Privacy.

Stackwell Solutions is the controller of the personal data described below. Everything on this page — a request, a question, or a complaint — goes to one address: mms@stackwell-solutions.com.

• What you send us. Every contact route here is a plain mailto: link — there is no form on this site and no backend to submit one to. If you write, we process your address and whatever you chose to put in the message, in order to answer it.
• Your on-device choices. Switching between the light and dark theme stores a single key (sw-theme) in your browser's local storage; confirming your age on a demo page stores another (sw-age18) so you are not asked again for thirty days; and answering the analytics question stores a third (sw-consent), which is how your answer is remembered and how you avoid being asked twice. All three stay on your device, are never sent to us, and clearing site data removes them. They are functional, not analytical — the third one exists precisely so that a decision about tracking is respected.
• What you do on a page. A few interactions are counted so we can tell whether the site works: opening a game demo and roughly how long it stayed open, using the catalog filter or search, answering the age question either way, putting a demo into full screen, and clicking a contact link or a call to action. This is measured by our own server — the page asks it to record an event, and the server answers with nothing at all. No cookie is set and nothing is stored on your device for it, no identifier is created, no third party is involved, and what you type in the search box is never sent — only the fact that a search happened. Each event is recorded in the same access log described below, under the same 30-day deletion. This measurement is independent of Google: it runs whether you accept Google Analytics or reject it.
• The request itself. Serving you a page necessarily means your IP address and your browser's request reach our server. The web server keeps an access log of those requests: the IP address, the user agent your browser announces (its browser and device family), the page asked for, the page that referred you, the time, and how the server answered. We use it to keep the service secure — spotting probes, scanners and abuse — and for aggregate traffic statistics. Entries are deleted automatically once they are more than 30 days old, and nobody has to remember to do it: the web server starts a new log every day and keeps only the last few, and the copy we keep for traffic statistics is cleared by a scheduled job that runs daily and deletes every entry older than 30 days. The log lives on our own servers in the EU and involves no cookies and no third party. The one exception is Stackwell's own team: when team members sign in to our admin tools we set a signed cookie (sw_team), which this log records only so that their visits can be excluded from the statistics.
• What Google Analytics sees — only if you accept. If you press Accept analytics, this site loads Google Analytics and Google receives data about your visit. If you press Reject analytics, no Google code is loaded and Google receives nothing. The section below describes exactly what that means.

Playing a demo loads our player from play.stackwell-solutions.com. That is our own server rather than a third party, and the demo runs on play money with no account and no wallet.

Nothing on this site needs a cookie in order to work, and until you answer the analytics question no cookie is set at all. The only cookies this site can ever set are Google Analytics', and they are set only if you press Accept analytics. Press Reject analytics and no Google code is loaded, no request is made to Google, and no cookie is created — your answer is remembered on this device and you are not asked again. Nothing is held back and sent later either: a page you viewed before accepting is a page Google never learns about.

You can change your mind at any time, in either direction, through the Cookie settings link in the footer of every page. Withdrawing consent stops further collection and deletes the Google Analytics cookies this site set. Because your browser treats stackwell-solutions.com and stackwell.studio as two separate sites, your answer is stored — and asked for — separately on each.

• What it is, and why we use it. With your consent this site loads Google Analytics 4 (measurement ID G-ZB7LGJDZDP) from Google. We use it for one purpose: to understand in aggregate which pages and which games people actually look at, so that we know what to build and what to fix. We do not use it for advertising, we do not use it to build a profile of you as an individual, and we do not combine it with any other source.
• What it collects. The pages you view and when, an approximate location derived from your IP address (country and region level), your device type, browser, operating system, language and screen size, the site that referred you, and the same interactions listed above. Google states that Analytics does not log or store IP addresses: yours is used to derive that approximate location and is then discarded. Google Analytics also measures two things on its own, independently of ours — scrolling down a page, and clicking a link that leads off this site. We do not use it for advertising. Two separate measures back that up, and it is worth being exact about what each one covers: the tag on this site is configured to turn off Google Signals and ad personalisation, and this site's Content-Security-Policy refuses to let these pages reach any advertising network at all. The second is a property of this website rather than of our Google account — it constrains what can happen in your browser on these pages, and says nothing about how the Analytics property itself is configured.
• The cookies it sets. Two, both first-party: _ga and _ga_ZB7LGJDZDP. They hold a randomly generated identifier that tells one browser apart from another, so that a returning visitor is not counted as a new person. Three separate things govern how long they last: Google's tag asks for two years; your browser may cap that lower, and the cap differs by browser — measured in Chrome, which enforces a 400-day ceiling on any cookie, they came back at 400 days, while Safari's tracking prevention cuts script-set cookies far shorter again; and the clock is refreshed each time you visit, so it runs from your most recent visit rather than your first. Withdrawing consent deletes them immediately, whichever of those applied.
• What is stripped before Google sees it. Analytics is normally sent the full address of the page you are on, including anything after the ?. We do not send it whole. Before the page reports itself, the address is reduced to the site, the path, and a short list of standard campaign parameters (the utm_ family and the common ad-click identifiers); everything else in the query string is removed, and so is anything after a #. It is an allowlist, so a parameter nobody anticipated is dropped by default rather than forwarded. This site never puts anything in a query string itself — but the address you arrive on is not always ours to choose, and that is the case this guards.
• Who receives it, and where it goes. Google, acting as our processor under Google's data processing terms. Google operates globally, so the data may be processed outside the European Economic Area, including in the United States; Google states that it relies on the European Commission's standard contractual clauses and on its certification under the EU–US Data Privacy Framework for those transfers. Google's own description of how it handles Analytics data is at business.safety.google/privacy.
• How long Google keeps it. Event-level data is deleted by Google after the retention period configured on our property; the aggregate reports built from it are not affected by that deletion. This is separate from — and unrelated to — the 30 days our own access log keeps.
• Turning it off. Use Cookie settings in the footer of any page: that withdraws consent, stops further collection and deletes the cookies. Google also publishes a browser add-on that opts you out of Google Analytics on every site at once, at tools.google.com/dlpage/gaoptout.

• Lawful basis. Google Analytics rests on your consent, which is why you are asked before anything loads and why withdrawing is as easy as giving it. Correspondence rests on our legitimate interest in answering people who write to a supplier — and, where you are asking about working together, on the steps taken at your request before entering a contract. The access log and our own interaction counts rest on our legitimate interest in keeping a public server secure and understanding, in aggregate, how the site is used — a narrow interest, served with the least data that can serve it: no cookies, no identifiers, no third parties.
• Retention. We keep correspondence for as long as it has a business purpose: the conversation it belongs to, and the relationship that follows from it. When it has none, we delete it. Access-log entries are deleted automatically, by a daily job, once they are more than 30 days old. Google Analytics data is deleted by Google after the retention period set on our property, and the cookies are removed from your device when you withdraw consent.
• Sharing. We do not sell personal data and we do not pass it to third parties for their own purposes. Google Analytics is the one external service in the path, it runs only with your consent, and Google processes that data for us rather than for itself. There is no ad network and no CDN involved.

Under the GDPR you can ask for a copy of what we hold about you, ask us to correct or erase it, ask us to restrict or stop using it, or ask for it in a portable form. Write to mms@stackwell-solutions.com and a person will answer. If you believe we have handled your data badly, you are entitled to complain to your local data-protection supervisory authority — you do not need our permission, and you do not have to come to us first.