Cookie Policy

1. Scope and operator

1. 1.1This Cookie Policy governs the storing of information on, and the gaining of access to information already stored in, the terminal equipment of every visitor to stratosphynx.com (the Site).
2. 1.2The Site is operated by Williwaw Studios OOD (Виливау Студиос ООД), UIC/EIK 206530664, 51 Business Park Sofia, Building 11A, floor 4, Sofia 1766, Bulgaria (the Operator, we, us), a limited liability company incorporated in the Republic of Bulgaria, which is the controller of any personal data described here within the meaning of Article 4(7) of Regulation (EU) 2016/679 (GDPR).
3. 1.3This Policy forms part of, and is incorporated by reference into, the Privacy Policy and the Terms and Conditions. Where this Policy and the Privacy Policy describe the same operation, this Policy governs the storage and access step and the Privacy Policy governs the subsequent processing.

2. Legal framework applied

1. 2.1Storage on and access to your terminal equipment is governed by Article 5(3) of Directive 2002/58/EC (the ePrivacy Directive) as amended by Directive 2009/136/EC, implemented in Bulgaria by the Electronic Communications Act. Article 5(3) permits such storage or access only with your prior informed consent, save where it is strictly necessary to provide a service you have expressly requested.
2. 2.2Where the stored item constitutes or leads to the processing of personal data, that processing additionally requires a lawful basis under Article 6(1) GDPR, and the consent relied upon must meet the standard of Articles 4(11) and 7 GDPR: freely given, specific, informed, unambiguous and as easy to withdraw as to give.
3. 2.3The Operator applies the guidance of the European Data Protection Board on consent (Guidelines 05/2020) and on the technical scope of Article 5(3) ePrivacy (Guidelines 2/2023), including the position that consent may not be obtained by pre-ticked boxes, by continued scrolling, or by a design that makes refusal harder than acceptance.
4. 2.4For visitors in Australia, the Privacy Act 1988 (Cth) and the Australian Privacy Principles apply to any personal information involved, in addition to and not in substitution for the standards described above.

3. The consent notice and how a choice is recorded

1. 3.1On a first visit the Site displays a cookie notice. The notice does not cover the page, does not prevent reading or navigation, and offers three equally prominent routes: accept all categories, keep strictly necessary only, or open Preferences and decide per category.
2. 3.2Refusal requires the same number of actions as acceptance. There is no pre-ticked box, no consent by scrolling, no consent by continued use and no repeated re-prompting of a visitor who has refused.
3. 3.3Until a choice is recorded, no key outside the strictly necessary category is written. If you close the notice without choosing, nothing beyond the strictly necessary category is written and the notice will be offered again on a later visit.
4. 3.4The record of your choice is itself stored, as sz_cookies. That single item is strictly necessary in the meaning of Article 5(3), because without it the Site cannot know on the next page that you refused.

4. Categories used

1. 4.1Strictly necessary. Items without which a function you have expressly requested cannot be delivered: your language selection, your age confirmation, and the record of your cookie choice. These are stored on the second limb of Article 5(3) ePrivacy and are not subject to consent.
2. 4.2Preference. Items that remember an interface setting you last chose. These are not strictly necessary and are stored only with consent.
3. 4.3Functional. Items that keep your points, your optional local account and related gameplay state. These are not strictly necessary and are stored only with consent.
4. 4.4There is no analytics category, no advertising category and no profiling category, because the Site performs none of those activities.

5. Register of every item stored

1. 5.1The following table is a complete register of every item this Site writes to your device. No item outside this table is written. If the register changes, the cookie notice is reset so that a fresh choice can be made before anything new is written.
2. 5.2

   Key	Medium	Purpose	Category	Legal basis	Lifetime
   sz_lang	Cookie + localStorage	A two-letter language code, so the server can render the page in your language before any script runs. Set only when you press a language control.	Strictly necessary	Art. 5(3) ePrivacy, second limb (strictly necessary): no consent required	12 months, or until you clear it
   sz_age_ok	localStorage	A single flag recording that you confirmed you are 18 or over, so the confirmation strip is not shown again.	Strictly necessary	Art. 5(3) ePrivacy, second limb (strictly necessary): no consent required	Until you clear it or press Erase everything
   sz_cookies	localStorage	The record of your cookie choice itself: 1 for all categories, 0 for strictly necessary only. Keeping it is what makes your refusal effective on the next page.	Strictly necessary	Art. 5(3) ePrivacy, second limb (strictly necessary): no consent required	Until you clear it or press Erase everything
   sz_points	localStorage	Your points number. Points are a scorekeeping figure with no monetary value, no exchangeability and no transferability.	Functional (consent)	Art. 5(3) ePrivacy + Art. 6(1)(a) GDPR: consent	Until you clear it or press Erase everything
   sz_entry	localStorage	The entry amount you last set on a board, so the board opens the way you left it.	Preference	Art. 5(3) ePrivacy + Art. 6(1)(a) GDPR: consent	Until you clear it or press Erase everything
   sz_user, sz_users	localStorage	An optional local account: a display name, an email address and a hashed password. It is created in your browser, stored in your browser and never transmitted to us or to anyone else.	Functional (consent)	Art. 5(3) ePrivacy + Art. 6(1)(a) GDPR: consent	Until you clear it or press Erase everything
   sz_refill_used	localStorage	A flag noting that the one free points top-up has already been taken in this browser.	Functional (consent)	Art. 5(3) ePrivacy + Art. 6(1)(a) GDPR: consent	Until you clear it or press Erase everything
   sz_removal	localStorage	An unsubscribe request you lodged on the unsubscribe page, kept locally so that you can see what you submitted.	Functional (consent)	Art. 5(3) ePrivacy + Art. 6(1)(a) GDPR: consent	Until you clear it or press Erase everything

