We collect as little as we can and never sell your data. This page explains what we keep, why, and your rights under the GDPR. Last updated: 9 November 2026.
1. Who is responsible
SPREADBEYOND SRL, str. Aurel Vlaicu nr.66, bl.H, sc.B, et.2, ap.14, Iasi, 700381, Romania, VAT RO33082112 is the controller of your personal data. Questions or requests: a support ticket or [email protected].
2. What we collect and why
| Data | Why | Kept |
|---|---|---|
| Account: username, email, password (encrypted hash), sign-in with Google/Discord/Facebook/VK id | To run your account (contract) | Until you delete the account |
| Votes: IP address, network, game username, time | To stop fake votes and send rewards to servers (legitimate interest) | 90 days (counts without IP longer) |
| Login history: IP address, browser, time | Security of accounts (legitimate interest) | 180 days |
| Billing: name, address, country, company, VAT number | Invoices for PayPal payments (legal obligation) | 10 years (Romanian accounting law) |
| Payments: amount, transaction id, payer email | Deliver credits, refunds, fraud checks (contract, legal obligation) | 10 years |
| Support tickets: name, email, messages | To answer you (contract / legitimate interest) | 3 years after the ticket is closed |
| Reports of servers: reason, message, IP | Moderation and abuse prevention (legitimate interest) | 1 year |
Listed servers: what owners publish (name, address, description, banner) is public on purpose. To show players online we contact the listed game server address; this does not involve personal data of visitors.
3. Who receives data
- PayPal and Tebex when you pay (they act as independent controllers of the payment data).
- Cloudflare (security and fast delivery of the site), our hosting provider, and our email sending service.
- The owner of a server you vote for receives your game username (so you get your in-game reward) — never your IP or email.
- Authorities, only when the law requires it.
Some of these companies work outside the EU; they are covered by the EU standard contractual clauses or the EU–US Data Privacy Framework.
4. Cookies
| Cookie | What for |
|---|---|
| topg_session | Keeps you logged in during your visit and protects forms (needed) |
| remember me | Only if you tick "Remember me": keeps you logged in for 90 days |
| tg_games | Remembers the last games you opened, to show them first on the home page |
| Cloudflare | Security checks against bots (needed) |
We do not use advertising or tracking cookies of other companies.
5. Your rights
You can ask to see, correct, download or delete your data, object to or limit its use, and withdraw consent at any time. Most data you can change yourself in Account settings. Some data must be kept by law (invoices). You can also complain to the Romanian data protection authority (ANSPDCP, dataprotection.ro) or the authority of your country.
6. Security
Passwords are stored only as strong hashes, the whole site uses HTTPS, payment card data never reaches us, and access to the admin panel is limited.
7. Children
The site is not meant for children under 16 to create accounts or buy services. Parents who think a child gave us data can ask us to delete it.