Privacy Policy

What we collect, why, and what we never do with it

Last updated: 3 July 2026

The short version:

  • We collect what a community site needs to work: your email, username, name, and the things you post. Nothing more.
  • We never sell your data, and there are no advertising or analytics trackers on the site.
  • Your data lives in the EU. Passwords are stored hashed, so we couldn't read them if we wanted to.
  • Want your account gone? Email us and it's deleted.

1. Who's responsible

Crit Gaming Reviews ("CGR") is run independently from the United Kingdom, and the site's operator is the data controller for the information described here. Anything privacy-related: harry.lidstone@critgamingreviews.com.

2. What we collect

  • Account details. Email address, username, first and last name, and an optional mobile number, given when you sign up. Your password is stored as a bcrypt hash, never as readable text.
  • What you post. Reviews, ratings, comments, forum posts, and any GIFs you attach.
  • Technical data. Your IP address, used briefly for rate-limiting and abuse prevention (stopping bots and spam floods), and appearing in standard hosting logs. Expired rate-limiting records are purged automatically.

3. Why we use it

  • To run your account and show your content to the community (performing our agreement with you).
  • To keep the site safe: bot checks at signup, rate-limiting, and automated content moderation (our legitimate interest in protecting the site and its members).
  • To respond when you contact us.

That's it. We don't sell data, we don't run ad trackers, and we don't send marketing emails.

4. Where it lives

Our database is hosted by Turso on AWS in Ireland (EU), and the site runs on Vercel. Both act as processors for us. Traffic to the site is encrypted (HTTPS), as is the connection between the site and the database.

5. Services that help us run the site

  • Cloudflare Turnstile checks that signups are human; it processes your IP as part of that check.
  • OpenAI is used to automatically scan the text of posts and comments for serious policy violations (hate speech, threats) at the moment you submit. Only the text is sent, not your name or account details, and it isn't used to train AI models.
  • GIPHY powers GIF search; your search terms go to GIPHY, your identity doesn't.
  • YouTube serves the game trailers, embedded in YouTube's privacy-enhanced mode, which sets no tracking cookies unless you play a video.

6. Cookies

We use essential cookies only: one that keeps you signed in, and (during private preview) one for the preview gate. No advertising cookies, no analytics cookies, no third-party tracking cookies. That's why you don't see a cookie banner.

7. How long we keep things

Account data and content stay until you delete them or ask us to delete your account. Rate-limiting records expire within about a day. If you delete your account, your posts and personal details are removed from the live database.

8. Your rights

Under UK GDPR you can ask for a copy of your data, ask us to correct it, or ask us to delete it. Email us and we'll sort it. You also have the right to complain to the ICO (ico.org.uk).

9. Age

CGR is for people aged 13 and over, per our Terms of Service.

10. Changes

If we add anything that changes this picture (analytics, advertising, an email newsletter) we'll update this policy first, and the date at the top will tell you when.