xploitr Privacy Policy

Last updated: October 28, 2026

This policy explains what information xploitr collects, why, and the choices you have. It applies to everyone who visits or uses xploitr.fyi, wherever you are. Near the end there are short sections with extra details for people in the United States (including California), Canada, and the EU/EEA and UK.

Shared links

When you open a page, we count that visit on our own server. A page counts as viewed only after it has been open and visible for about a second: a small script of ours, part of the site itself, then tells our server the page path, the xploitr page you came from if you clicked through from one, whether you arrived from another site (just that site's name, such as google.com) or moved within xploitr, the referral code if the link had one, and whether the browser says it is being driven by automation software. It sends nothing else and stores nothing in your browser. So we can count people rather than robots, our server uses your IP address and the technical headers your browser sends with that message (such as its browser name and language) to check that it comes from a real browser and not from a data center, a crawler or a script, and then discards them; only the results below are kept.

An issue page view that passes that check is counted with a salted hash of the IP address (not the address itself), the issue and the day, so the same address is only counted once that day. For the Trending spot on the home page we also keep the same hash with the issue and the time of your latest view of it, for 8 hours, then delete it. Neither count includes your browser.

If the link includes a referral code (a short code in the address, written s), we add that code to a separate count of the visit. A code we recognize is stored as a name for that kind of link. Any other short code is stored as it was written, and anything that isn't a short code is stored as "unknown". That count is only the code and a total. It is not tied to your IP address or your browser, and it is not saved in a cookie or anywhere else in your browser. After the visit is counted, the code is removed from the address bar, so a link you copy doesn't carry it.

We don't use tracking cookies. These counts are used only for aggregate traffic stats, such as which pages are viewed and which shared links people follow. The total stays in our own database. We also send our logging provider, for each counted page view, the page path and type, the time, the referral code's name if there was one, the kind of site you came from (search, social, direct or the site's name), whether it was the first page of your visit and, if you clicked through from another xploitr page, that page's path, whether your device is a phone, tablet or computer, and a visitor number. The visitor number is a salted hash of your IP address and browser for that day only, so it changes every day and can't be turned back into either. Nothing else about you goes with it: no IP address, no browser details, and no cookie. A view that fails the check is sent only as a reason (for example "data center") and a page type. We don't use a third-party analytics script in the browser.

Questions about privacy: xploitrceo@gmail.com.

At a glance

1. Who we are

xploitr.fyi ("xploitr", "we", "us") is an independent site that tracks publicly known issues in online games. It is run by an individual operator, not a company, and that operator is responsible for your information (the "controller" under some privacy laws). To contact the operator directly, email xploitrceo@gmail.com.

For questions about this policy, complaints, and all privacy or data requests, please email support@xploitr.fyi.

2. Information we collect

Information you give us

• Account details: when you create an account, we collect your email address, the username you choose (which is public), and your password, which we store only in a protected, hashed form. If you sign in with Google, Google shares basic account information with us, such as your Google account ID and email address. We store the sign-in tokens Google gives us in encrypted form, and we don't keep your Google profile photo.
• What you post and send: comments, votes on comments (up or down), status suggestions, issue submissions, reports and similar contributions, plus any messages you send us. Some of this is public, and some is seen only by the people who run the site (for example suggestions, submissions and reports while they're reviewed). Next to each comment, the public can see the commenter's username, join month and number of accepted reports. If a suggestion or submission of yours is published, the issue update can show a credit with your username (for example "Reported by @username"). Status suggestions are always credited; for issue submissions you can opt out when you submit.
• Community features: community features (status suggestions, issue submissions, comments, votes on comments and reports) need a signed-in account with a verified email that is at least 24 hours old. In some countries the wait doesn't apply to posting comments.
• Email alerts (optional): email alerts are off unless you turn them on. If you do, we store whether alerts are on, which games and single issues you follow, the issue types and changes you chose, and a record of the alerts sent to you. Alerts go only to your account's verified email address. They're only about published issues in the games and issues you follow, never about activity on the site, and they don't include your username or other account details. If an alert can't be delivered or is reported as spam, we stop sending alerts to that address and keep a scrambled (hashed) form of it, not the address itself, so we don't email it again.

Information collected automatically

• Technical and security data: like most websites, our servers receive your IP address, browser type, the pages you request, the referring page and the time of each request. We use this to keep the site working, keep accounts secure (for example to recognize sign-ins from new browsers) and prevent abuse such as spam.
• Sign-in and security records: we store your IP address and browser details with your sign-in sessions (up to 30 days) and with browsers you've chosen to trust (up to 60 days). We also use your IP for rate limits (records deleted within about a day). New-device emails include the browser and IP address of the sign-in.
• Approximate location: we may look up your approximate country from your IP address, using a location database stored on our own server, so your IP address isn't sent to anyone for this. We use the country only for site rules such as anti-spam measures, and we don't store it.
• View counts: a page counts as viewed once it has been visible for about a second and our server has checked that the view comes from a real browser and not from a data center or a robot (see "Shared links" above). We count how often issues are viewed using short-lived, one-way hashed data rather than your raw IP address. When a link includes a referral code, we also add one to a separate total for that code. That total is only the code and a number. It isn't tied to your address, and it isn't kept in your browser. Each counted page view is sent to our logging provider with the details listed under Shared links, without your IP address or browser. See "Shared links" above.

