Privacy Policy

Last updated: September 11, 2026

1. Introduction

Sleik.is ("we", "us", "our") takes privacy and security seriously. This Privacy Policy explains what information we collect, why we collect it, how we use it, and what rights you have under applicable data protection laws (including GDPR and Icelandic data protection legislation).

2. Data Controller and Contact

The data controller for sleik.is is the site operator.

• Email: [email protected]
• Website: sleik.is

3. Information We Collect

Depending on which parts of the site you use, we may collect:

• Account and profile data: user ID, display name, sign-in provider, avatar, language preference and email address (where available). Signing in is handled solely by Sleik ID, our own single sign-on. Older accounts (email/password, Google or SMS/phone) are linked to Sleik ID automatically on first sign-in when a verified email address matches. Much of the site, including many single-player games, can be used without signing in; in that case we create no account and store no game progress.
• Game and community data: scores, leaderboards, statistics, favourites, multiplayer game and challenge state, and community content such as chat messages in features where chat is enabled.
• Points, purchases and items: your points balance and a transaction ledger recording every award, purchase and stake — including points wagered in games such as slots, roulette, plinko and blackjack, and points staked on prediction events — together with store purchases and which cosmetic items you own and have equipped. Points are a virtual, in-site currency with no monetary value.
• Sleikcraft: if you link a Sleikcraft (Luanti) character to your account, we store that in-game username and the link date, and the game servers keep in-game chat and player activity logs.
• Messages, feedback, and contact submissions: if you contact us, we collect the information you provide (for example name, email, message type, message text and optional attachments), along with your IP address and browser user-agent.
• Advertising data: when an ad is shown to you we record an impression — the ad and campaign, the page path, a coarse device type (mobile or desktop), and either your user ID or a session identifier. This is used to count views, apply frequency caps and measure campaigns. We do not build advertising profiles and we do not track you across other websites.
• Operational and technical data: IP address, user-agent, timestamps, error logs and operational service logs. For signed-in users this includes presence (whether you are online) and page-duration events, used for reliability, abuse prevention and diagnostics.

4. How We Use Your Information

We use information to:

• Provide and maintain the service (games, settings, leaderboards)
• Manage accounts and authentication
• Enable multiplayer, leaderboards, challenges and chat
• Operate the points economy, the store and cosmetic items, and keep balances accurate and fair
• Select, cap and measure the ads shown on the site
• Link and operate Sleikcraft game-server accounts
• Respond to support requests, feedback and bug reports
• Prevent fraud, cheating, misuse and security incidents
• Analyse and improve user experience and site performance (usually with aggregated data)

5. Legal Bases (GDPR)

We process personal data on one or more of the following legal bases:

• Contract: where processing is necessary to provide a service you request (e.g. an account, saving progress, a store purchase).
• Legitimate interests: to secure the service, prevent cheating and abuse, show and cap our own ads, and improve reliability and performance.
• Consent: where required.
• Legal obligation: where we must comply with legal requirements.

6. Service Providers and Third Parties

Our primary game and account data store is PostgreSQL, running on our own infrastructure. We also use the following providers where needed to run the service:

• Sleik ID (sso.sleik.is): our own single sign-on service, which handles registration, sign-in, passwords and passkeys
• Firebase Authentication (Google): no longer used to sign in. It remains only to close out legacy Firebase sessions in your browser.
• Atlassian Jira: contact-form submissions and their attachments are filed as support tickets
• Google Maps JavaScript API: map rendering in the location-based game Staðasleikur
• Cloudflare: security filtering, DDoS/WAF protection, edge delivery, and Cloudflare Web Analytics (cookieless traffic measurement)
• PostHog (EU Cloud): product analytics for sleik.is and shop.sleik.is. Data is hosted in the European Union. Requests go through our own domain (/ingest) and are forwarded to PostHog together with your IP address, browser information and usage events (for example page views, game results and orders). We do not use session replay (screen recording). In addition, server-side operational logs (error messages and backend diagnostics) are sent to PostHog. These can include your user ID (uid) where an error or event relates to a signed-in user. PostHog retains logs for 14 days.
• Kling (Journey ehf.): payment processing for the shop and contributions — see section 13

Advertising is first-party. sleik.is currently shows no ads and records no advertising data. Should advertising be reintroduced, ads will be served by our own ad system from sleik.is infrastructure. We do not use a third-party ad network, and no advertising network receives your data from us.

