Your data, plainly explained
Last updated: 23 October 2026
This policy explains what personal data TopRankinGames collects, why, who we share it with and what your rights are. We have tried to keep it short and plain. If anything is unclear, email us at [email protected].
TopRankinGames (toprankingames.com) is run by Cool Monkey Studios Ltd, a company registered in England & Wales (company no. 15481762). Our registered office is 30b Wild’s Rents, London SE1 4QG. We are registered with the UK Information Commissioner’s Office (ICO) under number CSN2843278.
We are the “controller” of the personal data described here. For any privacy question or request, contact [email protected].
Voting is open to everyone and doesn’t need an account. When you vote, we record:
A keyed hash is a one-way code made with a secret key that only we hold. It lets us see that two votes came from the same connection without storing the IP address itself. Because we hold the key, this is still personal data, and we treat it that way.
Why: to allow one vote per person per game every 12 hours, to spot and remove fake votes, and to keep the rankings fair. Our lawful basis is legitimate interests: running honest rankings and protecting the site from fraud and abuse.
The vote page also checks you are a real person with Cloudflare Turnstile. To do this, your browser talks to Cloudflare, and we send Cloudflare your IP address with the check result. We also count attempts per connection for a few minutes so we can slow down floods of votes.
Some games send you to us with a player code in the link. After a counted vote, our server tells the game about it in a signed message. That message contains the game’s name, a vote number, the player code the game gave us, the time of the vote and a one-time security code. It does not contain your IP address, country or any other information about you.
The game uses the code to give you your reward. The game is responsible for how it uses its own player codes, under its own privacy policy. Our lawful basis is legitimate interests: delivering the reward you voted for. We keep the delivery record, including the player code, for 30 days so we can retry failed deliveries and help game owners fix problems.
Game pages, owner dashboards and our public Statistics page only show totals. Countries are only named once they reach a minimum number of votes; smaller numbers are grouped as “Other”. Game owners can see the time, country and status of the last 100 votes for their own game, but never IP addresses, hashes or anything else that identifies a voter.
Like every website, our servers and Cloudflare receive your IP address, browser details and the pages you ask for. We use this to deliver the site and keep it secure. We count one listing view and one “player sent to us” per visitor, per game, per day using a short-lived keyed hash that expires within a day. Our lawful basis is legitimate interests: running a secure, working website.
If you click a sponsored ad or partner banner, we store a keyed hash of your IP address and browser details for 2 days so we can count each click only once. Advertisers only see totals (views, clicks and click rate).
To list a game or buy an ad you need an account. We collect:
Your username and email are never shown publicly. Your games and their content are public once approved.
Why: to run your account and listings, contact you about them and enforce our terms and rules. Our lawful basis is contract (providing the service you signed up for) and, for moderation and fraud records, legitimate interests.
When you log in, WordPress keeps a login session that records your IP address and browser, so you can see and end your sessions. Sessions last up to 14 days (4 hours for staff). After 10 failed log-ins from one connection, log-ins are paused for 15 minutes; we note the event and the username that was tried.
When you book an ad, we store the booking: what the ad is for (your game or the brand name you give us), the slot and dates, the image, alt text and link, the price, its status and the PayPal order, payment and refund reference numbers. When you subscribe to the verified-owner badge, we store the PayPal subscription number and its status. To verify your domain, you can ask us to email a link to an address at your game’s domain; we store that address and when we sent the link.
PayPal processes the payment. Card fields on our payment page are hosted by PayPal, so we never see or store your card number, and we don’t receive your billing address. PayPal acts as its own controller for payment data, under PayPal’s privacy statement.
Our lawful basis is contract, and legal obligation for the payment records we must keep for tax.
We email account holders about things that affect them: your listing was approved, rejected or changed; your ad was received, approved or refunded; your game won a place or a crown; your verified-owner badge needs attention; your account was warned, suspended, banned or restored; and the usual WordPress emails such as password resets. Staff accounts also get security alerts, for example when an administrator logs in from a new network. We don’t send newsletters or marketing emails.
If you use our contact form or email us, we receive your name, email address and message, and use them to reply. Our lawful basis is legitimate interests: answering you.
