Privacy Policy

Last updated: 12 October 2026

The Well Played Awards is a free library you can read without an account. We collect very little: what your browser sends when you visit, and what you choose to send us through a form or by email. This page covers what that is, why we need it, who else handles it, how long we keep it and what you can ask us to do.

The short version

• We don't set cookies or show ads. We don't sell personal data or share it with advertisers.
• Visitor statistics come from Cloudflare Web Analytics, which uses no cookies. It runs only if you click "Accept" in our banner. You can change your choice at any time with the "Cookie settings" link at the bottom of the page.
• Videos and images come from our own media storage. Watching a video doesn't send your data to YouTube, Vimeo or any other video platform.
• Forms ask only for what we need to review your submission. If you give us your email, we use it only to deal with your request and reply, and we never publish it.
• The editor is told about each submission through Telegram. The notice includes what you entered, including your email if you gave one.
• You can ask at any time to see, correct or delete your data: [email protected].

Who is responsible for your data

The controller of your data is the operator of The Well Played Awards, an independent publisher based in Portugal. You can reach the operator at [email protected]. If you need the operator's full legal details, for example to exercise your rights or to file a complaint, write to that address and we will send them to you.

We haven't appointed a data protection officer because the law doesn't require one for a service like ours. Please send any question about this page or your data to the email above.

When you visit the site

Delivery and security. Every request to wellplayedawards.com passes through Cloudflare. Cloudflare delivers our pages, protects the site from attacks and limits abusive traffic. To do that, it processes your IP address, your browser and device details, the address of the page you request and the time of the request.

Our server is hosted by Hetzner in Germany. It keeps standard access logs: the time, the page address, the response, the referring page and your browser type. Catalogue filters are part of the page address, so they appear in these logs too. Traffic reaches our server through Cloudflare, so these logs normally show a Cloudflare network address rather than yours. We use the logs to keep the site running and secure.

Visitor statistics. We count visits with Cloudflare Web Analytics, but only if you agree. A banner asks whether we may collect anonymous visit statistics. It has two buttons of the same size and style, "Decline" and "Accept", and nothing is pre-selected. Until you click one, the statistics script isn't loaded and nothing is stored for statistics.

If you click "Accept", your browser downloads a small script from Cloudflare's domain static.cloudflareinsights.com. The script reads the page address, the referring page and page-load timing from your browser and sends them to Cloudflare. It counts the page you're on and every later page you open within the site. From this, Cloudflare reports pages viewed, referring sites, country, browser, device type and page speed. With that request Cloudflare also receives your IP address and browser details, which it uses to work out country, browser and device type; we don't see them. Cloudflare says the script uses no cookies or local storage and doesn't fingerprint visitors. We see only totals, never individual visitors.

If you click "Decline", nothing is loaded and we don't ask again for 12 months. "Cookies and storage on your device" below explains how we remember your choice and how to change it.

The banner appears on every page of the site, including this one, and the statistics script loads only after you accept it there.

Search and fonts. Library search runs inside your browser, so what you type isn't sent to us. Our fonts come from our own domain, so your browser doesn't contact Google Fonts.

Legal basis: for delivery, security and server logs, our legitimate interests in running a fast, secure site (Article 6(1)(f) GDPR). For visitor statistics, your consent (Article 6(1)(a) GDPR and Article 5 of Portuguese Law 41/2004), which you can withdraw at any time.

Videos and images

The videos and images on our pages are delivered from our own media storage (Cloudflare R2, at media.wellplayedawards.com). We don't embed YouTube, Vimeo or any other video player, and we don't load videos from other websites. Links to games, case studies and archived copies take you to other sites only when you click them.

Cookies and storage on your device

We don't set any cookies, and we don't use advertising or cross-site tracking. Our own code stores up to two items in your browser, and neither ever leaves your device. Cloudflare may store or read others, as listed below.

How your choice works

• Before you choose, the statistics script isn't loaded and nothing is stored for statistics.
• If you click "Accept", the script loads straight away on that page. It also loads on your later visits, as long as your acceptance is less than 12 months old. Accepting in one tab also starts it in any other tabs of the site you already have open.
• If you click "Decline", nothing is loaded and we don't ask again for 12 months.
• We treat a choice older than 12 months as expired and ask again, and we don't load the script on an expired acceptance. We also ask again if we change the version of the banner. Your new choice replaces the old one.
• If your browser blocks local storage, as some private modes do, nothing is stored. Your choice then lasts only until you reload the page, and the banner asks again.

Changing or withdrawing your choice. The footer of every library page has a "Cookie settings" link, after Privacy, Terms, Copyright and Removal requests. It reopens the banner and shows your current choice: accepted or declined.

• Click "Decline" to withdraw your consent, and we save the refusal. If the statistics script was running on that page, the page reloads at once without it, and the script isn't loaded again. Any other tabs of the site you already have open stop counting when you reload or close them.
• Click "Accept" to start the statistics straight away.
• Press Esc to close the banner without changing anything.

