Privacy Policy
This page describes what personal data Slow Made City processes, on what legal basis, who we share it with, and what rights you have. We write it in plain language rather than legalese.
Who processes the data
The data controller is Strata Promo OOD ("СТРАТА ПРОМО" ООД), company number (EIK) 130982726, registered seat Sofia, Bulgaria.
For questions about this policy: [email protected].
What we collect
If you only read the site
If you decline analytics cookies, we collect nothing that identifies you. Cloudflare, which hosts the site, processes technical request data (IP address, browser type) for security and content delivery - this is necessary for the site to work at all.
If you accept analytics cookies
We use Google Analytics 4 to understand which stories get read, where readers come from, and how they move through the site. Google receives a truncated IP address, the page URL, device and browser information, and an anonymous identifier stored in a cookie. We have not enabled advertising features: Google Signals and ad personalization are turned off, and we pass no data on for advertising purposes.
Google Analytics loads with consent denied by default (Google Consent Mode v2). Until you press "Accept", no analytics cookies are written.
If you are signed in (City Loop)
When you register via magic link or Google, we store your email address and, for Google sign-in, the name and profile picture Google gives us. While you play, we record check-ins, articles read, and points. If you upload a photo, it is stored alongside your profile until the editorial team approves or rejects it.
Cookies and local storage
| Name | Purpose | Lifetime |
|---|---|---|
smc_consent | Remembers your choice about analytics cookies | 6 months |
sb-*-auth-token, sb-*-code-verifier | Signing in (Supabase). Strictly necessary - without them you cannot stay logged in | 60 days |
pending_point_intent | Holds a point earned before sign-in so it is not lost | 10 minutes |
_ga, _ga_* | Google Analytics - only after consent | up to 2 years |
Sign-in cookies are strictly necessary and are set without separate consent, because the service you asked for (an account) does not work without them. Analytics cookies are set only after your explicit consent.
You can withdraw consent at any time by clearing this site's cookies in your browser settings - the banner will reappear on your next visit.
Legal basis
- Consent (Art. 6(1)(a) GDPR) - for analytics cookies.
- Performance of a contract (Art. 6(1)(b)) - for the account and the game you asked for.
- Legitimate interest (Art. 6(1)(f)) - for site security and abuse prevention.
Who we share it with
We do not sell data. We share it only with the providers we need in order to run the site:
- Cloudflare - hosting, article and photo storage;
- Supabase - profiles, points, game history;
- Google - Google Analytics and Google sign-in.
Some of these providers process data outside the EU. Transfers rely on the European Commission's Standard Contractual Clauses and, for US providers, the EU-U.S. Data Privacy Framework.
How long we keep data
- Analytics data in Google Analytics - 14 months.
- Account and game history - until you ask us to delete it.
- Rejected photos - deleted once the editorial team decides.
Your rights
You have the right to access your data, to rectification, to erasure, to restriction of processing, to portability, and to object to processing. You may withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal.
Write to [email protected] and we will respond within one month.
If you believe we process your data unlawfully, you have the right to complain to the Bulgarian Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd, Sofia, cpdp.bg.
Changes
If we change this policy materially, we will note it here and, where needed, ask for your consent again.
Last updated: 9 August 2026