//privacyPrivacy Policy

How we handle personal data

Last updated 19 August 2026. This policy describes every piece of personal data checkpointnomad.com collects, why, on what legal basis, who processes it and for how long. If anything here contradicts what a page or a form tells you, treat it as an error and write to us — we will fix it.

1. Who is responsible

The data controller is Checkpoint Nomad, C/O Kubra Gurkan Kose, Bornholms Alle 17, 3. 1, 2630 Taastrup, Denmark, registered in Denmark under CVR 45843653. Contact for any privacy matter: info@checkpointnomad.com, or by post to the address above. We have not appointed a Data Protection Officer, because we are not required to under Article 37 GDPR; privacy questions go to the address above and are handled by the company.

2. What we collect, field by field

Two things happen on this site: what you deliberately send through a form, and what the server records simply because your browser asked it for a page. Both are set out below — §2.1 and §2.2 are the form fields, §2.3 is the automatic part, and §2.4 is what does not happen at all. There is no account system, no profiling and no advertising pixel.

2.1 Pitch submission (/pitch-your-demo)

Studio or developer name — identifies who is submitting.
Contact email — the only way we can send you an answer.
Game title, genre, target platforms — the assessment itself.
Your pitch text — what you choose to tell us about the game.
Playable build link and design document link — what we assess.
Funding band — tells us whether the project is in a range we can work with.

Every one of those fields is required, and there are no optional fields on that form. That is deliberate: the legal basis below covers what is necessary for the step you asked us to take, and a field you did not have to fill in could not be necessary by definition.

2.2 Contact form (/contact)

Your name, your email address, the subject you selected, and your message.

2.3 What every page request records, whether or not you use a form

This is the same description that appears in the notice on each form and on the Cookie Policy, because all three are rendered from one source and cannot drift apart. The last line of each entry answers the question that matters most — whether it is tied to what you sent.

A truncated one-way hash (SHA-256) of your IP address, with the time of each submission.

Purpose: To count submissions per sender so the forms cannot be flooded. The hash cannot be turned back into your IP address, and the raw address is never written to the database.
Legal basis: Art. 6(1)(f) — our legitimate interest in keeping the forms usable.
Retention: The counter file is deleted 24 hours after your last submission.
Linked to your submission: Yes — the same hash is stored in the row with your submission, so an abusive sender can be identified and removed. It is deleted with the row.

Standard web-server log lines: IP address, date and time, the URL requested, the HTTP status, and the browser user-agent string.

Purpose: Security, abuse investigation and diagnosing errors. This is recorded for every request to any page of this site, not only when you send a form.
Legal basis: Art. 6(1)(f) — our legitimate interest in operating the service securely.
Retention: 30 days, then deleted.
Linked to your submission: No. Server logs are not joined to submissions and are not used to build a profile.

An application event log recording that a submission was stored, with its reference — no names, addresses, message text or IP addresses.

Purpose: To detect failures, such as a submission that could not be saved.
Legal basis: Art. 6(1)(f) — our legitimate interest in a working service.
Retention: 30 days.
Linked to your submission: Only by the reference shown to you after sending, which is not personal data on its own.

A hidden field on each form is filled in only by automated submitters. If it is filled, the submission is discarded and nothing is stored at all.

2.4 What is not happening

Every asset on this site — fonts, styles, scripts, images — is served from checkpointnomad.com itself. There is no analytics provider, no advertising pixel, no chat widget, no content delivery network and no third-party font host. The only organisation other than us that can see the traffic is Hostinger International Limited, which operates the server in Düsseldorf, Germany as our processor under Article 28. If an analytics or advertising tag is ever added, it will load only after you allow it in the cookie banner, and it will be listed on the cookie page before it goes live.