Clearing the site's data in your browser also removes your choice, and the banner asks again.

When you send us something

The site has three forms: submit a game, add a credit, and request a removal or correction. You can submit a game or add a credit step by step, from the buttons on the site, or on a full page (/submit and /credits). None of the forms needs an account. Under each send button there's a link to this policy. The game and credit forms also link to our Terms of Use, and the removal form to our Copyright & Removal page.

What the forms collect

• Submit a game, step by step: a link to the game, or its name if there's no link; where it lived (web, mobile web, app, mini-app, installation or something else); the brand; and, if you like, who made it, what it was for and what happened, and files. This version doesn't ask for your name or your email.
• Submit a game, full page: a link to the game and, if you like, its title, the brand, the studio or agency, your email and a note.
• Add a credit, step by step: the project, the role, the studio or person to credit, your email and, if you like, proof or notes.
• Add a credit, full page: the game and the studio or agency to credit and, if you like, the role, your email and a note.
• Removal or correction: the project, the reason, your name and who you represent, your email, your confirmation that the request is made in good faith and, if you like, more detail. We keep the exact wording of the statement you confirmed with your request. This form doesn't take files.

We also record when each request arrived.

Your email is used only to deal with your request and reply about it. We never publish it, add it to a mailing list or use it for marketing. It's required in the removal form and in the step-by-step credit form, because we can't decide a removal or check a credit without being able to reach you. It's optional on the full-page forms. Without it, we can't ask you questions or tell you what we decided. We don't send automatic confirmation emails.

Files you upload. Only the step-by-step game form takes files: JPG, PNG, WebP, GIF, MP4, MOV or WebM, up to 12 files and 8 MB in total. They're stored on our server under random file names and aren't publicly accessible. The editor may look at them to assess your submission, and we may use material from them on the game's page (see our Terms of Use).

Metadata in your files. Before we save an image (JPG, PNG, WebP or GIF), we remove its embedded metadata: EXIF data such as the camera, the date and the GPS location, as well as XMP and IPTC data, comments and colour profiles. To do this, we turn the image upright, convert it to standard colours (sRGB) and save it again in the same format: JPEG and WebP at quality 90, PNG without loss. Animated GIF and WebP images keep all their frames. If an image can't be processed, for example because the file is damaged, it's larger than 100 megapixels or our image tool is unavailable, we save the original unchanged, metadata included, and note this in our server log. Videos are saved exactly as you send them. We don't remove their metadata, including any location tag your phone added. If that matters to you, remove it before uploading, or send us a link instead.

Credits are public. If we accept a credit, we publish the studio or person name and the role you entered on the game's page and on the studio's page. If you enter your own name, it will be public.

Spam protection. When you open a form, Cloudflare Turnstile checks your browser for signs of automation. It asks you to tick a box only if it's unsure. When you send the form, our server passes your IP address and the result of the check to Cloudflare for confirmation. We also count submissions from each IP address to stop floods. These hourly counts are held only in our server's working memory and cleared within about an hour. They are never written to disk or to logs.

How submissions reach the editor. Your submission is saved in our database. A plain-text notice then goes to the editor's private chat with our Telegram bot, so that we can deal with requests promptly. The notice contains:

• the details you entered in the form, including your email;
• for removal requests, your name and who you represent, on the same line as your email;
• your message, up to its first 1,500 characters;
• the number of files you added, but not the files themselves.

If a notice fails to send, a script sends it again later in the same format. When the editor makes a decision, our bot edits the notice to remove your email (with your name, for removal requests) and your message, and keeps the project details, including the studio or person name entered as the maker or for the credit. A notice that is still waiting for a decision keeps your email and message in the chat. Deleting a submission from our database doesn't delete its Telegram notice. Legal basis for these notices: our legitimate interests in handling requests promptly (Article 6(1)(f)). See "Who else handles your data" and "Transfers outside the EU" for more about Telegram.

Research. If we take a game forward, we research it with automated tools, including AI services. These services receive the game's link and the title, brand and studio you gave us. They never receive your email, your message or your files. The editor reviews every submission. No decision with legal or similarly significant effects on you is made by automated means alone.

Legal basis: our legitimate interests in running an editorial library: reviewing, checking and publishing what people send us, and replying to them (Article 6(1)(f)). For removal requests and notices about illegal content, we also rely on our legal obligations wherever the law requires us to handle such notices (Article 6(1)(c)).

When you email us

Mail sent to [email protected] goes through Cloudflare Email Routing to a mailbox hosted on Google Workspace. We use your address and message to reply and to deal with your request, based on our legitimate interests (Article 6(1)(f)). We keep emails for up to 2 years after the last message in the conversation, then delete them, unless we need them longer to establish or defend a legal claim.

People who appear in the library

The library documents marketing campaigns that have been made public. Some pages include information about individuals:

• freelancers and other people named in credits;
• people named in press coverage, award entries or case studies;
• people visible in screenshots or video from a campaign.