Information from public sources
To document issues, we may quote public posts about the games (for example from social media or game forums). Issue pages show public source details for the posts we cite, such as the author's handle or name, dates and a short quote. We may store public follower and engagement counts for cited posts to help rank sources; these aren't displayed. If you'd like your handle or a quote removed, email support@xploitr.fyi.

What we don't collect
We don't use third-party analytics scripts, tracking scripts or tracking pixels. The only measuring script is our own page-view count described under Shared links, which follows no one across sites or days. Ads we host ourselves are an image and a link, labeled Sponsored, and don't set an advertising cookie or load a third-party script. If we show ads from a third-party ad network, that network's script loads only after you allow it, and never on sign-in, account, notification, unsubscribe, privacy, terms, submit or admin pages. Once you allow it, the network receives your IP address and browser details and may set its own cookies, under its own privacy policy. We work out traffic and usage (such as page views, popular issues and which sites send visitors to us) from our own server logs, described in section 6, from the referral counts described under Shared links, and from the page-view events we send our logging provider (described under Shared links; no IP address, browser details or cookie). We don't ask for sensitive information such as health or financial details, so please don't include any in what you post.

3. How we use information

We use information to:

• create and run your account, sign you in and keep it secure
• send account and security messages, such as email verification, password reset and new sign-in codes (we don't send marketing emails)
• if you turn them on, send email alerts about published issues in the games and issues you follow (these are not marketing; each one has a one-click unsubscribe link)
• show and run community features, and review suggestions and submissions
• moderate content and keep the community safe, including automated filters and review by the people who run the site
• operate, troubleshoot, protect and improve the site, including measuring traffic and usage from our server logs
• comply with the law and respond to valid legal requests

We don't use your account details or your activity on xploitr to choose ads. If you allow third-party ads, the ad network may use its own cookies to measure and choose the ads it shows you. We don't make decisions with legal or similarly significant effects about you by automated means alone.

4. How we share information

We don't sell your personal information. We don't share it for targeted (cross-context behavioral) advertising unless you allow third-party ads, as described below. We share information only:

• Publicly, by design: what you choose to post publicly, along with your username.
• With service providers: we use trusted service providers for hosting, email delivery, sign-in (Google), log storage, and code and image hosting. They may process data in the United States, the EU or other countries.
• With embedded content you choose to open: some issue pages can show posts from third-party platforms such as X. Nothing loads from these platforms until you choose to open the post. When you do, that platform receives your IP address and browser details and may set its own cookies, under its own privacy policy.
• With an ad network, if you allow ads: when we show ads from a third-party network and you allow them, the network receives your IP address and browser details to show and measure a gaming ad, and may set its own cookies. If you don't allow it, nothing is shared with an ad network.
• For legal reasons: to comply with law or valid legal process, or to protect the rights, safety or property of our users, the public or xploitr.
• If the site changes hands: if xploitr is transferred to someone else, your information may go with it, under this policy or one that protects it at least as well.

5. Cookies

We use only cookies that are needed to sign you in and keep your account secure. Browsing the site while signed out doesn't set any cookies of ours. Some cookies, such as ones that protect Google sign-in and hold your email address while you verify it, are set once you start signing in or signing up. We don't use analytics cookies, and we don't set advertising cookies ourselves. If you allow third-party ads, the ad network may set its own advertising cookies. You can refuse that from the ad notice on the page, and you can reset your choice by clearing this site's data in your browser. A referral code in a link is not a cookie: our page-view script reads it from the address, sends it with the page view, and doesn't save it in your browser. If that changes, we'll update this policy and ask for your consent where the law requires it.

We don't sell your information or track you across sites ourselves. Third-party ad cookies are used only if you choose Allow on the ad notice, so choosing No thanks (or never choosing Allow) keeps them off.

6. How long we keep information

We keep information only as long as we need it for the purposes described in this policy, then delete or anonymize it. For example:

• account information is kept while your account is open. To delete your account, email support@xploitr.fyi, ideally from the address on your account. We then delete your email address, username, profile photo, password, Google sign-in link, sessions, trusted browsers, two-factor settings, notifications, notification settings, followed issues, email alert settings and the games and issues you follow for alerts, plus any status suggestions or issue submissions that haven't been published, and the private notes on ones that have.
• when your account is deleted, what you contributed stays, but it's anonymized and no longer linked to you: your comments stay and show "[deleted user]" instead of your username (earlier versions of edited comments are deleted), published suggestions and submissions stay without your name, your votes on comments and reports you made about comments still count without your name, and published credits and quotes in issue updates (such as "Reported by @username") say "a deleted user" instead. We keep an empty account record with no personal details so those contributions still have something to point to. You can sign up again later with the same email address or Google account; it will be a new account. The words of your comments and quotes stay as written, so if they mention you, you can ask us to edit or remove them. Logs and backups that already hold your information are deleted on the schedule below
• server access logs (IP address, browser, page, referrer and time), error logs, and page-view and referral events (described under Shared links) are kept for up to 30 days by us and our logging provider, then deleted
• sign-in sessions are kept for up to 30 days, trusted browsers for up to 60 days, and rate-limit records are deleted within about a day
• email alert settings are kept while your account is open and deleted with it; records of the alerts sent to you are deleted after about 30 days. The hashed form of an address we've stopped alerting after a bounce or spam report isn't linked to your account and is kept so we keep not emailing it; email support@xploitr.fyi if you'd like it removed. Unsubscribe links in alert emails stop working after 180 days
• moderation records and the research notes behind issue pages are kept as long as needed to run and protect the site
• we make an encrypted backup of the database once a week and keep the 8 most recent, so about 2 months. A backup may still hold information that has since been deleted or anonymized, including after you delete your account, until it is replaced

We may keep some information longer if the law requires it, or to handle a dispute or legal claim.

7. Security

We use reasonable measures to protect your information, such as encrypted (HTTPS) connections, hashed passwords, rate limits and restricted access. No system is perfectly secure, though. If a breach affects you, we'll notify you as the law requires.

8. Your choices and rights

In your account settings, you can change your username, manage two-factor authentication, sign out other devices, and manage notifications and email alerts. Every alert email also has an unsubscribe link that works without signing in. You can also edit or delete your own comments.

For anything else, including deleting your account, getting a copy of your data or correcting it, email support@xploitr.fyi, ideally from the email address on your account. We may need to verify your identity first. We'll respond within the time the law requires, and we won't treat you differently for using your rights. You can make these requests wherever you live; the sections below describe extra rights in some places.

9. United States and California

If you live in California, the California Consumer Privacy Act (CCPA) and the California Online Privacy Protection Act (CalOPPA) give you rights, and other US states have similar laws.

• Categories we collect: identifiers (such as email, username and IP address), internet activity (such as pages requested and browser details), account log-in details, and content you post. Section 2 describes the sources and section 3 the purposes. We use account log-in details only to sign you in and keep your account secure.
• Selling and sharing: we don't sell your personal information, and we haven't done so in the past 12 months. If you allow third-party ads, the ad network may use cookies for cross-context behavioral advertising, which California law calls sharing. You can refuse or withdraw that from the ad notice and still use the site. We don't knowingly sell or share information about people under 16.
• Your rights: you can ask to know or access, delete or correct your personal information, and you won't be discriminated against for doing so. You or an authorized agent can make a request at support@xploitr.fyi. If we turn down a request, you can ask us to reconsider by replying to our answer.
• CalOPPA: this policy explains what we collect and who we share it with (sections 2 and 4), how to review and change your information (section 8), how we handle Do Not Track (section 5), and how we announce changes (section 13).
• Shine the Light: we don't share personal information with third parties for their own direct marketing.

10. Canada

We handle personal information of people in Canada in line with the Personal Information Protection and Electronic Documents Act (PIPEDA) and its fair information principles.

• Consent: by using xploitr and creating an account, you consent to the uses in this policy. You can withdraw consent by asking us to delete your account.
• Access and correction: email support@xploitr.fyi to see or correct the information we hold about you.
• Accountability: the operator is responsible for privacy at xploitr.
• Storage outside Canada: your information may be processed in the United States or other countries, where authorities may be able to access it under local law.
• Complaints: if you're not satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada (priv.gc.ca).

11. EU/EEA and UK

If you're in the EU/EEA or the UK, the GDPR or UK GDPR applies.

• Legal bases: we use your information to provide the service you signed up for (contract); for security, preventing abuse, moderation, sourcing issues and running the site (our legitimate interests, balanced against your rights); to meet legal duties (legal obligation); and with your consent, which you can withdraw at any time. Third-party ad scripts and their cookies load only with your consent, given on the ad notice; withdrawing it stops the script on later pages, and you can remove cookies already set with your browser's controls.
• Your rights: you can ask to access, correct, delete or restrict your information, receive a portable copy, and object to our use of it based on legitimate interests. Email support@xploitr.fyi. We'll normally reply within one month.
• International transfers: your information may be transferred to and processed in countries outside the EU/EEA and UK, including the United States. Where required, we rely on appropriate safeguards for international transfers.
• Complaints: please contact us first so we can try to help. You also have the right to complain to a data protection supervisory authority, such as the authority where you live or work, or, in the UK, the Information Commissioner's Office (ico.org.uk).

12. Children

xploitr isn't directed to children. You must be at least 13 years old, or the minimum age required in your country if that's higher (for example 16 in some EEA countries), to create an account. We don't knowingly collect personal information from children below that age. If we learn that we have, we'll delete it. If you believe a child has given us personal information, please email support@xploitr.fyi.

13. Changes to this policy

We may update this policy from time to time. When we do, we'll change the "Last updated" date at the top, and for significant changes we'll post a notice on the site before they take effect.

14. Contact

Questions, complaints and all privacy or data requests: support@xploitr.fyi