GULF GAMBIT — COOKIE AND LOCAL STORAGE POLICY

Effective date: 2026-09-27 Last updated: 2026-09-27

1. The short version

Our website sets no cookies at all. It runs no JavaScript, loads nothing from other companies' servers, and has no analytics, no advertising tags and no embedded fonts or scripts from third parties. There is nothing on it to consent to, and so we do not show you a cookie banner.

The Gulf Gambit app is not a web browser and does not use cookies. It does store a small amount of information on your device — the token that keeps you signed in, your settings, and your progress through the tutorial. That storage is covered by the same law that covers cookies, so it is described in full below.

The one place third-party cookies can appear is if you choose to sign in with Google or Facebook. That happens in those companies' own sign-in pages, under their rules, not ours. See section 5.

2. Why this document exists

Article 5(3) of the EU ePrivacy Directive — implemented in the Netherlands as article 11.7a of the Telecommunicatiewet, the "cookiebepaling" — is not limited to cookies. It covers storing information on, or gaining access to information already stored on, a user's terminal equipment, whatever the technology.

That wording catches a mobile app's local storage just as it catches a browser cookie. A policy that said "we use no cookies" and stopped there would be technically true and substantively misleading. So this document describes everything Gulf Gambit stores on your device, not only the things called cookies.

Two consequences follow from the same article:

• Storage that is strictly necessary to provide a service you asked for does

not require consent.

• Storage that is not strictly necessary does require consent, obtained

before the storage happens.

Every item in section 4 is categorised against that test.

3. The website

The only outbound links on the site are ordinary text links you can choose to click — currently to the Dutch supervisory authority and to our advertising provider's own privacy policy. A link is not a cookie: nothing is loaded from those sites unless you click through.

Our hosting provider (Cloudflare) processes the IP address and request metadata necessary to deliver the page and to protect the site from attack. That is network delivery and security, not tracking, and it is described in section 4.6 of our Privacy Policy.

If this ever changes — if we add analytics, an embedded video, a web font from another domain or any other third-party resource — we will provide the notice and, where required, the consent mechanism the law requires before making the change. The site's build configuration is deliberately set up so that adding a script is a visible, deliberate edit rather than something that can slip in unnoticed.

4. What the app stores on your device

None of the following is a cookie. All of it is local storage on your own device, and all of it is removed when you delete the app.

4.1 Strictly necessary — no consent required

These exist to deliver the service you asked for. Without them you could not stay signed in or play a match.

4.2 Preferences you set — no consent required

These record choices you made yourself. Storing a setting you deliberately chose is part of providing the service.

4.3 Progress and state — no consent required

4.4 Advertising

No advertising identifier is stored, and no advertising SDK is present in the app today.

When optional rewarded advertising is enabled, advertisements will be contextual — selected on the basis of the app you are in, your approximate region and your device language. They are never selected on the basis of a profile built about you. We do not use the device advertising identifier (IDFA), and Gulf Gambit therefore does not present an App Tracking Transparency prompt.

Our advertising provider may need to store limited information on your device to render an advertisement, cap how often you see the same one and confirm that you finished watching so your reward can be paid. Where any of that storage is not strictly necessary, we will obtain consent before it happens.

See section 4.5 of our Privacy Policy for the full advertising position.

5. Third-party sign-in

If you choose Sign in with Google or Sign in with Facebook, the app opens that company's own sign-in page in a secure system browser view.

On that page, Google or Meta may set their own cookies, under their own privacy and cookie policies. That is their sign-in system, not ours — we cannot read those cookies, and we do not receive them.

We do not embed Google's or Meta's software development kits in the app. We use the standard web sign-in flow precisely because it keeps those companies' tracking technology out of the app itself.

If you would rather not involve either company, you can create an account with an email address and password, or use Sign in with Apple.

6. A note on the age question

The app asks your birth year once, before you begin. That answer is stored on your device and is not transmitted to us. We do not hold your date of birth on our servers, and it is not in any of our databases.

It is stored rather than merely checked because a single yes/no tap collects nothing anyone can act on, whereas a year lets the app behave correctly at the two thresholds that matter: the minimum age to play, and the age below which consent-based processing would need a parent's authorisation.

7. How to clear what is stored

Because the website sets no cookies, there is nothing on it for you to clear and no preference for us to remember.

8. Changes to this policy

We will update this document whenever what we store on your device changes.

Where a change introduces storage that requires consent, we will ask for that consent before the storage happens — not afterwards, and not by treating your continued use as agreement.

The Last updated date at the top shows when this document was last revised.

9. Contact