3. Legal basis, and why we do not ask for consent

Pitch submissions — Article 6(1)(b). Processing is necessary for steps taken at your request before entering into a contract. You asked us to assess a pitch; reading it and replying is that step.
Contact messages — Article 6(1)(f), or 6(1)(b) where your message is a step towards a contract. Our legitimate interest is answering business correspondence addressed to us. You can object at any time under Article 21.
Anti-abuse and logs — Article 6(1)(f). Our legitimate interest in keeping the site available and the forms usable.
Non-essential cookies — Article 6(1)(a) consent, and only where you actually give it. See the Cookie Policy.

You will not find an “I agree to the privacy policy” tick-box on our forms. Consent is a separate legal basis from the ones above, and consent you have to give in order to submit a form is not freely given under Article 7(4) — so demanding it would misstate our basis and be invalid at the same time. Instead you get a notice at the point of collection telling you exactly what happens, which is what Article 13 requires.

4. What we never do

We do not sell or rent personal data, and we never will.
We do not disclose your data to third parties for those parties’ own purposes.
We do not add you to a mailing list because you contacted us.
We do not build profiles or take automated decisions with legal or similarly significant effects.
We do not ask for a phone number, postal address, date of birth or any special-category data.

5. Who processes the data for us

We use processors that act only on our documented instructions under Article 28 contracts. Naming a processor is not the same as disclosing your data to a third party for its own purposes — a processor may only do what we tell it to.

Hosting — Hostinger International Limited. This website, its API and its database run on a single virtual server operated by Hostinger International Limited in Düsseldorf, Germany. That is the only place your submission is stored. The processing terms are their published data processing addendum under Article 28.
Transfers outside the EEA. Germany is in the European Economic Area, so storing your data there is not a Chapter V transfer and no adequacy decision or safeguard is needed for it. We do not rely on standard contractual clauses for hosting, because there is nothing to transfer.
Email. Outbound mail from the server is switched off, so no email provider receives anything you submit through a form. Messages you send directly to info@checkpointnomad.com are handled by the mailbox provider for the checkpointnomad.com domain.
How we know where the server is. The location was established from inside the machine on 2026-08-17 — the first upstream router, round-trip times to cities with known locations, and the RIPE registry entry — not from an IP-geolocation lookup, which is frequently wrong.

That list is exhaustive. There is no analytics provider, no CRM, no chat widget, no content delivery network, no backup provider and no third-party font host. If that changes, this section is updated before the change goes live, because adding a processor is a change to who holds your data.

We use no analytics provider, no CRM, no chat widget, no content delivery network and no third-party fonts. Every asset on this site is served from our own domain, which is why no request leaves your browser to anyone else while you read it.

6. How long we keep it

Pitch submissions: 24 months from your last message about them, then deleted.
Contact messages: 12 months from your last message, then deleted.
Anti-abuse records and server logs: 30 days.
Where a submission leads to a signed agreement, the contract file is kept for as long as Danish bookkeeping law requires (five years from the end of the financial year it relates to).

Deletion is not a promise made only in this policy: the retention periods above are enforced by scheduled jobs in the database itself.

7. Your rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). Where processing rests on consent, you may withdraw it at any time without affecting processing already carried out.

Write to info@checkpointnomad.com. We answer within one month, and we will tell you if we need longer as Article 12(3) allows. There is no charge.

If you believe we have handled your data unlawfully you may complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark — datatilsynet.dk — or to the supervisory authority where you live.

8. Security

The site is served over HTTPS. Form input is validated and escaped on the server, database access uses prepared statements, credentials are held outside the web root, and the database is not exposed to the public internet. No system is perfect; if you find a weakness, please tell us at info@checkpointnomad.com and we will respond.

9. Children

This is a business-to-business site for game developers and is not directed at children. We do not knowingly collect data from anyone under 13, the age set for information society services in Denmark under Article 8(1) GDPR as implemented in Danish law. If you believe a child has sent us data, write to us and we will delete it.

10. Changes to this policy

When this policy changes we update the date at the top of the page. Material changes — a new processor, a new purpose, a different retention period — are described in the section they affect rather than summarised away.