Privacy & cookies
Optional analytics is off until you accept it. Sign-in and giveaways work either way.
Basic visit statistics
The public counter estimates unique visits over the last 24 hours without using cookies or browser storage. The server temporarily processes the network address already needed to deliver the site and converts it into a keyed, site-specific hash. Only the hash and its latest visit time are saved. Repeat visits from that network count once; shared networks can combine different people, and changing networks can count someone again. It is an estimate of networks, not a count of identifiable people.
These short-lived records are pseudonymous, not fully anonymous. They expire from the active count after 24 hours without a visit; expired records are removed when the counter is next accessed. Random hashing keys change daily; only the current and previous day’s keys are kept when the counter is accessed, so midnight does not count a returning network twice. This counter saves no raw IP addresses, user-agent strings, page URLs, referrers, account references or browsing history, and is never linked to detailed analytics or giveaways. It works independently of the optional analytics choice and honours your browser’s Do Not Track and Global Privacy Control signals. Protected routine backups may contain earlier records until those backups expire.
We count page loads for all visitors, including when optional analytics is off or rejected. This counter stores daily page totals for 90 days and minute totals for up to 25 hours for aggregate reports. The separate page-total records contain no visitor identifier, IP address or fingerprint. Counts are not linked to detailed analytics, accounts or giveaways. Refreshes and repeat visits count again; these totals do not identify unique people. JavaScript must be enabled, and browsers or blockers can prevent counting.
First-party site analytics
If you accept analytics, the site assigns a random, HTTP-only visitor identifier to measure sessions and unique browsers in the admin analytics. The identifier is hashed before it is stored. These records are pseudonymous, not linked to your account. These detailed reports reflect browsers that consent to analytics, not every visitor.Zero Percent Games does not load Google Analytics or another third-party analytics tag.
What is measured
With your consent, the site records pseudonymous sessions and page paths, including the first page in each session, coarse device and browser categories, referral hostnames, standard UTM source, medium, campaign, term, and content labels, scroll depth, engaged time, and clicks to Steam, demos, Discord, and creator links. Outbound clicks retain their destination hostname and UTM labels. It does not store raw IP addresses, full user-agent strings, precise locations, arbitrary query strings, or the path and query from an external referring page.
If an advertising link arrives without UTMs, the site can recognize the presence of a Google, Meta, Microsoft, TikTok, X, or LinkedIn click parameter to classify its source. The advertising click identifier itself is discarded and never stored.
Detailed analytics sessions and events are retained for up to 90 days. The lightweight unique-browser count retains its hashed last-seen record for up to 31 days. Evidence of analytics consent (hashed visitor identifier, notice version and choice time) is kept for up to 90 days after the last analytics activity.
Your control
Open “Cookie settings” at the bottom of any page and choose “Reject optional” to stop optional collection. The anonymous daily page total continues. Rejecting deletes analytics history and consent evidence associated with the current browser from the active database and expires its visitor cookie. Choices last 180 days. Browser Do Not Track and Global Privacy Control signals never automatically enable analytics; collection starts only after your choice. An earlier opt-out-only setting is not treated as consent.
Accounts and external services
Signing in uses the provider you select. Game metadata and images come from Steam, and outbound creator links open the destination selected by that creator. Those services apply their own privacy terms when you use them.
Reddit sign-in requests only your account identity: your Reddit account ID, username and avatar. It does not request posts, comments, messages or subreddit subscriptions. Reddit does not provide your email address through this connection. The account ID identifies your sign-in method, and its access token is encrypted at rest. Connecting Reddit to an existing account requires signing in to that account first.
If you connect itch.io for creator verification, the site requests only your public itch.io profile and the list of games you develop. The access token is encrypted at rest and is used only to verify and refresh those games. Draft and unpublished games are never shown publicly. Disconnecting itch.io deletes the token and its ownership records from Zero Percent Games.
Connecting Patreon for membership giveaways requests your public account identity and creator pages, including published creator names, images, URLs and eligible tiers. It does not request member lists, membership history or email access. Access and refresh tokens are encrypted and used to verify and refresh creator information. Disconnecting removes those tokens and imported profiles from the active database. Previously donated prizes, their creator details and review records remain available for giveaway delivery; earlier connection data may remain in protected backups until those backups expire. Patreon applies its own privacy terms when you authorize a connection or redeem a gift.
