Privacy Policy

Last updated: 2026-09-23

This Privacy Policy explains what information is collected when you use GachaData (the “Service”) and how it is used. GachaData does not require an account. A few optional features — requesting a game, subscribing to the newsletter, and getting a free API token — ask for your email address; apart from those, the limited data described below is collected automatically or by the third-party services we use.

1. Information we collect

Information you give us. GachaData has no user accounts. Three optional features ask for your email address: requesting a game (optional, so we can tell you if it goes live), subscribing to the newsletter, and registering for a free API token. We use each email only for the purpose you provided it for — to notify you, to send newsletter updates, or to deliver and manage your API token — and you can ask us to remove it at any time (see “Your choices”). We do not sell email addresses or use them for unrelated marketing. We do not collect names or payment information through the website; Pro billing is handled entirely by Patreon under its own policy.

Information collected automatically. As with most websites, our hosting provider and the third-party services listed below may automatically receive technical information — such as your IP address, browser type and version, device and operating system, referring page, and the pages you view — for the purposes of serving the site, security, analytics and advertising.

Who processes this data for us. We use the following providers, and each receives only what its job needs:

• Cloudflare — hosting, CDN, cookieless Web Analytics, Turnstile anti-abuse, and the Workers KV storage that holds newsletter subscriptions, API tokens and game-request notification records.
• GitHub (GitHub, Inc.) — when you submit the game-request form, the game name, your notes and, if you supplied one, your email address are filed as an issue in a private repository that only the operator can read. That issue is our request tracker.
• Resend (Plus Five Five, Inc.) — delivery of the emails we send you: your API token, and newsletter messages if you subscribed. Resend processes the recipient address and the message in order to deliver it.
• Google — AdSense advertising, as described below, and Search Console verification.
• Patreon — membership and billing for the Pro tier, under its own policy. We never receive your payment details.

2. Controller, lawful bases, retention and your rights

Controller. GachaData is an independent project run by one operator. The operator acts as the controller for the processing described in this Policy and can be reached at the contact address below. Contact: contact@gacha-data.com.

Why we process, and on what basis.

• Serving the site and keeping it available (technical request data, security, abuse prevention, rate limiting) — our legitimate interest in operating and protecting the Service.
• Aggregate, cookieless traffic measurement (Cloudflare Web Analytics) — our legitimate interest in understanding which pages are used. No individual profile is built and no cross-site tracking takes place.
• Game requests, the newsletter, and API tokens (the email address you choose to give) — your consent for the newsletter, and performance of the service you asked for in the case of a request notification or an API token. You may withdraw consent at any time; withdrawing it does not affect processing already carried out.
• Advertising — your consent, collected through a consent management platform before any advertising or measurement technology is loaded. Where no consent is given, no such technology is loaded.

How long we keep it. An email address given with a game request is stored in two places. The notification record (game plus email) expires automatically 180 days after you submit it, whether or not we have got to your request. The request ticket is the private GitHub issue described above; it stays in the tracker after the request is answered and closed, so that we have a record of what was asked for, and is deleted if you ask us to. Newsletter addresses are kept until you unsubscribe; an API token and its associated email for as long as the token is active, and deleted on request. Operational logs used for rate limiting and abuse prevention are short-lived and retained no longer than needed for that purpose. Aggregate analytics contain no personal identifiers.

Your rights. Where the GDPR or UK GDPR applies to you, you have the right to access your personal data, to have it rectified or erased, to restrict or object to its processing, to data portability, and to withdraw consent at any time. Exercise any of these by writing to contact@gacha-data.com — we do not require an account to act on a request. You also have the right to lodge a complaint with your local data protection supervisory authority.

Automated decision-making. We do not carry out automated decision-making or profiling that produces legal or similarly significant effects.

3. Cookies and local storage

GachaData does not set any cookies of its own. Your site preferences (such as theme and language) are stored locally in your browser using localStorage, which stays on your device and is never sent to us — it is not a cookie. Our Cloudflare Web Analytics is cookieless. The only cookies on this site are those set by Google AdSense (see “Advertising” below); for visitors from the EEA, the United Kingdom or Switzerland, only after you consent to them. You can control or delete cookies through your browser settings; disabling them may affect some functionality.

4. Analytics and anti-abuse

We use Cloudflare Web Analytics, a privacy-first analytics service that measures aggregate traffic (such as page views and referrers) without using cookies and without tracking individuals across sites. Forms on this site (requesting a game, the newsletter, and API-token registration) are protected by Cloudflare Turnstile, a privacy-preserving alternative to a CAPTCHA; to tell a person from a bot it receives technical signals such as your IP address and browser characteristics. It does not track you across sites. See Cloudflare’s privacy documentation at cloudflare.com/privacypolicy for details.

5. Advertising (Google AdSense)

Consent for advertising is collected through Google’s certified consent management platform (the consent message shown on your first visit from the EEA, the United Kingdom or Switzerland; IAB Transparency & Consent Framework v2.2). No advertising or measurement technology runs before you answer it, and you can change your answer at any time via Privacy and cookie settings.

We display advertising through Google AdSense. Google and its partners may use cookies and similar technologies to serve ads based on your prior visits to this and other websites, and may collect and process data as described in Google’s policies. Third-party vendors, including Google, use the DoubleClick cookie to serve ads based on your visits to this and other sites. You can review and opt out of personalised Google advertising at adssettings.google.com, learn about third-party ad vendors at aboutads.info, and read how Google uses data at policies.google.com/technologies/partner-sites.

6. The API

Using the API requires an access token. To obtain a 無料トークン you provide an email address; we use it to deliver the token, to enforce our one-token-per-email limit, and to contact you about the token if needed. We store the token together with that email and the IP address it was created from, and we log request metadata (such as IP address and timestamps) in order to enforce rate limits and per-network caps, prevent abuse and keep the Service running. Pro tokens are linked to your Patreon membership. You can ask us to delete your token and its associated email at any time (see “Your choices”).

7. Third-party links

The Service links to third-party websites and resources. Their privacy practices are governed by their own policies, not this one.

8. Children’s privacy

The Service is intended for a general audience and is not directed to children under 13 (or the minimum age required in your jurisdiction). We do not knowingly collect personal information from children.

9. Your choices

You can disable or delete cookies in your browser, opt out of personalised ads via the links above, and clear the local preferences the site stores. To stop newsletter emails, use the unsubscribe link in any newsletter message; to delete an email address or API token you gave us, contact us at contact@gacha-data.com. Many browsers offer a “Do Not Track” signal; because there is no common standard for how it should be handled, the Service does not currently respond to it differently.

10. International users

The Service may be operated from, and its providers may process data in, various countries. By using the Service you understand that technical data may be processed outside your country. Where required, the third-party providers named above offer their own mechanisms for data-subject rights (such as access or deletion); please use those providers’ tools.

11. Changes

We may update this Policy from time to time; the “Last updated” date above reflects the current version.

12. Contact

Questions about this Policy: contact@gacha-data.com.