Privacy Policy
This page describes what personal data Slow Made City processes, on what legal basis, who we share it with, and what rights you have. We write it in plain language rather than legalese.
Who processes the data
The data controller is Strata Promo OOD ("СТРАТА ПРОМО" ООД), company number (EIK) 130982726, registered seat Sofia, Bulgaria.
For questions about this policy: hello@slowmadecity.com.
What we collect
If you only read the site
If you decline analytics cookies, we collect nothing that identifies you. Cloudflare, which hosts the site, processes technical request data (IP address, browser type) for security and content delivery. This is necessary for the site to work at all.
We also count visits with Cloudflare Web Analytics. It sets no cookies, reads nothing from your device, and does not follow you between sites: visits are counted from the referring page's address, not from an identifier. That is why this statistic works even when you decline analytics cookies, and why it needs no consent. We see totals: how many pages were opened, which are read most, from which country and in which browser. We do not see you.
If you accept analytics cookies
We use Google Analytics 4 to understand which stories get read, where readers come from, and how they move through the site. Google receives a truncated IP address, the page URL, device and browser information, and an anonymous identifier stored in a cookie. We have not enabled advertising features: Google Signals and ad personalization are turned off, and we pass no data to Google for advertising purposes.
We also use Microsoft Clarity, which records how the page is scrolled
and where it is clicked, so we can see where a piece loses its reader.
Clarity sets both first-party cookies for this site and cookies on
Microsoft domains. One of them, MUID, is also used by
Microsoft for advertising beyond this site. We neither buy nor show
advertising and we do not use this data for it, but we cannot limit what
Microsoft uses it for. If that is not acceptable to you, decline
analytics cookies: Clarity then records nothing.
Both Google Analytics and Clarity load with consent denied by default (Google Consent Mode v2 and Clarity's equivalent signal). Until you press "Accept", no analytics cookies are written and no session is recorded.
If you are signed in (City Loop)
When you register via magic link or Google, we store your email address and, for Google sign-in, the name and profile picture Google gives us. While you play, we record check-ins, articles read, and points. If you upload a photo, it is stored alongside your profile until the editorial team approves or rejects it.
Cookies and local storage
| Name | Purpose | Lifetime |
|---|---|---|
smc_consent | Remembers your choice about analytics cookies | 6 months |
sb-*-auth-token, sb-*-code-verifier | Signing in (Supabase). Strictly necessary. Without them you cannot stay logged in | 60 days |
pending_point_intent | Holds a point earned before sign-in so it is not lost | 10 minutes |
_ga, _ga_* | Google Analytics (only after consent) | up to 2 years |
_clck, _clsk | Microsoft Clarity, ties page views into one session (only after consent) | up to 1 year |
MUID, CLID, ANONCHK, MR, SM | Cookies on Microsoft domains, set by Clarity. MUID is also used by Microsoft for advertising (only after consent) | up to 13 months |
Sign-in cookies are strictly necessary and are set without separate consent, because the service you asked for (an account) does not work without them. Analytics cookies are set only after your explicit consent.
You can withdraw consent at any time by clearing this site's cookies in your browser settings; the banner will reappear on your next visit.
Legal basis
- Consent (Art. 6(1)(a) GDPR) for analytics cookies.
- Performance of a contract (Art. 6(1)(b)) for the account and the game you asked for.
- Legitimate interest (Art. 6(1)(f)) for site security and abuse prevention.
Who we share it with
We do not sell data. We share it only with the providers we need in order to run the site:
- Cloudflare (hosting, article and photo storage);
- Supabase (profiles, points, game history);
- Google (Google Analytics and Google sign-in);
- Microsoft (Clarity, session recordings).
Some of these providers process data outside the EU. Transfers rely on the European Commission's Standard Contractual Clauses and, for US providers, the EU-U.S. Data Privacy Framework.
How long we keep data
- Analytics data in Google Analytics: 14 months.
- Recordings in Microsoft Clarity: per Microsoft's Clarity policy.
- Cloudflare Web Analytics: aggregate totals only, no per-visitor data.
- Account and game history: until you ask us to delete it.
- Rejected photos: deleted once the editorial team decides.
Your rights
You have the right to access your data, to rectification, to erasure, to restriction of processing, to portability, and to object to processing. You may withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal.
Write to hello@slowmadecity.com and we will respond within one month.
If you believe we process your data unlawfully, you have the right to complain to the Bulgarian Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd, Sofia, cpdp.bg.
Changes
If we change this policy materially, we will note it here and, where needed, ask for your consent again.
Last updated: 9 August 2026