Privacy Policy

Last updated: 22 September 2026 · Information pursuant to Art. 13 / 14 GDPR

1. Controller

The controller responsible for data processing on this website within the meaning of the GDPR is:

2. Hosting & server log files

This website is hosted and delivered via Cloudflare (Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA), acting as our processor under Art. 28 GDPR. When you access the site, Cloudflare automatically processes technical access data that your browser transmits, in so called server log files:

• IP address
• date and time of the request
• page / file requested
• referring page (referrer), if transmitted
• browser type, browser version and operating system

This processing is technically necessary to deliver the website and to ensure its stability and security (e.g. defence against attacks). Legal basis: Art. 6 (1)(f) GDPR (legitimate interest in the secure and reliable operation of the site).

Transfer to a third country: Cloudflare is a US provider, so data may be processed in the USA. The transfer is safeguarded by a data processing agreement including the EU Standard Contractual Clauses; Cloudflare is also self-certified under the EU–U.S. Data Privacy Framework. You can find Cloudflare's privacy policy at cloudflare.com/privacypolicy.

3. Cookies & tracking

This website itself sets no cookies, no local storage for tracking purposes and no analytics, statistics or audience-measurement tools (no Google Analytics, no Matomo, no pixels). No usage profiles are created.

For security and bot mitigation, our host Cloudflare may set a strictly necessary cookie (e.g. __cf_bm). It is used solely to tell humans and bots apart and does not serve advertising or cross-site tracking; under § 25 (2) TDDDG such strictly necessary cookies do not require consent.

4. Fonts, scripts and images

The font (Archivo), all stylesheets, all scripts and all images and icons are delivered exclusively from this server. There is no connection to Google Fonts, to any CDN or to any other external service, so no personal data is transmitted to third parties while the page loads. A Content Security Policy sent with every page additionally instructs your browser to block any request to a third-party server, so this cannot happen even by mistake.

5. Discord member count & live deal lists

The join section may display the current number of members in our Discord server. This number is retrieved on our side, not in your browser: an automated job periodically asks Discord for the public invite figures and stores the result as a small file on this server. Your browser only ever loads that file from freegamesandbundles.org and never contacts Discord, so your IP address is not transmitted to Discord when you view this page. Only if you click a “Join the Discord” link does a connection to Discord take place, at which point the Discord privacy policy applies (see section 7).

The same applies to the lists of current bundles and free games on this site. They are compiled by the same kind of automated job on our side and published as plain pages on this server. Your browser does not contact the stores, their APIs or their image servers when you view them; product images are deliberately not shown for this reason.

6. Affiliate links

This website contains affiliate / partner links to shops and platforms (including Fanatical and Humble Bundle). If you click such a link and visit the target site, the respective provider may process data (e.g. set cookies or store a partner identifier) in order to attribute a purchase referred through us. This processing takes place under the respective provider's own responsibility and is governed by their privacy policy. We may receive a commission; there is no additional cost to you. Legal basis for setting the link: Art. 6 (1)(f) GDPR (legitimate interest in financing the service).

7. External links (Discord & stores)

Via the “Join the Discord” buttons and the store links you are forwarded to external services. As soon as you open those pages, only their privacy policies apply, in particular the Discord privacy policy. We have no influence over the access to or the content of those pages.

8. Contacting us by email

If you contact us by email, we process the data you provide (email address, content of your message) solely to handle your request. Legal basis: Art. 6 (1)(f) or (b) GDPR. The data is deleted once it is no longer required for processing and no statutory retention obligations apply.

9. Your rights

You have the following rights regarding your personal data vis-à-vis the controller:

• access (Art. 15 GDPR)
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection to processing (Art. 21 GDPR)

You also have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data (Art. 77 GDPR).

10. SSL/TLS encryption

For security reasons this site uses TLS encryption (recognisable by “https://” and the padlock icon in your browser's address bar). This protects the data transmitted between your browser and the server from being read by third parties.