Privacy policy

Ludixa is a video game news site, free to read and funded by advertising. This page explains what is processed, why, on what legal basis and who receives it. It is written to be read, not to be survived.

Who is responsible

The data controller is Manuel Rizzo, via Padre Luigi Tezza 18, 31015 Conegliano (TV), Italy. For anything concerning personal data, write to [email protected].

What is processed, and on what basis

Reading the site — no consent needed, no account needed

• Server logs. The hosting layer keeps short-lived technical logs (request, time, IP, user agent) needed to serve pages and block abuse. Legal basis: legitimate interest in operating and securing the service (art. 6(1)(f)).
• Aggregate page counts. A per-day counter of how many times a page was viewed. No IP, no cookie, no identifier — it cannot be traced to a person, so it is not personal data.
• Language preference. A cookie remembering which language version you are reading. Strictly necessary for a function you requested.

Reading statistics — only with your consent

One switch, two recipients. Both record the same things: page visited, time on page, scroll depth, clicks on links and buttons, downloads, the domain that referred you (domain only, never the full URL), and device/browser/OS derived from the user agent. What differs is where the data goes, so they are described separately.

Our own counter is self-hosted on our own infrastructure. No data broker, and the data does not leave our server.

What it deliberately does not do:

• Your IP address is never stored. It is used once, in memory, to derive a one-way hash that also mixes in the date and the site name. The hash changes every day and differs per site, so the same reader cannot be followed across days or correlated with any other site.
• Search terms are not recorded. The statistics register that a search happened, not what you typed. Free text is the most likely place for personal data to end up, so it is excluded at the source.
• No cookie. One entry in session storage, gone after 30 minutes.

Google Analytics 4, since 24 August 2026, is the second recipient, and it is a third party: Google Ireland Limited, acting as an independent controller for what it collects. It receives the page address, the referrer, your IP address (from which it derives an approximate location), and your device and browser. It sets two cookies, _ga and _ga_9XXCTLM5VQ, each lasting two years.

We have switched off advertising signals, ad personalisation and Google Signals, so this data is not used to build an advertising profile of you and is not joined to Google’s advertising identifiers.

Transfers outside the EEA. Google is a US company and data may be processed outside the European Economic Area, under the EU–US Data Privacy Framework and Google’s standard contractual clauses: policies.google.com/privacy. Our own counter transfers nothing: it stays on our server.

Legal basis: your consent (art. 6(1)(a) and art. 5(3) ePrivacy). Retention: 400 days on our server, then automatic deletion; 14 months at Google. Refuse the category and neither one starts — no Google script is inserted into the page at all.

If you allowed statistics before 24 August 2026, we are asking you again. That permission covered a counter that never left our server. Adding a third party who receives your IP address and sets two-year cookies is a different question, so it is being asked as one rather than treated as already answered.

Advertising — only with your consent

Ads are served by Adsterra (AdsPro Ltd), which acts as an independent controller for what it collects. When you allow this category, Adsterra receives your IP address, user agent, the page you are on and the referring page, and it can set its own identifiers to build an advertising profile, cap ad frequency and measure clicks.

Transfers outside the EEA. Adsterra and the advertisers buying through it operate globally, so data may be processed in countries without an EU adequacy decision. Their policy governs those transfers: adsterra.com/privacy-policy.

Legal basis: your consent. Refuse it and no Adsterra script is inserted into the page — not blocked after loading, never loaded. The ads simply do not exist for you, and the site works the same.

Your choice, and how to change it

The banner offers Accept and Reject with the same weight and the same number of clicks. Withdrawing is as easy as giving:

Ad and cookie settings

The exact list of what gets stored is in the cookie policy.

Your rights

Under the GDPR you can ask for access, correction, deletion, restriction and portability of your data, object to processing based on legitimate interest, and withdraw consent at any time without giving a reason. Write to [email protected] and you will get an answer. You can also complain to your national data protection authority — in Italy, the Garante per la protezione dei dati personali.

One honest limit: because the statistics keep no stable identifier for you, we have no way to find “your” rows in them. That is a consequence of collecting less, not a refusal — and it is why there is nothing there to export or erase.

Third parties

• Adsterra — advertising, only with consent. See above.
• Google (Google Ireland Limited) — Google Analytics 4, reading statistics, only with consent. See above.
• Storefront CDNs (Steam, Nintendo, Xbox, Apple) — cover art and screenshots. These requests are proxied through our own server, so your browser never contacts them directly and they never see your IP address.
• Trailers — the one exception to the line above, and only after you press play. A game trailer is tens of megabytes of video: proxying it would mean routing that through our server for every viewer, so the file is streamed straight from Valve’s CDN. That means Valve sees your IP address for as long as the trailer plays. Nothing loads before the press: what you see until then is the still frame, proxied like every other image.
• Google Fonts — typefaces are served from our own domain at build time, not fetched from Google at page load. No request reaches Google.
• Hosting — the site and its database run on a single European server under our control.

Article content is produced through an editorial pipeline that uses AI assistance; source outlets are credited on each story.

If you create an account — only if you choose to

Reading Ludixa never requires an account. If you make one, it exists to save stories, follow games and keep a library of what you own, play and finish.

There is no password. You sign in with Discord or Google, so we never see, store or lose one. From the provider we receive only your name, email address and avatar — the basic profile they share for sign-in, and nothing about your Discord servers, your contacts or your activity elsewhere.

What is stored, and only this:

• Name, email address and avatar URL from the provider.
• A session, so you stay signed in for 30 days. It is a first-party cookie, not shared with anyone.
• What you put there yourself: saved stories, followed games, and library entries with their status, your rating and your notes. None of it is public and none of it is used for advertising.
• Your reading history, so the home page can offer to pick up where you left off: which stories you opened, when, and how far down you scrolled — one row per story, updated rather than appended. It exists only for signed-in accounts, it is never public, it is never used for advertising, and you can empty it in one click from the reading history page without deleting your account.

Push notifications, if you turn them on. They work without an account: what is stored is the address your browser's own push service issues for that one installation, plus the keys needed to encrypt the message, and it identifies a browser rather than a person. If you are signed in when you turn them on, or if you choose to be notified only about the games you follow, that subscription is linked to your account — because without knowing whose list it is, that choice cannot be applied. Deleting your account unlinks it; the notifications themselves stop from the same button that started them.

Legal basis: performance of the service you asked for (art. 6(1)(b)). Retention: until you delete the account.

Deleting it takes one click, from your account page — not an email to us. Account, library, saved stories, followed games and reading history go with it, immediately and for good.

If you sign in once with Discord and once with Google using the same email address, you land on the same account rather than two. That is only safe because both providers verify the address before telling us, and it is limited to those two.