Privacy
What this website does with your data, in plain words. Last updated 12 November 2026.
Your answer about browser storage: not given yet.
1. Who is responsible
Arjhun Swaminathan is responsible for this website (the "controller" under the GDPR).
Contact: hi@arjhun.com
2. The short version
- No cookies of this website's own. Cloudflare, the host, sets one security cookie to keep out bots (section 3). No analytics or tracking tools. No ads. No social media plugins.
- Fonts and images come from this website itself. Your browser does not contact Google or any other outside service while you read it, unless you choose "Full experience", which loads film posters from TMDB (section 8).
- Your browser only stores something if you say yes. The question comes up the first time you play gully cricket.
- The counters on the fun page only keep totals, like "the sailor was caught 312 times". Nothing records who did what.
- This website does not store IP addresses. Cloudflare, the host, processes them to deliver the pages (section 3).
3. Hosting
The website runs on Cloudflare (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). When you open a page, your browser sends your IP address and some technical details, such as the page asked for, the time, and your browser type. Cloudflare needs these to deliver the page and to protect the site against attacks.
Cloudflare processes this data on behalf of this website under a data processing agreement. Cloudflare is certified under the EU-US Data Privacy Framework, so transfers to the USA rest on the adequacy decision of the European Commission (Article 45 GDPR).
How long Cloudflare keeps these logs is set out in Cloudflare's privacy policy. This website does not keep them.
To tell people apart from automated bots, Cloudflare adds a small script to every page. It checks your browser in the background and sends the result to Cloudflare. If the check passes, Cloudflare sets one cookie:
| Name | Set by | What it is for | How long |
|---|---|---|---|
cf_clearance | Cloudflare | Shows that this browser already passed the bot check, so it is not checked again on every page. It holds an encrypted token, not your name or any account. | One year |
This cookie does not need your consent, because it is strictly needed to protect the website against attacks and automated abuse (section 25(2) no. 2 TDDDG). It is not used for advertising or to follow you across other websites. You can delete it at any time in your browser settings; the check then simply runs again.
Legal basis: Article 6(1)(f) GDPR. The legitimate interest is delivering the website safely.
4. Counters on the fun page
The receipt on the fun page shows totals for all visitors together: visits to any page of this website, countries, jukebox shuffles, times the sailor was caught, times someone got rickrolled, punches, runs scored in gully cricket, and balls the dog ran off with. When you do one of these things, your browser tells the server to add one (or the runs) to that total.
Only the totals are kept, for as long as the site runs. There is no visitor ID and no list of visits. For visits, the server also adds one to "phone" or "computer", worked out from the request your browser sends anyway, and adds your country to a list of countries if it is not there yet. The country comes from Cloudflare as a two-letter code and is never linked to you or to a visit.
Legal basis: Article 6(1)(f) GDPR. The legitimate interest is showing the shared numbers on the fun page.
5. Gully cricket leaderboard
If you get into the top ten and choose to save your score, the site stores the two or three letters you type, your score, the number of balls, and the flag you picked. No date or time is stored. An entry is kept for as long as it stays among the best fifty scores, and is deleted when it drops out. Please do not use your real initials if you would rather not. To have an entry deleted, write to the contact in section 1 with the letters, the score and roughly when you played.
The bowling figures (overs, runs and wickets per bowler) are added up across all games. They contain nothing about you.
To stop the leaderboard and the counters being flooded, Cloudflare counts how many requests arrive from the same connection within one minute. This count is kept in memory only and is never written to the database; the IP address is not stored.
Legal basis: Article 6(1)(b) GDPR for the leaderboard entry, because you ask for it to be shown. Article 6(1)(f) GDPR for the flood protection; the legitimate interest is keeping the leaderboard and counters usable.
The database keeps a restore history for up to 30 days. A deleted entry can therefore stay in that history for up to 30 days before it is gone for good.
6. Email
If you write to hi@arjhun.com, your email arrives in my Proton Mail inbox (Proton AG, Switzerland, a country with an adequacy decision of the European Commission). It stays there until I delete it, at the latest when our conversation is over.
Legal basis: Article 6(1)(f) GDPR, the legitimate interest in answering messages; Article 6(1)(b) GDPR where you write about working together.
7. Storage in your browser
Gully cricket can keep three small notes in your browser's local storage. This is not a cookie, but the law treats it the same way: it needs your consent (section 25(1) of the German TDDDG, and Article 6(1)(a) GDPR). The question comes up the first time you start the game, and nothing is written unless you say yes.
| Name | What it remembers |
|---|---|
gully-best | Your own best cricket score |
gully-country | The flag you picked for the leaderboard |
gully-initials | The initials you last saved, so the next score is quicker to save |
If you say yes, the notes stay until you say no or clear your browser data. If you say no, they stay in memory for the open page only and disappear when you leave. Saying no also deletes anything stored before.
One entry is always stored: consent, your yes or no, so the question does not come back on every page. This is allowed without consent because it is strictly needed (section 25(2) TDDDG). It stays until you clear your browser data.
You can change your answer at any time with the buttons at the top of this page. Saying no later does not make earlier storage unlawful.
Cloudflare's security cookie is not part of this choice; it is described in section 3.
8. Links to other websites
The site links to YouTube, Spotify, Apple Music, BoardGameGeek, LinkedIn and others. Nothing is loaded from them until you click a link. The fake ads and the fake captcha on the fun page also open a YouTube video in a new tab when clicked. The wallet on the fun page links to my Ko-fi page for tips; Ko-fi only comes into play if you click it, and then its own privacy policy applies. After that, their own privacy policies apply.
Film and series posters. Before the fun page opens, you choose between "Full experience" and "Data saver experience". Only with "Full experience", which says so on its button, does your browser load the posters in "Now showing" and "Now streaming" from TMDB (The Movie Database). TMDB then receives your IP address and the usual technical details of a request. With "Data saver experience", or if you open the fun page directly, you see plain title cards and nothing is loaded from TMDB. Legal basis: Article 6(1)(a) GDPR, your choice. See TMDB's privacy policy.
9. Do you have to give any data?
Your IP address and the technical details in section 3 are needed to deliver the pages at all; without them the site cannot be shown. Everything else is optional: you can play without saving a score, and say no to browser storage.
10. Your rights
You have the right to access your data (Article 15 GDPR), to have it corrected (16), deleted (17) or restricted (18), and to receive it in a portable format (20). You can withdraw consent at any time (Article 7(3)). Write to the contact in section 1.
Right to object (Article 21 GDPR): where processing rests on legitimate interest (Article 6(1)(f)), you can object to it at any time for reasons arising from your particular situation.
You also have the right to complain to a data protection supervisory authority, for example the one where you live or work (Article 77 GDPR).
No automated decisions or profiling take place.