Last updated: 28/08/2026
There is no long, unreadable legal text here. No mumbo-jumbo to cover my back. No attempts to trick you into agreeing to terms you'll regret later.
I make it a point to collect as little data as necessary and, when I do, I protect it as if it was my own. This is a hobby project, not a business. I have no interest in your data beyond keeping the site running, and I will never sell it.
Who runs this site
Colin O'Brien. I am the data controller for the purposes of the GDPR. For anything on this page (questions, complaints, requests) email info@findapinball.com.
Your account
The only personal data you must give me is your email address. I use it to log you in, to confirm your account and to reset your password. Nothing else is required; any other profile details are optional and up to you. Passwords are stored hashed, so I never see them.
Legal basis: performance of the contract between us, i.e. providing you with an account.
Retention: for as long as your account exists. There is no self-service delete button yet, so email info@findapinball.com and I will delete your account and confirm when it's done.
What you contribute
Locations, machines, edits and other submissions are published on the site and visible to everyone. Treat anything you submit as public. If you ask me to delete your account, your contributions stay on the site but are anonymised – they are no longer linked to you or your display name.
Legal basis: performance of the contract, and my legitimate interest in keeping an accurate, usable record of what the community has built.
Emails
The only emails this site sends are account confirmations and password resets. There is no newsletter and no marketing. They are sent via Scaleway Transactional Email, a French provider acting as my data processor, and carry no open or click tracking.
Legal basis: performance of the contract.
Cookies
A single cookie keeps you logged in. It is strictly necessary for the site to work, which is why there is no cookie banner. Nothing else here sets cookies, and nothing tracks you across other websites.
Maps
Map tiles and location search are provided by Geoapify (Geoapify GmbH, Germany). Your browser requests tiles directly from them, so they receive your IP address in order to send the map back. Their servers are in the EU.
Legal basis: my legitimate interest in showing you a map, which is kind of the point of the site.
Analytics
I run a self-hosted copy of Swetrix analytics. It sets no cookies and creates no persistent identifier for you. Your IP address and browser user agent are used only to generate a salted hash that lets it recognise a single visit; the salt is rotated regularly and the IP address itself is not stored. I see aggregate figures (pages, referrers, countries) not individuals. I use it to spot usage trends and catch errors.
Legal basis: my legitimate interest in keeping the site working and understanding which parts of it are used.
Hosting and server logs
The site runs on a FreeBSD server hosted with LeaseWeb in Amsterdam, the Netherlands. Standard request logs, which include IP addresses, are written by the web server so I can diagnose faults and spot abuse. They are rotated regularly, and older logs are deleted; I don't use them to build any profile of you.
Legal basis: my legitimate interest in the security and availability of the site.
Data sharing
I don't sell your data or share it with anyone, except:
- Scaleway, which delivers account emails.
- Geoapify, which serves the maps.
- LeaseWeb, which hosts the server.
- Bunny.net (BunnyWay d.o.o., Slovenia), which runs the content delivery network the site is served through. Visit from the EU, and an EU edge server handles your request, so your data stays in the EU. Bunny.net's network is global, though: if you visit from outside Europe, the nearest edge server, wherever it is, handles the request instead. Either way your IP address is used only to route and serve the request, and the logs keep it in anonymised form.
- Where a legal obligation requires it.
If you're in the EU, your data stays in the EU – all four are EU companies and serve EU visitors from within the EU. Your data only leaves the EU or the European Economic Area if you visit from outside Europe, in which case Bunny.net serves you from a local edge server. All four act as my processors.
Automated decision-making
There is none. No profiling, no automated decisions with legal or similarly significant effects.
Your rights
Under the GDPR you can ask me to give you a copy of your data, correct it, delete it, restrict or object to how I use it, or hand it over in a portable format. Email info@findapinball.com and I'll sort it out. I'll reply within a month, usually much sooner.
If you're unhappy with how I handle your data, you can complain to your national data protection authority. Mine is the Belgian Data Protection Authority, and the EDPB lists all the others.
Updates
Changes take effect when published here. The date at the top tells you when this last happened.