Privacy Policy

What we collect

GameDropDaily serves static game pages with optional notifications and a contact form. No accounts, no logins, no cookies, no third-party analytics. Paid game recommendations are labelled Sponsored. We never sell your data. Optional notification delivery uses your browser's push provider, as described below.

Page-view measurement

Updated 2026-09-24: this section replaces an older note that said we had no analytics. Our own cookie-less page-view count has run since May 2026 and was extended on this date.

We run our own cookie-less measurement. When you open a page, your browser sends our server: the page path; the site you came from (the domain only, or the previous page if it was one of ours); your screen class (phone, tablet or desktop), pixel-density class, colour-scheme setting and pointer type; your language (the two- or three-letter code only) and time zone (to the hour); whether the window is consistent with the screen and has normal browser chrome; whether the page opened in the foreground, was restored from the back-forward cache, reloaded, or reached by the back button. When you leave, it sends how long the page was in the foreground, how far you scrolled, how long the page is, when and by what kind of input (mouse, touch, keyboard, wheel or scroll) you first interacted, how many times the pointer moved or the screen was touched (counts only), which kinds of links you clicked (for example "Steam store" or "related game"), and a count of script errors. It also sends whether the browser reports being automated, how many languages are configured (0, 1 or 2+), whether its local storage could be written, whether the page was a 404, whether it was prerendered, whether a frame was painted, whether the window was resized, the number of inputs and the total time the page was open; the leaving record can be sent more than once while the page stays open, with a sequence number so that we keep only the latest. Apart from the timings (whole seconds, and the delay before your first input in milliseconds), only coarse classes and counts are sent, never exact values such as your screen size. We use this to see which pages work and to filter out bots, which is our legitimate interest in running the site.

How we tell visitors apart

For recommendations labelled Sponsored, we also count a card impression when at least a quarter of the card enters the visible page, a click to the game introduction, a click to Google Play, and a view of the introduction. These events carry only a fixed action category, placement (home, weekly selection, directory or introduction), the page path and the same page and tab numbers described below. Each action is counted once per page view. A click also counts as an impression if it arrives before the visibility check. Google Play links carry a fixed campaign name and placement code; they contain no visitor identifier. Google receives your request when you follow a store link, under its own privacy policy. Our site cannot observe an installation.

Our server counts visitors with a token made from your IP address and browser string plus a random value that changes every day and is discarded afterwards. Your IP address is not stored with page views, and the token cannot be recomputed once the day is over. A second token, made the same way from the network part of your IP address only (the first two of four blocks for IPv4, the first two of eight for IPv6), lets us spot automated fleets that spread one browser over many addresses. We also store a yes/no flag for whether the address belongs to a known cloud-hosting range, your browser family and operating system (for example "Edge on Windows"), and whether the browser's client-hint headers agree with its user-agent string. Cloudflare, our CDN, tells us the country of each request; we keep the two-letter code only. Each browser tab also carries a random session number that lives only in that tab, so we can count pages per visit. Each page view also carries a random number, kept only in memory for that page, that links its opening and leaving records.

Returning visitors

To count how many readers come back, your browser keeps a small record in localStorage (gdd:fs:v1): the date of your first visit, the date of your last visit and a visit counter capped at 21. Only coarse ranges are sent, such as "first visit 2-6 days ago", never a code that identifies you. It is replaced with a fresh one on your first visit after 180 days, and clearing site data removes it at any time.

Opting out

If your browser sends the Global Privacy Control or Do Not Track signal, we store nothing about the page view and write no automatic measurement or recently-viewed record to your browser. Explicitly chosen Follow and notification preferences still work. (If an extension sends only the header without the matching browser setting, the returning-visitor record above may still be written in your browser, but nothing is stored on our side.) We only add one to a counter of opted-out requests, by browser family, so we know how much our numbers undercount.

Your games on this device

Following a game saves its name, game slug and local image address in gdd:follow:v1 in your browser's localStorage (up to 40 games). We also keep up to 12 recently viewed games in gdd:viewed:v1. These lists stay on this device and are not sent to our server. Unfollow a game to remove it from your followed list, or clear this site's browser data to remove both lists. Older recent entries are replaced as you visit more games.

The Your games row compares the latest public patch date with the existing gdd:fs:v1 last-visit date. A temporary last-visit snapshot, gdd:visit-day:v1, stays in sessionStorage in the current tab and expires after 30 minutes of inactivity. Because the last-visit record has day-level precision, updates on the same UTC day are not marked new. With Global Privacy Control or Do Not Track enabled, we do not automatically record recently viewed games; you can still explicitly choose Follow to save your own preferences.

Optional game patch notifications

We ask for notification permission only after you choose Notify me. If you enable notifications, we store your browser's push subscription endpoint, its encryption keys (p256dh and auth), and the game slugs you choose (up to 20). We use these solely to deliver official Patch or Release notifications. Your browser's push provider (Apple, Google, Mozilla or Microsoft) delivers encrypted notifications; it is not an analytics service. No account, email address or cookie is needed.

We retain the subscription until you unsubscribe or the push service reports that it has expired or is no longer valid. We keep subscription and game-preference timestamps, delivery timestamps and daily counters to limit alerts to one per game in 12 hours and three per subscription each UTC day. Notification-enabled game slugs are also stored on this device in gdd:push-games:v1; the browser manages the push subscription itself. For abuse prevention, the notification API uses five-minute request-count windows by IP address in memory; expired entries are cleared on the next request or process restart, and are not written to disk.

Use Turn off notifications on the game's update page to stop alerts for that game. Removing the last game deletes the server subscription and unsubscribes the browser. If this browser still has a subscription but its local game settings have been lost, use Turn off all notifications to remove it. A notification already queued may still arrive. Following and notifications are separate controls: Unfollow alone does not stop notifications. You can also revoke notification permission in your browser settings; the server deletes the subscription when the push provider rejects a later delivery. Clearing browser data alone may prevent immediate server removal, so use Turn off notifications first.

Opening a notification sends the fixed arrival category push to our first-party measurement, subject to the same opt-out controls. Click counts distinguish the nearby patched-games strip, Follow, notification controls, RSS and Your games. No followed-game list, push endpoint, encryption key, search text, URL query or fragment is sent to analytics. The notification marker is removed from the page address.

Game search

Search on the page-not-found screen runs against a public game list downloaded to your browser. Search text is not sent to us and is not stored.

Server logs and abuse prevention

Like every web server, ours writes standard access logs (IP address, browser string, URL, time), including the measurement requests above. Pages also send a second, content-free request (/api/track/view) that appears only in those logs; it helps us tell scrapers from readers. Logs are kept for 14 days. IP addresses that trigger our abuse rules are blocked for up to 30 days.

How long we keep it

Raw measurement records are kept for up to 13 months. Daily totals (visitors, pages, countries and the like), which contain nothing about any individual, are kept indefinitely.

Contact form

If you use our contact form, we store what you typed: the message, the optional email address and the optional game or page field, together with the type of request you chose, the address of the page you sent it from, your IP address and your browser string (to reproduce bug reports and to stop spam). Messages are read only by the site maintainer, are kept until the request is handled and are never shared. Ask us at any time and we delete yours.

Contact

Questions or requests about your data: our feedback form. We reply within seven business days.