Creator email campaigns and Gmail
Connecting Gmail is optional and separate from Google sign-in. We request your Google account identity, verified email address and permission to send emails you approve. We do not request permission to read your inbox. Google access and refresh tokens are encrypted at rest and used to send your tests, approved campaigns and scheduled messages while you are away.
Templates, message content, recipient snapshots, schedules, delivery receipts and errors are private to the sending account. Sharing a creator list does not share your mailbox or campaigns. List owners and editors can send from their own Gmail account; viewers cannot start a campaign. Tests go to the connected Gmail address. An explicit confirmation starts list sending, and pending emails can be paused or cancelled.
Campaign emails contain a sender-specific unsubscribe link. We retain suppression records to honour that choice. Shared or imported email verification confirms a contact source; it does not establish permission to receive marketing. Campaign records and templates remain while needed for your account; deleting your account removes these records from the active database. Disconnecting Gmail deletes its stored tokens and pauses pending sends. You may also revoke access through your Google account. Protected backups may retain earlier records until replaced.
Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Gmail data is used only to provide the requested email features, and is not used for advertising or to train general-purpose AI models.
Community chat
Anyone can read this site’s community chat, including visitors without an account. Only signed-in members can post. Your chosen nickname, messages, posting times and online status are publicly visible. Until you choose a nickname, the online list uses a generated Player name, not your login name or email. Developer verification is not required. Each site has its own separate chat.
The live conversation keeps only the latest 100 messages. You can delete your own messages; administrators can remove messages and suspend abusive accounts. Earlier or deleted messages may remain in routine rolling database backups until those backups expire. Online status is based on an active, visible site tab and expires within approximately 90 seconds of losing contact. A first-party, HTTP-only session cookie deduplicates guest browsers across tabs; only a site-specific hash and recent activity are stored for this count, not raw IP addresses. Guests join the presence count only when they open chat. Guest presence expires after approximately 90 seconds and stale records are cleaned as visitors check in. Guests are shown only as a count, never as individual profiles. The unread-message badge keeps a last-read message number in your tab’s session storage, so it survives navigation without saving chat text or creating an account. Chat works independently of optional analytics.
Links to public pages on this site can show a preview using our existing catalogue data. Chat does not fetch external links or run embedded HTML. Preview artwork may load from Steam or itch.io image servers without sending the chat page as a referrer.
Why we use this data
Accounts, favourites, creator connections and prize delivery process the data needed to provide the features you request. Optional detailed analytics relies on your consent. Basic traffic measurement, security, abuse prevention, moderation and giveaway fairness rely on our legitimate interests in understanding overall traffic and operating a safe service. You can object to this processing using the contact below; browser privacy signals also disable the unique-visit estimate. We use legal obligations where a valid legal requirement applies. We do not sell your personal data or use your activity to build advertising profiles.
Shared IP addresses or devices may cause giveaway entries to share one draw chance. This is automated anti-abuse processing, not a determination of someone’s identity. Contact us if you believe it has treated you unfairly.
Services and retention
Developers with tool access can use YouTube creator discovery. Keyword searches send game titles and search options from our server to Google's YouTube Data API using the site's shared API key. Game category discovery reads the selected game's public YouTube video lists from our server without opening individual videos or using your Google login. Results are marked as coming from the game page; individual video game labels are not checked. Previously saved exact-label searches keep their original game-card evidence. Typing a game name reads public structured game cards on our server and suggests matching YouTube games without opening local tabs. Our server obtains public names, thumbnails, views and audio-language metadata from the API. Your site account identifier, Google cookies, saved business emails, contact sources, and private notes are not sent to YouTube by this feature.
Public video and channel results may be reused through a 24-hour cache. Published business emails confirmed from channel descriptions or captured through the collector, source URLs, verification dates, game/search provenance, and audio-language tags form a shared creator directory visible to signed-in accounts with developer-tool access. Verification timestamps are recorded by our server. Emails are not automatically checked again; a developer can explicitly request a fresh verification. Tags use reported audio-track language for matching videos, and missing metadata is shown as unknown. These creator fields cannot be edited through the ordinary forms.
