Privacy and cookies

The short version

• Reading this site collects nothing unless you press Accept on the analytics banner. No cookies, no tag, no request to Google.
• LobbyRank sets no cookies of its own, at all, whatever you choose. The only cookies that can appear are Google Analytics' own, and only after you accept.
• Clicking through to a casino writes one row to our database. It holds no IP address, no name, no email and no identifier that follows you.
• There is no account, no login, no newsletter and no advertising network. We have nothing to sell and no one to sell it to.

Analytics: off unless you say otherwise

We use Google Analytics 4 to answer two questions: roughly how many people visit, and which sites and searches sent them. That is the whole purpose.

It does not load until you press Accept. Before that there is no Google tag on the page, no cookie, and no request to any Google domain — the banner defaults to declining and nothing is stored while it is on screen. If you press Decline, none of it ever loads and we remember only that you declined.

If you accept, Google Analytics sets its own cookies and records:

• the pages you view on this site, and when
• the site or search that referred you
• your approximate location, browser and device type

Alongside that, we deliberately turn off:

• Advertising signals. Ad storage, ad personalisation and ad user data are denied in the tag, and granted nowhere. This property cannot feed ad targeting.
• Google Signals. Off, so your activity here is not joined to a Google account.
• Full IP addresses. IP anonymisation is on.

Google processes this data on its own terms as a separate company, and we cannot speak for what it does beyond the settings above. Analytics never loads on our internal admin pages, because that traffic is us and counting ourselves would make the only number we want wrong.

How to change your mind

The choice is recorded in your browser's local storage — not a cookie — so declining stores nothing that travels with a request. It stays on the device and browser you chose it on, and clearing your site data resets it.

Every page has an Analytics line in the footer showing your current choice, with a control to withdraw it or accept. Withdrawing takes effect immediately: the tag stops collecting on the page you are on, and does not load again.

When you click through to a casino

Our links to casinos go through /go/ on this site, which records the click and then forwards you. This is how we know which recommendations are useful, and it is how we get paid — see the affiliate disclosure. It happens on our server whether or not you accepted analytics, because it is not analytics: it is the record of a click on our own site.

Each click writes one row containing:

• the time
• which casino, which game page, and which region the page was for
• which of our own links was used
• the path of the page you clicked from
• the two-letter country code we resolved for the request
• a hash of your browser's User-Agent string

What that row does not contain, and what the columns are for:

• No IP address. Only the country code. Your IP is used to work out which country you are in — which we have to do, because it decides which casinos may lawfully be shown to you — and is not written down.
• No raw User-Agent. It is hashed with SHA-256 and truncated. It exists to tell repeat and automated clicks apart, not to identify anyone. We are not going to claim that makes it anonymous in every sense — a hash of a common browser string is a coarse fingerprint of the software, not of you, and there is nothing stored beside it to join it to a person.
• No session or visitor identifier. That column exists in the schema and is deliberately left empty. Filling it would mean minting an identifier to follow you between clicks, which is precisely the tracking this is written to avoid.
• No name, email, or account. We do not have any of these, because there is nothing on this site to sign up for.

These rows are never joined to Google Analytics, and Google Analytics is never used to measure clicks or commission. The two do not meet.

What happens at the casino is not us

Once you follow a link you are on the operator's site, under its privacy policy and its terms, not ours. If you open an account or deposit, that relationship is entirely between you and them. We are told about commission, not about you — we never receive your name, your email, your account details or what you played.

Where the data sits

The site is hosted by Vercel. The click log lives in a Postgres database hosted by Supabase, readable only by our own server-side credentials — no part of it is exposed to browsers. Analytics data, if you accepted, sits with Google.

Things we do not do

• Sell, rent or share what we collect. There is no commercial arrangement of any kind over this data.
• Run advertising, retargeting pixels, or any third-party tag beyond the analytics described above.
• Track you across other websites.
• Ask for an email address, or run a mailing list.
• Show different content to search engines than to people.

Asking us about your data

We hold no account and no contact details, so in most cases there is nothing to look up — we could not find “your” rows if we tried, which is a consequence of the design rather than an excuse. If you have a question about any of this, or want something removed, write to hello@lobby-rank.com and tell us what you need; we will say plainly what is and is not possible.

This page describes what the code does today. It is not legal advice, and it has not yet been through the specialist review the rest of our compliance wording is queued for.