Privacy Policy
Last updated: 2026-10-14
Notis ini juga tersedia dalam Bahasa Melayu.
This site is built to collect as little about you as possible. There are no accounts, no advertising and no tracking cookies. This notice explains the small amount of personal data that is still involved, and your rights over it.
It is my personal data protection notice under section 7 of Malaysia’s Personal Data Protection Act 2010 (PDPA), as amended by the Personal Data Protection (Amendment) Act 2024. Where the EU or UK General Data Protection Regulation (GDPR) applies to you, it also serves as my notice under that law.
1. Who is responsible
The data controller for amirwarsanah.com is Amir Warsanah, an individual based in Malaysia. For anything about this notice or your personal data, use the contact form on the home page.
2. What I collect, and where it comes from
| Data | Source | Why |
|---|---|---|
| Technical data your browser sends with every request: IP address, browser and device type, the page requested, the referring page, and the date and time | Your browser, received by my hosting provider, Cloudflare | To deliver the site, keep it secure and protect it from abuse and attacks, and to see aggregate traffic figures (such as page views and countries) |
| What you send through the contact form: your email address and your message, with the page you sent it from and your screen size | You, when you choose to send me a message | To read and reply to your message, and to check with Cloudflare Turnstile that the form is being used by a person and not a bot (Turnstile sees your browser and connection details, which Cloudflare uses to tell the two apart) |
| What you send through the signup form: your email address and which of the lists you ticked (the English newsletter, the AI newsletter, or news when my English or AI course is ready), with the page you signed up from and your screen size | You, when you choose to sign up | To send you only the emails you asked for, and to check with Cloudflare Turnstile that the form is being used by a person and not a bot |
| Anything in our email correspondence after that: your name, email address, the content of your messages and any attachments | You, when you reply to me by email | To continue our conversation, and to keep a record of it |
I do not ask for sensitive personal data. Please do not send health, financial, religious, biometric or other sensitive information through the contact form or by email.
Giving me your personal data is voluntary. You can browse the whole site without identifying yourself. If you give an email address that does not work, I will not be able to reply.
The email list. Signing up is optional, and you choose what you get. I will only email you about what you ticked, I will never sell or give your address to anyone to market to you, and every email I send will tell you how to stop getting them. To be taken off the list at any time, send me a message through the contact form.
3. Cookies
This site does not set any cookies of its own, and does not use advertising, tracking or social media cookies. Because of that, there is no cookie banner.
Cloudflare, which hosts and protects the site, may place a strictly necessary security cookie (for example __cf_bm or cf_clearance) if it needs to check that a visitor is not an automated bot. These cookies exist only to keep the site available and secure, do not track you across other websites, and are described in Cloudflare’s cookie documentation. You can block or delete cookies in your browser settings. The site will still work, although a security check may be shown again.
4. Who I share it with
I do not sell, rent or trade your personal data, and I do not use it for advertising. It is disclosed only to:
- Cloudflare, Inc.: hosting, content delivery, security, receiving contact-form messages and signups, and forwarding email sent to my amirwarsanah.com address. Cloudflare’s privacy policy.
- Google LLC: the Google Sheet where contact-form messages, signups and feedback messages are stored, which only I can read, and the Gmail mailbox where email is received and stored. Google’s privacy policy.
- Authorities or other parties, only where the law requires it, or where it is needed to establish, exercise or defend a legal claim.
5. Transfers outside Malaysia
Cloudflare and Google run global networks, so your data may be processed in the United States and in other countries outside Malaysia. I use these providers because they commit to contractual data protection terms and industry-standard security, and I rely on the grounds for cross-border transfer allowed under section 129 of the PDPA. For visitors in the EU or UK, these providers use the European Commission’s Standard Contractual Clauses or other lawful transfer mechanisms.
6. How long I keep it
- Technical data is held by Cloudflare under its own retention periods. I do not keep a separate copy of it.
- Contact-form messages are deleted once they are dealt with, and at the latest 12 months after they arrive. Your IP address is held in the server’s memory for a few minutes to stop floods and is never written down.
