This website
01The short version
This website sets no cookies, runs no tracking script of any kind, and has no accounts, comments or forms. Nothing is stored on your device and no profile of you is built, so there is nothing to accept, decline or opt out of — which is why you were not shown a banner.
Two things are unavoidable and worth being explicit about: the server that delivers these pages sees your IP address, and clicking a gameplay trailer loads a video from YouTube. Both are covered below.
The games are a separate matter with their own policies. Those are linked at the bottom of this page.
02Who is responsible
The data controller for this website, within the meaning of the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR” / RGPD), is:
- Othmane Ettaib, trading as Indie Core Dev — a sole proprietorship (entreprise individuelle) established in France in April 2025
- SIREN 943 647 503 — APE 6201Z, computer programming
- Contact: contact@indiecore.net
The studio is not required to appoint a Data Protection Officer, and has not appointed one. Write to the address above for anything on this page.
03What happens when you visit
The site is static. There is no application server, no database and no user profile — every page was generated in advance and is served as a file.
Delivery is handled by Cloudflare. Like any web server, it processes the request in order to answer it, which necessarily involves:
- your IP address
- the date and time of the request, and the page requested
- the browser and operating system your browser reports
- the referring page, if your browser sent one
Purpose: delivering the page you asked for, and protecting the site against attack and abuse. Legal basis: legitimate interest (Article 6(1)(f) GDPR) in operating a functioning, secure website.
These records are held by Cloudflare acting as a processor, under its own retention schedule, and are not exported, enriched, joined to anything else or used to build a profile. No log is consulted to identify an individual visitor.
04Cookies and tracking
This site sets no cookies. It uses no session storage, no tracking pixels, no fingerprinting and no advertising tags. There is no Google Analytics, no Plausible, no Matomo — no analytics script of any kind runs in your browser, and no request leaves this domain unless you start a trailer (section 5).
Exactly one thing is written to your device, and only if you close the mailing-list invitation that can appear in the corner of a page after you have read most of it. Closing it stores a single entry in local storage, named icd-ml-dismissed, holding the value 1. That is the whole of it. It is not an identifier, it is never sent anywhere, nothing else reads it, and clearing your browsing data removes it. Clicking through to the signup page stores the same entry, on the same reasoning: you have answered, so you should not be asked again.
It exists to honour a refusal. Without it the invitation would return on the next page, and on every page after that. Storage that records your own choice needs no consent under Article 82 of the French Data Protection Act, which is why there is still no cookie banner here. You can check all of this in your browser's developer tools: that one entry is the only thing the storage panel will ever hold, and nothing at all is there until you close the invitation.
Fonts are served from this domain rather than from a font CDN, so loading a page sends your IP address to no one but the host of this site.
Do I measure anything? Yes, in two ways, and neither involves you individually:
- Aggregate traffic counts produced by the host from the server logs already described above — how many times a page was served, from which countries, from which referring sites. This is a summary of records that exist anyway; nothing extra is collected in order to produce it, and it cannot be resolved back to a person.
- Search performance from Google Search Console: which search terms show this site in Google's results, and how often those results are clicked. That is Google reporting on its own search engine, aggregated and anonymised before it reaches me. It is not a measurement of you browsing here, and it happens whether or not you ever visit.
Neither produces a profile, follows you between sites, or tells me who you are.
05Gameplay trailers
Some game pages offer a trailer. The video is not loaded with the page. What you see before clicking is a still image served from this domain, and no request reaches Google until you press play.
If you do press play, an embedded player is created on
youtube-nocookie.com, YouTube's privacy-enhanced mode. At that point
Google receives your IP address, information about your device, and the fact that you
watched that video, and it becomes the controller for what it does with them.
Legal basis: consent (Article 6(1)(a) GDPR), given by the deliberate act of starting the video. Do not press play if you would rather Google were not involved; nothing else on the page depends on it. Google's handling is described in the Google Privacy Policy.
