Privacy Policy

Vestradiy ("we", "us") runs vestradiy.com. This page says exactly what happens to your data when you visit, play, or subscribe. The short version: you can play most of the site without giving us anything at all, we run no analytics and no advertising, and the only personal data we hold is the email address attached to a membership.

What we do not collect

• No user accounts, no passwords, no profiles.
• No analytics, heatmaps, tracking pixels, advertising or social plug-ins.
• No marketing cookies, and nothing shared with ad networks or data brokers.
• No newsletter. We only email you about the subscription you paid for.

What we do collect, and when

Playing the free games. Nothing leaves your browser. Scores, streaks and honour badges are kept in your own browser's localStorage so the game remembers them next time. We never receive them. Clearing site data deletes them permanently.

Subscribing. Checkout is handled by Creem, who act as merchant of record. Creem collects your email address and payment details; we never see or store card numbers. What we receive back is your email address, the plan, the subscription status and the renewal date. We store those, together with the licence key we issue, in Cloudflare KV.

Signing in. One cookie, vd_s: httpOnly, SameSite=Lax, valid for 90 days. It holds your licence key and a signature so we can tell it apart from a forged one. It is only set when you redeem a key, and deleting it signs you out. There are no other cookies.

Server logs. Our host, Cloudflare, keeps standard request logs — IP address, user agent, requested URL, timestamp, response code — for security and abuse prevention. We do not build profiles from them and do not combine them with anything else.

Why we are allowed to hold it

• To perform the contract — the email and licence record exist so you can get in and so renewals, cancellations and refunds land on the right subscription.
• Legitimate interest — security logs, rate limiting, and keeping a paywall from being trivially bypassed.
• Legal obligation — invoices, sales tax and accounting records are held by Creem as merchant of record, not by us.

How long we keep it

• Licence record (email, plan, status, date): while the membership is active, and for 12 months after it ends, so a returning customer is recognised and so refunds or chargebacks can still be handled.
• Webhook deduplication keys: 7 days, then deleted automatically.
• The vd_s cookie: 90 days, or until you sign out or clear cookies.
• Progress saved in your browser: until you clear it. It is not backed up anywhere.

Who sees it

• Cloudflare — hosting, functions and key-value storage. Requests are served from their edge network.
• Creem — payments, invoices, sales tax, refunds and chargeback handling, as merchant of record.

That is the whole list. We do not sell data, and we do not pass it to advertisers. We would only disclose something else if a valid legal order required it, and we would tell you unless we were barred from doing so.

Your rights

Write to [email protected] and ask. You can have a copy of what we hold, have it corrected, or have it deleted — we answer within 30 days and we do not ask why. Deleting the licence record ends access to the members' games; if you also want a refund, say so in the same email and see the Refund Policy. If you are in the EEA or the UK you also have the right to complain to your national data protection authority. If you are in California, we do not sell or share personal information as those terms are defined by the CCPA.

Children

The site is not directed at children under 13 and we do not knowingly collect their data. If you believe a child has subscribed, write to us: we will cancel, refund and delete the record.

Changes

If this policy changes we update this page and the date at the top. If the change is material — a new category of data, or a new recipient — we will also say so on the home page for 14 days before it takes effect.

Contact

[email protected] — the same address shown on the site and registered as the support contact in our payment provider's business details.