This information comes from public sources and from credited studios and people who send it to us. The public sources are award archives, agency and studio portfolios, press coverage, platform showcases, video platforms such as YouTube and Vimeo, public social-media posts, brand sites and copies kept by the Internet Archive. We don't seek out private contact details or sensitive information about anyone.

We research and draft pages with AI services from Anthropic and Perplexity (USA). They process the public sources we research, which can include the names of people credited on a project.

We use this information to document and discuss published marketing work. This is an exercise of freedom of expression and information, and it relies on our legitimate interests (Article 6(1)(f), read with Article 85 GDPR). The information stays as long as the page is published. After a removal, copies kept in our internal archives and backups are never republished (see "How long we keep it").

If you appear in the library, you can ask us to correct a credit, hide a name you no longer use or remove a frame that shows you. You can also object to the processing. Our Copyright & Removal page explains how.

Who else handles your data

We use the following service providers. A provider marked as a processor handles data only on our instructions.

• Hetzner Online GmbH, Germany (processor): hosts our server and database in the EU.
• Cloudflare, Inc., USA (processor):
  • content delivery and DNS;
  • security and rate limiting;
  • Turnstile, and Web Analytics if you accept it;
  • media and backup storage (R2);
  • email routing;
  • Cloudflare also uses some Turnstile data for its own purposes, as its Turnstile privacy addendum explains.
• Google (processor for Google Workspace): hosts the mailbox that hello@ forwards to.
• Telegram Messenger Inc., outside the EU: the third-party messaging service we use to notify the editor of new submissions. Its notices contain the details you entered in a form, including your email and the start of your message (see "How submissions reach the editor"). Telegram handles them under its own privacy policy.
• Anthropic, PBC and Perplexity AI, Inc., USA (independent controllers): AI services we use to research projects and draft pages. They receive public information about projects, which can include the names of people credited on them, and the game details from submissions. They never receive your email or your message. They handle data under their own terms and privacy policies.

We may also disclose data where the law requires it, for example to a court or a competent authority. We don't sell personal data, and we don't share it with advertisers.

Transfers outside the EU

Our server and database are in the EU.

Cloudflare and Google are US companies certified under the EU–US Data Privacy Framework. The European Commission recognised that framework as giving adequate protection on 10 July 2023. Cloudflare's data processing agreement also includes the EU Standard Contractual Clauses. Write to us if you'd like a copy of these safeguards.

Anthropic and Perplexity, which are also in the US, receive only public information about projects and the game details from submissions, never your email or your message.

Telegram's group companies are based outside the EU and aren't covered by an EU adequacy decision. We use Telegram's standard service, and we don't have a data processing agreement or Standard Contractual Clauses with Telegram. Its notices contain the details you entered in a form, including your email and the start of your message. If you'd rather your details didn't pass through Telegram, email us at [email protected] instead of using a form.

How long we keep it

We run these deletions automatically in regular batches, not at the moment a period ends, so data can sometimes stay a little longer than shown before it's deleted. Where a request has no recorded decision date, we count from the day it arrived. Data deleted from the database stays in backups until those backups expire.

Your rights

Under the GDPR you can ask us to:

• give you a copy of the personal data we hold about you (access);
• correct it (rectification);
• delete it (erasure);
• limit how we use it while a question is being resolved (restriction);
• give you the data you provided in a portable format, where that right applies.

Your right to object. Most of what we do relies on our legitimate interests. You can object to that processing at any time, on grounds relating to your particular situation. We will then stop, unless we have compelling legitimate grounds that override your interests, rights and freedoms, or we need the data to establish, exercise or defend legal claims.

Withdrawing consent. Where we rely on your consent, as with visitor statistics, you can withdraw it at any time with the "Cookie settings" link at the bottom of the page (see "Cookies and storage on your device"). This doesn't affect what happened before you withdrew it.

To use any of these rights, write to [email protected]. It's free. We may ask you to confirm that you control the email address involved. We reply within one month. If a request is complex, we may take up to two more months, and we'll tell you why.

Complaints. If you're unhappy with how we handle your data, please tell us first. You can also complain to the Portuguese data protection authority, or to the authority in the country where you live or work:

• Authority: Comissão Nacional de Proteção de Dados (CNPD)
• Address: Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, Portugal
• Phone: +351 213 928 400
• Email: [email protected]
• Website: www.cnpd.pt

Children

The library is written for people who work in or follow marketing, and it isn't aimed at children. If you're under 13, please don't send us personal data. If you think a child has, write to us and we'll delete it.

Security

We take these steps to protect your data:

• we use HTTPS throughout;
• our server accepts traffic only through Cloudflare;
• only the editor has access to submissions;
• database backups stored off-site are encrypted.

No system is perfectly secure. If we learn of a breach that puts your data at risk, we'll tell you and the CNPD where the law requires it.

Changes to this policy

We'll update this page when what we do changes, and change the date at the top. If a change is significant, we'll also note it on the site.

Contact

Write to [email protected], in English or Portuguese. A person reads every message.