Privacy Policy
MindLounge.gg ("MindLounge", "we", "us") is a small, independently run website: a quiet place to read, think and play. It is run by a private individual, not a company. This page explains, in plain language, what data the site collects, why, how long it is kept, and what rights you have.
Who is responsible for your data
The controller of your personal data is Oleksandr Antoshchuk, a private individual based in Poland. You can reach us through the contact form. We usually reply within 72 hours, and in any case within one month, as the GDPR requires.
The short version
- You can read, solve puzzles and play against bots without an account.
- We collect only what the site needs to work. We do not sell personal data and do not build advertising profiles.
- The site currently shows no ads. A Google AdSense script is loaded for the site review (see "Google AdSense" below).
- Visit statistics come from Cloudflare Web Analytics, which does not use cookies.
- You can delete your account at any time from your settings.
What we collect, why, and on what legal basis
Account. Email address, a securely hashed password (never the password itself), the display name you choose, and the date you joined. Used to create and secure your account and let you log in. We use your email address only to manage your account and send service messages about it (for example, confirming your address); we do not send newsletters or marketing. Basis: performance of our agreement with you (Art. 6(1)(b) GDPR).
Cookies. Only cookies the site needs to work: a session cookie (keeps you logged in, protects forms against cross-site request forgery, remembers your language and guest progress; it lasts up to 7 days) and, if you tick "Remember me" when logging in, a login cookie that keeps you signed in for up to 30 days. No advertising or cross-site tracking cookies are set by MindLounge itself. Basis: strictly necessary (Art. 5(3) ePrivacy Directive); legitimate interest in a working, secure site (Art. 6(1)(f)).
Games. Chess and checkers games against bots or other people: moves, results and your rating. During games with other people you can send a short set of predefined polite phrases; these are stored with the game. Go games are bot-only and are not saved to your history or rating. Basis: agreement (Art. 6(1)(b)).
Following, posts and messages. If you follow other players, we store who follows whom. Short posts you write and events such as "won a game" are shown to people who follow you. Private messages are possible only between people who follow each other, and are visible only to the two of you. Basis: agreement (Art. 6(1)(b)).
Forum. Topics, comments and votes you post are public and shown with your display name. Votes add up to a karma score that unlocks posting privileges. Basis: agreement (Art. 6(1)(b)).
Journal. When you react to an article or read it to the end, we record this to suggest what to read next. Reactions are never shown to others as counts. Comments under articles are public and shown with your display name. Before a comment appears, its text and the article title are sent to Anthropic, which provides the automated check for rudeness and spam; some comments are also reviewed by the site owner. Basis: agreement (Art. 6(1)(b)) for comments; legitimate interest in recommendations and in keeping discussions civil (Art. 6(1)(f)).
Shelf, puzzle rating and learning paths. Saved articles, your private notes, puzzle attempts and rating, and your progress in learning paths. Visible only to you; not shown on your public profile. Basis: agreement (Art. 6(1)(b)).
Without an account. If you use the site without an account, your reading records, puzzle attempts, path progress, guest games and daily progress are tied only to a random identifier in your session cookie. If you register or log in in the same browser, they move into your account. Otherwise they are deleted automatically (see "How long we keep data"). Basis: legitimate interest in letting you use the site without an account (Art. 6(1)(f)).
Contact form. Your name, email address and message are sent to the site owner by email (through Amazon SES) so we can answer you. They are not stored in the site's database, and the email is deleted 30 days after the matter is settled. Basis: legitimate interest in answering you (Art. 6(1)(f)).
Visit statistics. We use Cloudflare Web Analytics to see which pages are read and where visitors come from. It does not use cookies, does not follow you across sites and reports only aggregated numbers. Separately, when a link to the site carries campaign tags (such as utm_source), we add the visit to a daily total for that tag; we do not store your IP address, an identifier or browser details with these totals, and the totals are kept for up to 400 days. Automated visitors (bots, link previews) are counted separately. Basis: legitimate interest in understanding which content is useful (Art. 6(1)(f)).