3. 5.3localStorage is a store held inside your own browser. Its contents are not transmitted with requests, are not accessible to the Operator and are not accessible to any other website. The Operator has no server-side copy of any value listed above.

6. Withdrawing or changing consent

1. 6.1You may withdraw consent at any time under Article 7(3) GDPR, and withdrawal is as easy as giving it. Use the Preferences control at the foot of this page, or the Erase everything control, both of which take effect immediately without contacting us.
2. 6.2Choosing strictly necessary only, whether at the notice or later, immediately deletes the points value, the entry setting, the local account and the top-up flag from this browser. The Site continues to function without them.
3. 6.3Withdrawal does not affect the lawfulness of storage carried out on the basis of consent before its withdrawal, as provided by the second sentence of Article 7(3) GDPR.
4. 6.4Your choice is recorded per browser and per device, because it is stored on the device. A choice made in one browser does not carry to another.

7. What the Site does not do

1. 7.1The Site does not use analytics of any kind, first-party or third-party, and does not measure audience, sessions, funnels or conversions.
2. 7.2The Site does not use advertising identifiers, conversion pixels, remarketing tags, social plugins, embedded players, comment systems or any other third-party script that could observe your visit.
3. 7.3The Site does not perform device fingerprinting, canvas or font enumeration, IP-based profiling, cross-site tracking or any linking of your activity across sessions, devices or services.
4. 7.4The Site does not carry out automated decision-making producing legal or similarly significant effects within the meaning of Article 22 GDPR, and does not sell, rent or disclose any stored item, because it holds none of them.

8. Requests made to other hosts

1. 8.1The Site loads two web font files from a third-party font host. That request necessarily discloses your IP address and user agent to that host, as any request to any host does, and it is made for presentation only.
2. 8.2No cookie is set by that host through this Site, and no script from that host is executed. If you block the host, the Site renders with system fonts and every function continues to work.
3. 8.3Outbound links to support services listed on the Safer Play page open on the operators of those services and are governed by their own policies. We do not control them and do not receive information about your use of them.

9. Browser and device controls

1. 9.1Independently of the controls offered here, every mainstream browser lets you block or delete cookies and local storage, either wholly or per site, and lets you refuse storage in a private window. Blocking storage for this Site removes only the conveniences described above.
2. 9.2Where your browser sends a general opt-out signal, the Site behaves as though strictly necessary only had been chosen. Because the Site performs no tracking, such a signal changes nothing else.
3. 9.3Clearing site data in your browser erases everything listed in section 5 and returns the Site to the state of a first visit, including the cookie notice.

10. Retention and erasure

1. 10.1The language cookie expires twelve months after it is set. Every other item persists in your browser until you delete it, until you choose strictly necessary only, until you press Erase everything, or until your browser clears site data.
2. 10.2The Operator does not and cannot erase these items remotely, because it has no access to them. The controls on this page are the means of erasure.
3. 10.3Where an item constitutes personal data, your rights under Articles 15 to 22 GDPR apply and are described in the Privacy Policy. Because the items are held only on your device, the practical exercise of the right to erasure under Article 17 is the Erase everything control.

11. Visitors in Australia

1. 11.1For visitors in Australia, the items listed in section 5 that could identify an individual are personal information within the meaning of section 6(1) of the Privacy Act 1988 (Cth), specifically the optional local account.
2. 11.2That information is collected and held only on your device, is not collected by the Operator, is not disclosed to any overseas recipient by the Operator for the purposes of Australian Privacy Principle 8, and is not used or disclosed for direct marketing for the purposes of Australian Privacy Principle 7.
3. 11.3The Privacy Policy sets out how to make a complaint, including to the Office of the Australian Information Commissioner.

12. Changes, review and contact

1. 12.1This Policy is reviewed whenever a change is made to what the Site stores and in any event at least once a year. The version date appears at the head of this page.
2. 12.2A change that adds an item, changes the purpose of an item or changes its category resets the cookie notice, so that a fresh choice is obtained before the change takes effect.
3. 12.3Questions about this Policy: [email protected]. Questions about personal data, or the exercise of a right under the GDPR or the Privacy Act 1988 (Cth): [email protected]. Postal address: Williwaw Studios OOD (Виливау Студиос ООД), UIC/EIK 206530664, 51 Business Park Sofia, Building 11A, floor 4, Sofia 1766, Bulgaria.