Privacy Policy
This page describes what personal data Slow Made City processes, on what legal basis, who we share it with, and what rights you have. We write it in plain language rather than legalese.
Who processes the data
The data controller is Strata Promo OOD ("СТРАТА ПРОМО" ООД), company number (EIK) 130982726, registered seat Sofia, Bulgaria.
For questions about this policy: [email protected].
What we collect
If you only read the site
If you decline analytics cookies, we collect nothing that identifies you. Cloudflare, which hosts the site, processes technical request data (IP address, browser type) for security and content delivery. This is necessary for the site to work at all.
We also count visits with Cloudflare Web Analytics. It sets no cookies, reads nothing from your device, and does not follow you between sites: visits are counted from the referring page's address, not from an identifier. That is why this statistic works even when you decline analytics cookies, and why it needs no consent. We see totals: how many pages were opened, which are read most, from which country and in which browser. We do not see you.
If you accept analytics cookies
We use Google Analytics 4 to understand which stories get read, where readers come from, and how they move through the site. Google receives a truncated IP address, the page URL, device and browser information, and an anonymous identifier stored in a cookie. We have not enabled advertising features: Google Signals and ad personalization are turned off, and we pass no data to Google for advertising purposes.
We also use Microsoft Clarity, which records how the page is scrolled
and where it is clicked, so we can see where a piece loses its reader.
Clarity sets both first-party cookies for this site and cookies on
Microsoft domains. One of them, MUID, is also used by
Microsoft for advertising beyond this site. We neither buy nor show
advertising and we do not use this data for it, but we cannot limit what
Microsoft uses it for. If that is not acceptable to you, decline
analytics cookies: Clarity then records nothing.
Both Google Analytics and Clarity load with consent denied by default (Google Consent Mode v2 and Clarity's equivalent signal). Until you press "Accept", no analytics cookies are written and no session is recorded.
If you subscribe to the Slowmade Letter
We store your email address, the language you chose, and a consent record: when you gave it, from which page, from which IP address, and the exact sentence you agreed to. That record exists because the GDPR requires us to be able to demonstrate consent, not merely to assert it.
Subscription is double opt-in: we send you a link first, and nothing happens until you confirm it. That is what stops anyone from signing up an address that is not theirs.
The letters are sent through Resend, an email infrastructure provider. Resend processes your address in order to deliver the message and returns delivery, bounce and complaint feedback, which we use to stop writing to an address that does not work. The data is processed in the EU.
You can unsubscribe with one click from any letter, at any time. After you unsubscribe we keep the address marked as unsubscribed so that we cannot add you again by accident; that is our legitimate interest, and it is the lesser harm compared with losing you from the suppression list.
If you are signed in (City Loop)
When you register via magic link or Google, we store your email address and, for Google sign-in, the name and profile picture Google gives us. While you play, we record check-ins, articles read, and points. If you upload a photo, it is stored alongside your profile until the editorial team approves or rejects it.
On your profile you may also be asked whether we may email you. It is separate from the game and entirely optional: the game works the same whichever way you answer. If you agree, we store that consent together with the exact wording you were shown, the date, the language and the IP address it came from, because the GDPR requires us to be able to prove consent rather than merely assert it. The consent is for the Slowmade Letter, the same letter and the same wording as the form on the home page. The first letter arrives when the newsletter launches, not at the moment you agree.
If you decline, we record only that we have asked, so that we do not ask again, and without an IP address: that is not consent and there is nothing to prove. You can withdraw from the same page, at any time, with one click. The record that you gave consent and later withdrew it is kept, because that is precisely what shows during which period we were entitled to write to you. Neither consent nor withdrawal affects your points or your profile.
Cookies and local storage
| Name | Purpose | Lifetime |
|---|---|---|
smc_consent | Remembers your choice about analytics cookies | 6 months |
sb-*-auth-token, sb-*-code-verifier | Signing in (Supabase). Strictly necessary. Without them you cannot stay logged in | 60 days |
pending_point_intent | Holds a point earned before sign-in so it is not lost | 10 minutes |
_ga, _ga_* | Google Analytics (only after consent) | up to 2 years |
_clck, _clsk | Microsoft Clarity, ties page views into one session (only after consent) | up to 1 year |
MUID, CLID, ANONCHK, MR, SM | Cookies on Microsoft domains, set by Clarity. MUID is also used by Microsoft for advertising (only after consent) | up to 13 months |
Sign-in cookies are strictly necessary and are set without separate consent, because the service you asked for (an account) does not work without them. Analytics cookies are set only after your explicit consent.
You can withdraw consent at any time by clearing this site's cookies in your browser settings; the banner will reappear on your next visit.
Legal basis
- Consent (Art. 6(1)(a) GDPR) for analytics cookies.
- Performance of a contract (Art. 6(1)(b)) for the account and the game you asked for.
- Legitimate interest (Art. 6(1)(f)) for site security and abuse prevention.
Who we share it with
We do not sell data. We share it only with the providers we need in order to run the site:
- Cloudflare (hosting, article and photo storage);
- Supabase (profiles, points, game history);
- Google (Google Analytics and Google sign-in);
- Microsoft (Clarity, session recordings).
- Resend (sending the Slowmade Letter).
Some of these providers process data outside the EU. Transfers rely on the European Commission's Standard Contractual Clauses and, for US providers, the EU-U.S. Data Privacy Framework.
How long we keep data
- Analytics data in Google Analytics: 14 months.
- Slowmade Letter subscription: until you unsubscribe. The consent record is kept after that.
- Recordings in Microsoft Clarity: per Microsoft's Clarity policy.
- Cloudflare Web Analytics: aggregate totals only, no per-visitor data.
- Account and game history: until you ask us to delete it.
- Rejected photos: deleted once the editorial team decides.
Your rights
You have the right to access your data, to rectification, to erasure, to restriction of processing, to portability, and to object to processing. You may withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal.
Write to [email protected] and we will respond within one month.
If you believe we process your data unlawfully, you have the right to complain to the Bulgarian Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd, Sofia, cpdp.bg.
Changes
If we change this policy materially, we will note it here and, where needed, ask for your consent again.
Last updated: 9 August 2026