- Signups are kept until you ask to be taken off the list, or until I stop sending that kind of email, whichever comes first.
- Emails are kept for as long as our conversation is useful, then deleted when they are no longer needed, unless the law requires me to keep them longer.
7. Your rights
Under the PDPA you have the right to:
- Access the personal data I hold about you, and have a copy
- Correct personal data that is inaccurate, incomplete, misleading or out of date
- Withdraw consent to my processing of your personal data
- Prevent processing that is likely to cause you damage or distress, and prevent processing for direct marketing (I only email people who signed up to my list, and you can leave it at any time)
- Data portability: ask for your data to be sent to another data controller, where technically feasible
If you are in the EU or UK, you also have the right to request erasure, to restrict or object to processing, and to complain to your local data protection authority. Where the GDPR applies, I rely on legitimate interests to run and secure the site and to reply to messages you send me, and on your consent where you give it.
To use any of these rights, send me a message through the contact form. I will respond within 21 days, as the PDPA requires, and may need to confirm your identity first. In Malaysia you may also complain to the Personal Data Protection Commissioner (pdp.gov.my).
8. Security
The site is served only over encrypted HTTPS, has no database of visitor information, and relies on providers with strong security programmes. No system is perfectly secure. If a personal data breach occurs, I will act on it and give the notifications that the law requires.
9. Children
This site is written for adults and is not directed at children. If you believe a child has sent me personal data, contact me and I will delete it.
10. My apps and games
This section covers the apps and games I make and run: Wartastic Pacers, Amir’s Chess, RogueFour, Lapar Teruk and Ketuk Score. Each is served from its own address under ketuk-ket.uk. Telunjuk, my learning app for children, has its own notice at telunj.uk/privacy.
- No accounts, ads or tracking cookies. Settings and progress are kept in your own browser’s storage and stay on your device. Clear the app’s site data in your browser to remove them.
- Feedback. Wartastic Pacers, Amir’s Chess, RogueFour and Ketuk Score have a Feedback button. Sending feedback stores the text you typed, whether you marked it a problem or an idea, which app and page you were on, and your screen size, in a Google Sheet that only I can read. Your IP address is held in the server’s memory for a few minutes to stop floods and is never written down. Please don’t put personal details in a feedback message.
- Playing online. Wartastic Pacers, Amir’s Chess and RogueFour have an online mode where you type a name and a room code. These go to the game server so you and a friend can be paired, and the room keeps a simple win/loss tally under those names so it is still there the next time you use the same code. Amir’s Chess also keeps an unfinished game so it can be resumed. Playing solo sends nothing beyond loading the page.
- Wartastic Pacers leaderboard. If you post a Score Attack score, the server stores the name you typed, the score, a few run statistics (level, shots, clears) and the time. The leaderboard is public, so pick a nickname you are happy to show. To keep out spam, the server also keeps the IP address a score came from for up to one hour, then drops it. The game counts first-time and returning visits as plain totals that are not linked to you.
- Google Fonts. Wartastic Pacers and RogueFour load their typefaces from Google Fonts, so Google’s servers see your IP address when the page loads (Google’s privacy policy).
- Lapar Teruk sends nothing about you. Its map link opens Google Maps and its support link opens Buy Me a Coffee; each runs under its own privacy policy.
- Hosting and analytics. Every app is served by Cloudflare, as described in section 4. Cloudflare may count page views and loading speed as totals with its cookieless Web Analytics; it is not used to identify or follow you.
To have a leaderboard entry, a room record or a feedback message removed, send me a message through the contact form with the name or text shown. Your rights in section 7 apply to this data too. Other sites I link to that are run by others are not covered by this notice, and I am not responsible for their privacy practices.
11. Changes to this notice
If I change how personal data is handled, for example by adding analytics, I will update this notice first and change the date at the top.
12. Language
This notice is published in English and Bahasa Melayu, as section 7(3) of the PDPA requires. If the two versions differ, the English version prevails, to the extent the law allows.