You create a named list before searching. Lists contain only creators with a currently verified email and are visible to their owner and invited members. A list owner can create a seven-day invitation link, revoke links, or remove a member; joining grants permission to add or remove verified creators. Developer comments on a creator are shared across the hub with the author's display name and posting time. Authors can edit or remove their own comments; admins can moderate them. Previous private campaign notes are not published as comments. Existing saved confirmations may be imported with their original saved timestamps and an imported label.
YouTube's API does not provide the dedicated business-email reveal field, but public channel descriptions may contain a contact address. The local Chrome / Edge collector is required to open this tool. Selecting a creator previews their matching videos; email collection starts only when you click Verify or Verify again. The server first checks the channel description for a clear published contact email, converts obfuscated separators such as [at] and [dot] into a usable address, and records description provenance and its own confirmation time. If no clear address is found, the collector checks the email field. A previously confirmed email field is checked through the collector first on Verify again, with the description as a fallback. The collector opens the creator's YouTube About dialog in a small popup and clicks Google's initial verification checkbox once. Any image challenge is left for you to complete. After verification, the visible business email and canonical source URL are returned for automatic saving to the shared directory and your selected list. The popup closes after the site confirms saving. Your Google login remains in your browser. The helper keeps temporary job identifiers in browser session storage and does not store emails, passwords, cookies, API keys, or CAPTCHA answers.
The collector temporarily processes your site account and selected creator/job identifiers, the selected channel name and URL, verification state, candidate video identifiers, observed game-card identifiers, and its own tab identifiers to return the result to the requesting account and list. Game-label jobs are limited to 50 or 100 candidates, are cancellable, and remove their temporary browser-session state on completion or cancellation. It does not read your browser history or account-switching menus, and has no separate analytics, advertising, or remotely downloaded executable code. Removing the extension stops local collection. Deleting an account removes its owned lists and memberships and removes author attribution from retained shared comments and verification history. Shared creator emails and search provenance remain available to other developers until a fresh check removes the email or a deletion request is handled. Contact us to request removal of a creator's contact or shared comment.
YouTube metadata is hidden and cleared when it reaches 29 days; routine server cleanup removes expired snapshots. Shared business contacts, confirmation history, search provenance, and comments remain while needed to provide the directory. Legacy private campaign records remain scoped to their account until their campaign or account is deleted. Removed comments retain a restricted moderation record. Protected rolling backups can retain earlier records until they expire.
Information handled by the Creator Collector is used for the developer contact directory, comments and list collaboration described here, with processing by our hosting provider as necessary to operate and secure them. We do not sell it, use it for personalized advertising, or transfer it for credit or lending decisions. The Chrome Web Store User Data Policy, including its Limited Use requirements, applies to this extension.
Opening YouTube pages or loading its thumbnails lets Google receive technical request information, including your network address, under Google's privacy policy. YouTube's terms of service and API developer policies apply when you use YouTube. Those developer policies restrict automated page extraction even when a human completes the CAPTCHA.
Hosting providers process technical data needed to deliver and secure the site. Signing in or connecting a creator service shares the data needed with the provider you select. Images and media can load from Steam, itch.io or their delivery networks, which receive your network address. Playable third-party games load only when you press play. External websites have their own privacy and cookie policies.
We retain account, favourite, creator ownership and inventory records while needed to operate your account and deliver prizes. Contact us to request deletion. Security and moderation records may be retained where needed for abuse prevention or legal obligations. Deleted records can remain in protected rotating backups until replaced. Providers may process information outside your country; applicable transfer protections and provider agreements must cover those transfers.
Your rights and contact
Privacy contact for Zero Percent Games: zeropercentstrategy@gmail.com. You can request access, correction, deletion, restriction or a portable copy of your data, object to processing based on legitimate interests, or withdraw consent. We may ask you to verify control of your account and normally respond within one month. Withdrawal does not affect earlier lawful processing.
You can also complain to your local data protection authority. In Malta, this is the Information and Data Protection Commissioner.