Security and logs. Our servers log technical information for reliability: request paths, response codes and times. IP addresses are not written to these logs. To protect against abuse (for example, repeated failed logins or mass sign-ups), your IP address is used in short-lived counters that expire automatically within 24 hours. Basis: legitimate interest in a secure service (Art. 6(1)(f)).
Google AdSense
The site currently shows no advertising. A Google AdSense script is loaded on our pages because Google requires it to review the site for a future advertising account. Google may use cookies or similar technologies when this script loads; see Google's own privacy policy and ad settings. If we start showing ads, we will update this page first and, where the law requires it (for example in the EEA, the UK and Switzerland), ask for your consent through a consent tool before any personalised ads are shown.
Our posts on social networks
We publish the daily puzzle and new Journal articles on MindLounge's own accounts on Bluesky, Mastodon and X. These posts contain no data about our users. If you interact with them, that happens under those networks' own privacy rules.
Who processes data for us
We do not sell personal data. These providers process data on our behalf, under their own terms and data-protection agreements:
- Amazon Web Services — hosting, database and email delivery (region: United States, us-east-1).
- Cloudflare — visit statistics only (Cloudflare Web Analytics).
- Anthropic — automated check of Journal comments.
- Google — the AdSense script described above.
Transfers outside the EU
Some of these providers (Amazon Web Services, Cloudflare, Anthropic, Google) process data in the United States. These transfers are made under the providers' data-processing terms, which rely on the EU–US Data Privacy Framework and/or the European Commission's standard contractual clauses. You can ask us for more information through the contact form.
How long we keep data
| Data | How long |
|---|---|
| Account, games, rating, shelf, notes, puzzle attempts, path progress | while your account exists |
| Guest data (reading records, puzzle attempts, path and daily progress) | 30 days; Journal reading records without an account — 90 days |
| Session cookie | up to 7 days |
| Server logs (no IP addresses) | 7 days |
| IP addresses in abuse-protection counters | up to 24 hours |
| Campaign totals (no personal data) | up to 400 days |
| Contact form emails | 30 days after the matter is settled |
| Encrypted database backups | up to 7 days |
Deleting your account (right to be forgotten)
You can delete your personal data at any time.
- Yourself, straight away: use "Delete account" in your account settings. Your account is deleted immediately.
- On request: if you cannot log in, send a request through the contact form, using the email address of your account. We will confirm the request by writing to that address and complete it within 30 days.
What is deleted: your account and email address, games history and rating, shelf and notes, puzzle attempts, path progress, reactions, reading records, follows, posts and private messages. Your Journal comments and forum posts stay, because other people's replies depend on them, but are shown as "[deleted]" without your name.
Backups: residual copies may remain in our encrypted database backups for up to 7 days, until they are overwritten. They are used only to restore the site after a failure and are protected against unauthorised access.
Your rights
Under the GDPR you have the right to:
- access the data we hold about you and get a copy;
- have inaccurate data corrected;
- have your data deleted;
- restrict how we use your data;
- receive your data in a portable format;
- object to processing based on our legitimate interests;
- withdraw consent at any time, where processing is based on consent.
Most of this you can do yourself in your account settings (display name, password, deleting the account). For anything else, use the contact form.
You also have the right to lodge a complaint with a data-protection supervisory authority — in Poland, the President of the Personal Data Protection Office (UODO), or the authority in the EU country where you live or work.
If you live in Switzerland (which is not in the EU), the Swiss Federal Act on Data Protection (FADP) also applies, and you can contact the Federal Data Protection and Information Commissioner (FDPIC).
Age
MindLounge is not intended for children under 16. Do not create an account if you are under 16.
Changes to this policy
When this policy changes, we update the date at the top. For important changes, we will also show a notice on the site.