Privacy Policy

Last updated: 7 October 2026. Operator postal details and service-provider retention/transfer arrangements still need confirmation before public launch.

This policy explains how Indie Games Showcase handles personal information and uses cookies and similar browser storage. It covers this website and its contact form. It does not replace the policies of websites you visit through our links.

1. Who is responsible

Indie Games Showcase is operated by Ivan Katić in Croatia. For privacy enquiries or to exercise your rights, email info@indie-games.eu. The operator’s full postal contact details will be added before public launch.

2. Information we process

When you contact us, we receive your name, email address, message and any information you choose to include. When the contact form is enabled, it also records your agreement to the linked policies in the email. Please avoid sending sensitive personal information or information about other people that is unnecessary for your enquiry.

Hosting and security services may process technical information such as IP addresses, request times, browser details and requested pages to deliver and protect the website. Administrator access uses a password-protected account and a signed session cookie. Authorised editorial content and uploaded files are stored using the configured administrator identifier.

3. Purposes and legal bases

We use enquiry details to read, manage and respond to your message. Our legitimate interest is communicating with readers, developers and partners. Where an enquiry concerns a potential contract, processing may also be necessary to take steps at your request before entering that contract. Agreeing to the form’s policies is not consent to newsletters or advertising.

We rely on legitimate interests for proportionate website security and administration and, where applicable, legal obligations for records we must retain. Optional embedded media is enabled only after your consent. You may withdraw that consent without losing access to written coverage or ordinary external links.

4. Cookies and similar storage

Cookies are small files stored by websites in your browser. Local storage is a separate browser storage mechanism used for settings. The controls described here cover the optional media integrations added to this website; they do not control independent websites opened through links.

Use the Cookie settings button on any page to accept, reject or change optional media. Rejecting optional media is available alongside accepting it. Withdrawing permission unloads embedded frames and prevents them from loading again. It cannot remove cookies already stored by another domain; use your browser’s site-data controls to remove those. Clearing storage or switching browsers/devices means you may be asked again.

First-party analytics is optional and requires your permission. You can allow or reject it independently of external media in Cookie settings. No advertising trackers are used.

5. External media and images

YouTube videos use the youtube-nocookie.com embed domain, but this does not mean playback is free of all third-party data processing. YouTube and Steam frames stay blocked until you enable external media. Their providers may receive technical information and apply their own policies when you allow them.

Some thumbnails and game artwork load from external image hosts, including YouTube’s thumbnail servers and Steam’s image servers, even while interactive media is blocked. Those image requests expose technical information, including your IP address, to the image host. They are not controlled by the external-media switch. Files hosted directly by this website, including the media kit, do not require an interactive third-party embed.

6. Service providers and sharing

The independently hosted website uses Cloudflare for delivery, database storage and uploaded files. The prepared contact form uses Resend for delivery to info@indie-games.eu; it currently remains disabled until configured. The receiving mailbox’s provider processes delivered enquiries. We do not sell enquiry details or publish private messages merely because they were submitted.

Information may be disclosed where necessary to comply with a legal obligation, protect against abuse or establish, exercise or defend legal claims. External platforms act under their own privacy policies for their services.

7. International processing

Hosting, email and media providers may process information outside Croatia or the European Economic Area. Where transfers subject to the GDPR occur, the operator must confirm an applicable transfer mechanism, such as an adequacy decision or appropriate contractual safeguards. Provider-specific arrangements must be verified before public launch; this policy does not claim that all data stays in the EU.

8. Retention

Messages are kept only as long as needed to handle the enquiry and any related relationship, dispute or legal obligation. A fixed mailbox retention schedule has not yet been established and must be confirmed before public launch. Contact message text is not stored in this website’s database by the prepared form.

When sending is enabled, hashed network-address counters limit repeated submissions. They expire after ten minutes and are deleted on subsequent contact requests. Editor content and uploaded files remain until removed or the service is closed; provider backups and operational logs may follow their own schedules.

9. Your rights

Where applicable under data-protection law, you may request access to your personal information, correction, erasure, restriction, or portability, and object to processing based on legitimate interests. These rights depend on the circumstances and legal basis. You may withdraw consent at any time without affecting processing that was lawful before withdrawal.

Email info@indie-games.eu with your request. We may need proportionate information to confirm your identity. We normally respond within one month; where the law permits an extension, we will explain it. You may complain to the Croatian Personal Data Protection Agency (AZOP) or another competent supervisory authority.

