Privacy Policy

1. Who we are

Phantovante (“we”, “us”) is an independent, non-commercial editorial guide to strategy and simulation games, run by an individual curator based in Toronto, Ontario, Canada. We are not a registered company and we do not sell products or services. This policy explains how we handle personal information under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and, where it applies, Québec’s Act respecting the protection of personal information in the private sector (Law 25).

2. Privacy contact

Questions, requests or complaints about your personal information can be sent to the person responsible for privacy at Phantovante:

Privacy contact

Marcus Elwin, Curator

Email

[email protected]

Location

Toronto, Ontario, Canada

3. What we collect

• Information you send us. If you use the contact / subscribe form, we receive the name and email address you enter (and any message). That’s it — we never ask for a phone number.
• Web-push subscription. If you opt in to browser notifications, your browser generates a push subscription token that our notification provider (OneSignal) uses to deliver messages. If you also submit your email through the form, it is linked to that subscription so we can reach you.
• Server logs. Like almost every website, our hosting provider automatically records technical data such as your IP address, browser type (user-agent), the page requested and a timestamp. This is standard operational logging for security and reliability.

We do not use advertising trackers, analytics profiling, or cookies for marketing, and we do not build advertising profiles or sell your data. The only notification/messaging service we use is OneSignal, described in section 6. See our Cookie Notice for details.

4. Why we use it (purposes)

• To read and reply to messages you send us through the form.
• To send you web-push notifications and email updates, where you have opted in.
• To keep the site secure and running (technical logs), and to diagnose problems.

We do not use your information for advertising, and we do not build user profiles.

5. Consent and how to withdraw it

When you submit the subscribe form and tick the consent box — and, for notifications, accept your browser’s permission prompt — you give meaningful, express consent for us to use your name and email and to send you web-push updates. You can withdraw that consent at any time, as easily as you gave it. To stop notifications, revoke the notification permission in your browser (or use any unsubscribe control); to delete your details, email [email protected] and ask us to remove your message and subscription. Server logs are collected on the basis of our legitimate interest in operating the site securely.

6. Who we share it with (service providers)

We keep sharing to the minimum needed to run the site:

• Hosting provider. The site and its server logs are stored with our web host, which processes technical data on our behalf.
• Email. Messages you send reach us through our email provider.
• Web-push notifications — OneSignal. We use OneSignal Inc. as our service provider to deliver web-push notifications. If you opt in, OneSignal processes your push subscription token and, where you provide it, your email address and name on our behalf so we can send you updates. Your consent is obtained through your browser’s permission prompt together with the subscribe checkbox — an express, opt-in basis consistent with Canada’s Anti-Spam Legislation (CASL) and PIPEDA. You can unsubscribe at any time (see section 5). OneSignal is based in the United States, so your email address and push token may be stored or processed there; see section 7 on cross-border transfers.

We do not sell, rent or trade personal information to anyone, and there are no advertising or analytics partners.

7. Cross-border transfers

Our hosting, email and notification providers may store or process data on servers located outside Canada, including in the United States or the European Union. In particular, OneSignal (web-push) is based in the United States, so your email address and push token may be processed there. Where that happens, your information may be subject to the laws of those jurisdictions. We take reasonable steps to work with providers that offer a comparable level of protection. As required by Law 25, we note this transfer here so your consent is informed.

8. Retention

We keep contact-form messages only as long as needed to handle your request and any reasonable follow-up, then delete them. Technical server logs are retained for a short period for security and troubleshooting, then rotated out by our host.

9. Your rights

Under PIPEDA and Law 25 you may:

• Ask what personal information we hold about you (access);
• Ask us to correct information that is inaccurate (correction);
• Withdraw consent and ask us to delete your data;
• Ask questions about how your information is handled.

Email [email protected] and we’ll respond within a reasonable time.

10. How to complain

If you’re not satisfied with our response, you can contact the Office of the Privacy Commissioner of Canada at priv.gc.ca. Residents of Québec may also contact the Commission d’accès à l’information du Québec (CAI) at cai.gouv.qc.ca.

11. Changes to this policy

If we change how we handle personal information, we’ll update this page and revise the date at the top. Material changes will be described plainly here.