If you agree in the cookie banner, we use Google Analytics 4 to understand how people use the site, for example which pages are popular. We use Google Consent Mode: if you say no, Google Analytics doesn’t set its cookies. Our lawful basis is your consent, and you can change your mind at any time.
When ads from Google are shown on the site, Google and its partners use cookies to show ads, limit how often you see them, measure them and prevent fraud. Ads are only personalised to your interests if you agree. You can manage Google’s ad personalisation at My Ad Center and read how Google uses information from sites that use its services. We never show ads on the vote page.
See our cookie policy for the full list of cookies.
We don’t sell your personal data. We share it only with the service providers below, who act on our instructions, and with the parties described next.
| Provider | What they do for us |
|---|---|
| IONOS | Hosts our website and database in a UK/EU data centre. |
| Cloudflare | Delivers the site quickly and securely (CDN), blocks attacks, runs the Turnstile human check, and tells us your country and network number. |
| Google (Analytics 4, Site Kit) | Website statistics, only with your consent. |
| Google (AdSense) | Ads, when ads from Google are shown. Personalised only with your consent. |
| Elementor | Builds our pages, runs the contact form and cookie banner, and sends the site’s emails through its Site Mailer service. |
| Microsoft (Microsoft 365) | Hosts our support mailbox, so emails you send us are stored there. |
| PayPal | Takes payments for ads and badge subscriptions (as its own controller for payment data). |
We also share:
Our site and database are hosted in the UK/EU. Some providers (Cloudflare, Google and PayPal) process data in other countries, including the United States, and Elementor is based in Israel. When data leaves the UK or the European Economic Area, we rely on adequacy decisions (for example for Israel, and for US companies certified under the EU-US Data Privacy Framework and its UK extension) or on the standard contract terms approved by the UK and EU authorities.
| Data | How long |
|---|---|
| Vote records (hashes, country, network, time, status) | 13 months, then deleted. Totals with no personal data are kept. |
| Callback delivery records (including the player code) | 30 days |
| Ad click records (hash) | 2 days |
| Short-term counters (vote limits, log-in pauses, daily view counts) | From a few minutes up to 1 day |
| Security log entries (failed log-ins, blocked vote floods, new-network log-ins) | 30 days |
| Log-in sessions | Until you log out or the session ends (up to 14 days) |
| Accounts and listings | While your account is open. Ask us and we’ll delete it. |
| Warnings, suspensions, bans and appeals | While the account exists and for 2 years after it closes, so banned owners can’t simply start again |
| Domain verification email address | Until your domain is verified, or 30 days after we send the link |
| Ad bookings, payments and refunds | 6 years, as UK tax law requires |
| Contact form messages and emails | 2 years after our last contact |
| Google Analytics data | 14 months |
Hall of Fame plaques and winner badges record a game’s name, month and votes permanently. They don’t contain personal data about players.
Under UK and EU data protection law you can:
To use any of these rights, email [email protected]. We’ll reply within one month. Please note that we store votes only as hashes, so we usually can’t find your votes unless you give us enough detail (for example the player code your game used and roughly when you voted).
If you’re unhappy with how we handle your data, please tell us first. You also have the right to complain to the UK Information Commissioner’s Office at ico.org.uk (0303 123 1113), or, if you live in the EU, to the data protection authority in your country.
We use HTTPS everywhere, keyed hashes instead of IP addresses, signed callbacks, two-step log-in and strong passwords for staff, log-in limits and Cloudflare’s protection. No system is perfectly secure, but we work to keep your data safe and will tell you and the ICO if a breach puts you at risk.
TopRankinGames is not aimed at children. You must be 18 or over to create an account. Anyone can vote without an account, and we don’t knowingly collect more than the vote data described above from anyone under 18. Some listed games are for adults only and are clearly labelled 18+. If you think someone under 18 has created an account, tell us and we’ll delete it.
We’ll update this page when our practices change and change the date at the top. If a change is significant, we’ll tell account holders by email before it takes effect.
Cool Monkey Studios Ltd, 30b Wild’s Rents, London SE1 4QG, United Kingdom. Email: [email protected].
See also our cookie policy and terms of use.