06Links to other sites
Pages here link out to Google Play, to GitHub and occasionally elsewhere. Those are ordinary links: nothing is sent anywhere until you click one, and no tracking parameters are attached.
Once you follow a link you are on someone else's site, under their privacy policy rather than this one.
07If you email me
The contact page publishes an email address. There is no contact form, so nothing is collected unless you choose to write.
If you do, your message and address are used to answer you and for nothing else. Legal basis: legitimate interest (Article 6(1)(f)) in replying to correspondence, or steps taken at your request before entering a contract (Article 6(1)(b)) where that applies. Messages are kept while the exchange is live and for as long as needed afterwards to make sense of any follow-up, then deleted. Writing to me does not add you to the mailing list. That is a separate opt-in you have to make deliberately, described below.
08If you join the mailing list
The list is optional and this site works exactly the same without it. Joining asks for your email address — no name — and you choose at that point whether you want news about the games, the blog posts, or both.
One more thing is recorded with it: which page you were on when you signed up, as a short label such as mot-malin or blog. It is part of the record showing where and how you consented, which Article 7(1) requires me to be able to produce. It is a single word chosen by the page itself — not the address you came from, not anything your browser reports, and nothing that follows you between visits or between sites. There is still no cookie and no tracking script anywhere on this website.
Nothing is sent until you click a confirmation link in an email. If you never click it, the pending address is deleted after 30 days and you hear nothing at all. Legal basis: your consent (Article 6(1)(a)), given by that confirmation click and recorded with the date it happened. You can withdraw it at any time with the unsubscribe link in the footer of every email — one click, no login and no questions, because leaving has to be as easy as joining. Withdrawing does not affect anything already sent.
The list is used for those emails and nothing else. It is never sold, rented or shared, never used to build advertising audiences, and your address is not matched against anything inside the games.
The emails themselves carry the measurement any mailing-list provider adds: a small invisible image that records a message was opened, and links that pass through Kit so clicks can be counted. That is how the inactivity rule below is applied, and it is the one place this site measures anything at all. It records that a message was opened, not what you did afterwards. It stops entirely when you unsubscribe, and blocking remote images in your email program prevents it — nothing in the email breaks if you do.
Unsubscribing stops everything and leaves a record marked unsubscribed, so that you cannot be added back by mistake. Addresses that go three years without a single email being opened are removed. Write to contact@indiecore.net and the unsubscribe record is erased too.
09Where the data goes
Nothing is sold, rented or shared for advertising. There are no data brokers and no advertising partners involved in this website.
Three providers necessarily process data as described above, and all three are based in the United States:
- Cloudflare, Inc. — hosting and delivery of this site
- Google Ireland Ltd / Google LLC — only if you start a trailer
- Kit Inc. (trading as Kit) — only if you join the mailing list; it stores the list and sends the emails. Certified to the EU–US Data Privacy Framework under its former name, ConvertKit LLC.
Transfers outside the European Economic Area rely on the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework.
10Your rights
Under the GDPR you have the right to request access to your personal data, to have it corrected or erased, to have its processing restricted, to receive it in a portable form, and to object to processing carried out on the basis of legitimate interest (Articles 15 to 22).
Exercise any of them by writing to contact@indiecore.net. You will get an answer within one month. Be aware of a practical limit: this site keeps no identifier for you, so for ordinary browsing there is generally no record that could be located and connected to you. If you have emailed me, that correspondence can be found and deleted, and the same goes for your entry on the mailing list.
If you believe your data has been mishandled you may lodge a complaint with the French supervisory authority (Article 77):
- Commission Nationale de l'Informatique et des Libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr
11Changes to this policy
If this changes, the date at the top of the page changes with it and the previous wording stays in the site's public Git history, so the date is the honest signal. If a change materially affects the mailing list, subscribers are told by email.
12Privacy policies for the games
The games are software you install on a device, and each has its own policy describing what that game does. Those pages are permanent — they are referenced from Google Play store listings, so their addresses do not change.