Google and other providers may process data in the EEA and/or other locations depending on configuration and service operations. Google's Privacy Policy also applies: https://policies.google.com/privacy

7. Cookies and Local Storage

We use cookies and similar technologies as needed for:

• Essential functionality: the signed session cookie sleik_session, and short-lived sign-in flow cookies (sso_oidc, sso_link_mode, sso_action_mode)
• Preferences: sleik_language
• Referrals and promotions: sleik_referral and sleik_bonus, which remember an invite link or a one-off bonus until it is applied to your account
• Shop: sleik_cart, which links your basket to you before you sign in
• Analytics: a PostHog cookie (ph_…_posthog) that gives your browser an identifier so visits can be counted. It is set on .sleik.is so one visitor is counted once across sleik.is and shop.sleik.is. It does not follow you to other websites.
• localStorage/sessionStorage: local settings and temporary game/session state stored in your browser
• Third-party scripts: Firebase and Google Maps may set or read their own cookies where those features are used

We do not use Google Analytics or any advertising or cross-site tracking cookies, and no data is sold or handed to advertisers. For traffic measurement we use Cloudflare Web Analytics (cookieless) and PostHog on European servers, which uses the cookie described above. When you are signed in, events are tied to your account identifier (uid); otherwise no person profile is created. You can opt out of analytics with your browser's "Do Not Track" setting, which we honour, or by blocking cookies. We also keep server-side operational logs as described above. You can disable cookies in your browser settings, though sign-in and some other features will not work.

8. Sharing and Disclosure

We do not sell personal data and we do not share personal data for marketing purposes. Data may be shared or disclosed only:

• With other users: your display name, avatar, scores and statistics may appear in games, challenges, chat, leaderboards, and on Sleikcraft servers where you have linked a character.
• With service providers: when needed to operate the site (hosting, authentication, support ticketing, maps, security/CDN), as listed in section 6.
• When legally required: if required by law or valid legal process.

9. Data Retention

We keep personal data only as long as necessary for the purposes described above:

• Account and game data: for as long as your account is active or until you request deletion.
• Points ledger and purchases: retained for the life of the account, since it is the record that makes balances and anti-abuse checks verifiable.
• Support and contact submissions: kept as support tickets for as long as needed to handle the request and for service-quality follow-up.
• Advertising impressions and presence/page-duration events: retained in aggregate-oriented form for reporting and abuse prevention.
• Technical and operational logs: retained for security, abuse prevention and diagnostics for as long as reasonably needed.

You can delete your account yourself from your profile page. If you ask us to delete an account or data, we aim to complete the process as soon as possible — typically within 30 days, unless longer retention is required by law.

10. Security

We apply technical and organizational security measures to protect data from unauthorized access, alteration, disclosure or destruction. Sign-in is handled by a dedicated authentication system (Sleik ID), session cookies are signed, and traffic is filtered at the edge by Cloudflare.

11. Children

Sleik.is is generally intended for users 13 years of age or older. We do not knowingly collect personal data from children under 13. If you believe a child has provided personal data, please contact us at [email protected].

12. Your Rights

Depending on your location and applicable law, you may have the right to:

• Access your personal data
• Correct inaccurate or incomplete data
• Request deletion (subject to certain conditions)
• Restrict or object to processing in certain cases
• Data portability (where applicable)
• Withdraw consent at any time (where processing is based on consent)

Many of these you can exercise directly: your profile page lets you change your display name and avatar and delete your account. For anything else, contact us at [email protected].

You may also lodge a complaint with the Icelandic Data Protection Authority (Persónuvernd) if you believe your data protection rights have been violated.

13. Card Data and Payment Security

We use Kling (Journey ehf.) as our payment provider. Your card details are processed directly by Kling in accordance with the PCI DSS standard and are never stored on sleik.is systems. Card number, expiry date and CVC are entered on Kling's payment page and never reach our servers.

We receive only confirmation of whether a payment succeeded, together with a transaction reference and a receipt link. No card details are sent to us.

For a shop order we store what is needed to fulfil it: name, address, email, phone, the items ordered and the amount. This is kept as long as Icelandic bookkeeping law requires and is not sold or passed on for marketing. Payment questions: [email protected].

14. Changes to This Policy

We may update this Privacy Policy as the service evolves. Changes take effect when posted on this page. We encourage you to review it periodically.

15. Contact

If you have questions about this Privacy Policy, please contact:

• Email: [email protected]
• Website: sleik.is