Privacy Policy

01Who we are

Hong Kong Fudatong Cross-border Commerce Co., Limited operates gc-cdn.com (the "service"), a collection of skill-based browser games. Our registered address is Room D07, 8/F, Phase 2, Man Tak Factory Building, 99 Sheung Keung Fuk Street, San Po Kong, Hong Kong. For the purposes of UK and EU data protection law we are the controller of the personal information described here.

02What we collect

What we do not collect: your full card number, government identifiers, precise location, contacts, or the contents of any private message — there are no private messaging features on this site.

03Why we use it

• to create and manage your account and your balance;
• to provide the games and deliver purchases;
• to send service messages — receipts, confirmations, and notices about a change to a policy you are subject to (we do not send marketing email);
• to answer your support, refund and privacy requests;
• to detect, prevent and investigate fraud, payment abuse and security incidents;
• to meet legal, tax and accounting obligations.

Where UK or EU law applies, we rely on: performance of a contract (running your account and delivering purchases), our legitimate interests (security, fraud prevention, keeping the service working), legal obligation (tax and accounting records), and consent where we specifically ask for it.

04Payments

Payments are processed by a third-party payment provider. Card details are submitted over an encrypted connection directly to that provider; they do not pass through, and are not stored on, our servers. We receive only a confirmation of the result plus the reference, amount and last four digits needed for your receipt.

When you pay with Apple Pay or Google Pay, the wallet presents a device-specific token to the payment provider. We never receive your underlying card number from either wallet. Your relationship with Apple or Google is governed by their own privacy terms.

05Cookies and browser storage

We use essential browser storage only. There are no advertising cookies, no cross-site tracking pixels and no third-party marketing tags on this site.

You can clear this storage at any time in your browser settings. Doing so signs you out and removes any balance held locally on that device.

Global Privacy Control. We honour the Global Privacy Control (GPC) signal as a valid request to opt out of the sale or sharing of personal information. Because we do not sell or share personal information as those terms are defined under the CCPA, the practical effect is that nothing changes — but the signal is recorded and respected, and no exception is relied upon.

06Children's privacy

The service is intended for people aged 13 and over. It is general-audience entertainment, with no content directed at children under 13, and we do not knowingly collect personal information from a child under 13.

• If you are under 13, do not create an account or send us personal information.
• If you are 13 to 17, please review this policy with a parent or guardian before creating an account. Paid features require the buyer to be 18 or to have a parent's or guardian's permission.
• If you are a parent or guardian and believe a child under 13 has given us personal information, write to [email protected] and we will delete it promptly.

07California privacy rights (CCPA / CPRA)

If you are a California resident, you have the following rights:

• To know what personal information we collect, use and disclose — set out in this policy;
• To access a copy of the personal information we hold about you;
• To delete personal information we have collected, subject to legal exceptions;
• To correct inaccurate personal information;
• To opt out of sale or sharing — we do not sell or share personal information, and we have no actual knowledge of selling or sharing the personal information of consumers under 16;
• To limit the use of sensitive personal information — we do not collect or process sensitive personal information for the purpose of inferring characteristics about you;
• Not to be discriminated against for exercising any of these rights. We will not deny you service, charge a different price, or provide a different level of service because you exercised a right.

To exercise a right, email [email protected] or write to Hong Kong Fudatong Cross-border Commerce Co., Limited, Room D07, 8/F, Phase 2, Man Tak Factory Building, 99 Sheung Keung Fuk Street, San Po Kong, Hong Kong. We verify identity against the information on your account and respond within 45 days. You may use an authorised agent to make a request on your behalf.

We do not use personal information for profiling in furtherance of decisions that produce legal or similarly significant effects.

Shine the Light (California Civil Code § 1798.83). We do not disclose personal information to third parties for their own direct marketing purposes.

Do Not Track. Browser DNT headers are not standardised; we treat GPC as described above and otherwise collect no cross-site tracking data to suppress.

08Other US state privacy rights

Residents of states with comprehensive consumer privacy laws — including Colorado, Connecticut, Utah and Virginia — have similar rights to access, correct and delete personal information, to obtain a copy of it, and to opt out of sale, targeted advertising and profiling. We do not sell personal information, do not run targeted advertising and do not profile for significant decisions. Requests go to [email protected] and are handled on the same timeline.

09UK and EU visitors

If you are in the UK or the European Economic Area, you have the right to access, rectify, erase, restrict or object to our processing, to data portability, and to withdraw consent where processing is based on it. Write to [email protected]. You also have the right to complain to your national supervisory authority; we would appreciate the chance to resolve the issue first.

10Where data is held

We are established in Hong Kong and our hosting and payment processing are carried out by service providers in Hong Kong, the European Union and the United States. Where personal information from the UK or EEA is transferred outside those territories, we rely on appropriate safeguards — standard contractual clauses or an equivalent lawful transfer mechanism — together with measures appropriate to the sensitivity of the data.

Our providers act on our instructions as processors. They may not use your personal information for their own purposes.

11How long we keep it

12Security

We use administrative, technical and physical safeguards appropriate to the data we hold. Passwords are stored only as salted hashes. Payment card data is handled exclusively by our PCI-DSS certified payment provider and never reaches our servers. No system is perfectly secure; if a breach affects your rights, we will notify you and the relevant authority as the law requires.

13Your choices

• Sign out of your account, or clear browser storage, to end the session on a device;
• Delete your account by emailing [email protected] — note that deleting the account also removes any remaining balance;
• Access or correct your details with the same request;
• Nothing to unsubscribe from: we send only service email, and there is no marketing list to leave.

14Changes to this policy

We may update this policy. When a change is material we post a notice on the site and update the effective date above. Continuing to use the service after a change takes effect means the updated policy applies to you.

15Contact

Privacy requests, access requests and deletion requests: [email protected], answered within 45 days (or sooner where the law requires).