Privacy

Patchnotes is responsible for the personal data described here. Contact: [email protected].

Every request passes through Cloudflare to our server. Both see your IP address and the details your browser sends with each request, which is needed to deliver the page. Your IP address is not stored in our database.

Analytics

We count how the site is used with PostHog, hosted in its EU cloud. Your browser sends events to our own server, which forwards them to PostHog. An event records:

• the page you viewed, how long it was visible, and the page you came from
• campaign parameters in the link you arrived by (utm_source and the like)
• your screen and window size, and your browser's user agent string, from which PostHog works out the browser and operating system
• filters you apply, searches you type and their text, and links you follow to other sites
• errors that occur in the page

Our server also passes on your IP address. PostHog uses it to estimate an approximate location, such as country and city, and then discards it: the address itself is not stored. Events are tied to a random visitor ID held in a cookie. If you create an account, they are also linked to your email address, as described below.

Nothing is sent until you interact with the page or leave it. A bot-detection script (BotD) runs in your browser to check whether it is automated; if it is, nothing is sent. Its result stays in your browser, and its reporting to its maker is switched off.

Clicks on articles

Links to articles go through patchnotes.fyi/go/ before reaching the publisher. Our server records which article was opened, where on the site the link was, the time, and whether the visitor cookie was present. That record holds no IP address, browser details or visitor ID. If you have the visitor cookie, the click is also sent to PostHog as an analytics event. The publisher is told only that you came from patchnotes.fyi, not which page.

Images from other services

Overview pages show outlet icons loaded from Google (www.google.com/s2/favicons), and game pages show game art and outlet logos loaded from OpenCritic (img.opencritic.com). Your browser fetches these directly, so Google and OpenCritic receive your IP address and browser details under their own privacy policies.

• pn_v: a random visitor ID for analytics. Set by our server, not readable by page scripts. Expires after one year.
• pn_s: a random session ID for analytics. Set by our server, not readable by page scripts. Expires after 30 minutes without activity.
• theme: your light or dark mode choice, only set if you pick one. Expires after one year (Safari removes it after seven days). Our server does not read it.
• When signed in: a session cookie that keeps you signed in, not readable by page scripts, valid for 30 days and renewed when you use the site; and a second cookie that only says you are signed in and holds no identifier.

The site also keeps your display preferences, the last 500 articles you opened (so they show as read) and the newest article you have seen (to mark what is new since your last visit) in your browser's local storage. These never leave your browser. Clearing the site's data in your browser removes them.

You sign in with your email address and a code we email you. We store:

• your email address
• when you confirmed that you are 16 or older, if you did
• where your signup came from: the campaign source, medium and name in the link, the referring page, and the page you landed on. We use these to learn which advertising brings readers.
• your time zone as your browser reports it

Sign-in codes are six digits, stored hashed, and expire after 10 minutes. Your session is a random token in a cookie; your IP address and browser details are deliberately not stored with it. Your IP address is used to limit how often sign-in codes can be requested and tried.

When you sign in, we give PostHog your account ID and email address, and the browser's analytics events, including those from before you signed up, are linked to them. Signing in on another device links that device's events too. Signing out gives the browser a new visitor ID, so what happens after it is not linked to you.

Signing in with Discord or Google may be added later. This notice will say what they share before they are offered.

The newsletter sends the Daily, Weekly and Monthly overviews by email. We store:

• the lists you chose
• a consent record: when you subscribed, which version of the consent text you agreed to, and when you unsubscribed. It is kept after you unsubscribe, as proof of the consent you gave, until you delete your account.
• a record of each issue sent to you, so none is sent twice

The emails contain advertising. They have no tracking pixels and no links that identify you, apart from the unsubscribe link. Links to articles go through patchnotes.fyi/go/ and are counted per article, not per reader.

When an email bounces or a recipient marks it as spam, Amazon SES tells us, and we mark the address so we stop sending to it.

You can unsubscribe with the link in any email, with the unsubscribe button Gmail and Yahoo show, or on your account page.

• To provide your account (signing in, sending codes, the account page): to perform our agreement with you, GDPR Article 6(1)(b).
• To send the newsletter: your consent, Article 6(1)(a). You can withdraw it at any time by unsubscribing; this does not affect sending that happened before.
• Our legitimate interests, Article 6(1)(f): delivering and securing the site, limiting sign-in attempts, handling bounces and spam complaints, understanding which pages and features readers use (analytics), and learning which advertising brings readers (signup source).

An email address is needed to have an account. Everything else is optional. We make no automated decisions about you and do not sell your data.

These companies process data on our behalf:

• Supabase: our database, hosted on AWS in Ireland (eu-west-1).
• Amazon Web Services: hosting on Lightsail and email sending through Amazon SES, in Ireland (eu-west-1).
• Cloudflare: DNS, the network and proxy in front of the whole site, image storage on R2, and forwarding of email sent to [email protected].
• PostHog: analytics, in its EU cloud.

Some of these are US companies. Where data reaches the United States, the transfer relies on the EU–US Data Privacy Framework and the Standard Contractual Clauses in their data processing terms.

The AI models that write the overviews receive news articles only, never data about readers.

• Your account, its consent records and its record of sent issues: until you delete your account.
• Sign-in codes: they expire after 10 minutes.
• Sessions: 30 days after you last used the site, or until you sign out.
• Cookies: as listed above.
• Analytics events: for as long as our PostHog plan retains event data.
• Article click records: kept, but they contain no personal data.

You can ask for access to your data, to have it corrected or erased, to restrict how it is used, to receive it in a portable format, and you can object to processing based on our legitimate interests. You can withdraw consent at any time.

On your account page you can change your lists, export your data as JSON, and delete your account, which deletes the account, its sessions and its subscriptions, and removes your email address from PostHog. For anything else, email [email protected]. We answer within one month.

You can complain to the data protection authority where you live or work, or to Datatilsynet, the Norwegian authority, which supervises the publisher.