provided by Namecheap, Inc. in data centers located in the United States (primarily Phoenix, Arizona). When you submit data through the contact form or browse the site, that data is processed and stored on US-based servers.

If you are visiting from the European Union, the United Kingdom, Switzerland, or another jurisdiction with data transfer rules, this means your personal data is transferred to and stored in the United States. We rely on the following safeguards for that transfer:

  • The Standard Contractual Clauses (SCCs) included in our hosting provider's data processing terms (EU Commission Decision 2021/914)
  • Adequate technical measures: HTTPS encryption in transit, server-side access controls, password hashing, no third-party data sharing
  • The principle of data minimisation: we collect only what we need and retain it only for as long as necessary

If your jurisdiction's data protection law restricts cross-border transfers and you would prefer not to have your data processed in the United States, please do not submit it through the contact form. You can also email us at the address above to request alternative arrangements.

8. Security

The site is served exclusively over HTTPS. Admin access requires a hashed password and is rate-limited. Contact submissions are protected against automated abuse through honeypot fields, CSRF tokens, and per-IP rate limits.

9. Children

The site is not directed at children under 13 (or under 16 in jurisdictions where that is the relevant threshold under GDPR). We do not knowingly collect data from children. If you believe a child has submitted personal data through the contact form, email us and we will delete it. This also satisfies our obligations under the US Children's Online Privacy Protection Act (COPPA).

10. Changes to this policy

We may update this policy as the site evolves. Material changes will be reflected by a new "Last updated" date at the top. Continued use of the site after changes constitutes acceptance.

11. Contact

For any privacy question or request, write to contact@phalangix.com.