10. Security and changes

We use access controls and transport security to help protect information. No online service can guarantee absolute security. This policy may change when website functions or providers change; the update date appears above. Material changes to optional processing may require a new consent choice.

Guest comments and administrator access

You can comment without a reader account. Your chosen name, message and posting date are displayed publicly immediately. Your email is stored privately in the website database and is visible only to the administrator for managing comments and responding to requests. It is not displayed publicly, and submitting it does not subscribe you to marketing or verify ownership of that address. Do not include private information in your message.

To reduce spam, we use a hidden form field, a short-lived submission token, duplicate checks and rate limits. Network addresses are processed into daily hashes for rate limiting rather than stored as raw addresses in comment tables. Email hashes also support rate limits. Counters expire after ten minutes and are removed on subsequent challenge requests; form tokens expire after one hour and are removed on subsequent requests or submission. These measures reduce abuse but cannot prevent every spam message.

Comments and private emails remain until deleted by an administrator or the service closes. Hidden and spam-marked comments remain private for moderation until deleted. Guests do not have account-based deletion controls; contact info@indie-games.eu to request correction or removal. Provider backups and operational logs may follow their own retention schedules. Discussion and abuse prevention are supported by our legitimate interests in operating and protecting the community.

Signed-in users and editorial roles

Administrator access uses a configured account identifier, email address and name. These are stored with the assigned role and last visit time to manage editorial access. The administrator password is stored only as a salted hash, with a signed, HttpOnly session cookie used for authentication. This independently hosted version does not offer public account registration. Guest comments and community ratings do not require an account. Contact info@indie-games.eu about access records or personal information.

Community review scores

Review pages accept guest scores instead of comments. Your display name, score and submission date are public. No email is collected by the rating form. A secure, HTTP-only browser cookie named showcase-voter lasts up to one year and identifies your browser for the rating service you request. A hash of its random identifier is stored with each rating so repeat submissions update your existing score for that game. You can remove the cookie in browser settings, but this also removes the browser’s association with your earlier scores. Guest ratings are not verified identities or purchases, and changing browsers or clearing cookies can bypass the one-browser limit.

Published scores contribute equally to the community average, separately from the editorial score. Spam protection uses submission tokens and temporary hashed network counters. Administrators may hide, mark as spam or delete ratings; excluded ratings do not contribute to the average. Ratings remain until removed or the service closes. Contact info@indie-games.eu for deletion assistance. This processing supports the rating service you request and our legitimate interests in maintaining a useful, abuse-resistant community.

Optional website analytics

With your permission, first-party analytics records page views, referring website domains, broad mobile/desktop classification, video play-button clicks, demo/store/YouTube link clicks, submitted searches and successful comment or score submissions. Video clicks are intentions to play, not verified watch time. It does not record comment bodies, rating names or private emails in analytics. Search phrases are stored up to 120 characters; obvious email addresses and long numeric sequences are suppressed, but please do not search for private information. Page query strings and arbitrary anchors are excluded.

Analytics stays off until you enable it in Cookie settings. Existing external-media consent does not automatically enable analytics. A random identifier in local browser storage (showcase-analytics-visitor) expires after 90 days and is removed when you reject analytics. The server stores a different hash each UTC day, so visitor counts are daily browser estimates, not identifiable people or deduplicated unique visitors across a whole date range. Referrers may be absent or obscured by browsers.

Analytics is stored in the website’s Cloudflare database, visible only to administrators and retained for approximately 90 days, with older records removed when new events arrive. Raw network addresses are not stored in event records; daily hashes are used in ten-minute anti-abuse counters, removed on later events. Hosting logs and backups may have separate provider retention. Your consent is the basis for this optional measurement. You can withdraw it in Cookie settings at any time, which stops new collection; contact info@indie-games.eu about previously collected information. Administrator visits and obvious automated agents are excluded. Blocking, rejection and incomplete consent mean this dashboard will not represent all traffic.

Administrator Google Search Console connection

If the administrator chooses to connect Google, this website requests read-only Search Console permission to retrieve accessible properties, search performance and recorded URL inspection results. The server stores the Google refresh token encrypted in its Cloudflare database; OAuth state expires after ten minutes. Google reports are shown only to the administrator and are not used to identify individual website visitors. This connection does not sign visitors in to Google or add Google Analytics tracking. Disconnecting revokes the Google token and removes the stored connection. Google processes authorisation and API requests under its own privacy policy; provider logs and website backups may retain records separately.

Questions? info@indie-games.eu