1. Who is responsible for this site?
Imaginoix is the personal game and portfolio website of Hector Magaña. For privacy questions or requests, email hector@imaginoix.com.mx.
2. The short version
Imaginoix has no visitor accounts, advertising pixels, third-party analytics trackers, or sale of personal data. The public portfolio uses no analytics cookies; protected EDU features use only strictly necessary, short-lived security, access, and live-game cookies. Students who take an EDU test provide their name and answers so the test can be timed, graded, and reviewed by their teacher. EDU live quizzes instead ask for a fictional team nickname and create a group-only player ID; they keep answers, timing, scores, and placements so the classroom game and cumulative group leaderboard work. The site also keeps limited first-party, cookieless measurements so Hector can understand which pages and games work, diagnose broad compatibility issues, and estimate play time. A game trailer or EDU class material may use a privacy-enhanced YouTube player as described below.
3. Data collected
| Activity | Data kept | Why |
|---|---|---|
| Page view | UTC date and time; normalized page path with the query removed; matched route name; related game ID, if any; external referring host and a referring path truncated to 255 characters with its query removed; coarse device class, browser family, and operating-system family; a bot flag; and the daily anonymized visitor code described below. | Count visits, understand popular pages and broad device support, exclude bots from the reported counts, and see which sites send useful traffic. |
| Game play | A random 128-bit play token; game ID; UTC start, heartbeat, and end times; total credited play seconds; heartbeat count; the daily anonymized visitor code; coarse device class; whether loading completed; and whether the session ended by browser beacon, timeout, or an unknown reason. | Count plays, estimate active play time, and find loading or compatibility problems. Heartbeats occur about every 30 seconds while the page is visible; each heartbeat can add no more than 45 seconds. |
| EDU test or quiz | The student name entered before the test; a random private attempt token; a snapshot of the test questions; selected, matched, and written answers; points and percentage; grading status; and start, deadline, submission, and grading times. | Run the timed assessment, calculate automatic and partial scores, let the teacher grade written answers, show the student their answer review, and keep a class result record. |
| EDU live quiz | The fictional team nickname entered by the student; a generated group-only player ID and random participant token; the live-quiz and group identifiers; each selected answer, whether it was correct, response time, and awarded live score; placement and group-leaderboard points; and join, answer, completion, and activity times. | Let the student rejoin future games in the same group without an account, run and score the live classroom game, show the teacher the roster and forgotten IDs, resolve duplicate players, award configured placement points, and maintain the group leaderboard. |
A full user-agent string, IP address, and first accepted-language tag may be processed briefly in server memory to create coarse categories, apply abuse controls, and produce the daily anonymized visitor code. The raw IP address, full user-agent string, and accepted-language tag are never written to the analytics database. The random play token is held only in the open page’s memory on your device—not in a cookie or persistent browser storage—while the matching random token is stored with the server-side play session so heartbeats can be joined to it.
Automated bots may be recorded with a bot flag and a “bot” device class, but bot rows are filtered out of every analytics report.
4. What is not collected
| Category | Imaginoix does not collect |
|---|---|
| Identity and contact | Visitor account profiles or email addresses—unless you choose to send Hector an email. The public site has no visitor accounts. An EDU test records only the student name they enter and does not require an email address. A live quiz does not request a real name, email, or university registration number; students are instructed to use a fictional nickname, although text someone voluntarily enters could still identify them. |
| Network and location | Raw IP addresses or full user-agent strings as stored site analytics; precise location; GPS data; or a stored language preference. |
| Tracking and browser storage | Advertising or analytics cookies, advertising identifiers, cross-site tracking data, or a durable browser fingerprint that follows you across UTC dates. |
| Commerce and public content | Payment information, public uploads, comments, or other public user-submitted content. |
5. The daily anonymized visitor code
To estimate unique visitors without an account or cookie, the server derives a new secret salt for each UTC date. It combines that daily salt with the request’s IP address, user-agent string, and first accepted-language tag, hashes the result, and stores only the first 32 hexadecimal characters. The daily salt itself is derived from a private server secret and is never stored as a daily value.
Because the salt changes each day, codes cannot be used to recognize the same browser across different days. They are first-party operational counts, not cross-site identifiers or persistent fingerprints. They still represent an honest, probabilistic estimate: multiple people can share a code, and one person’s code can change during a day.
If your browser sends Do Not Track: 1 or Sec-GPC: 1, Imaginoix still records the non-identifying aggregate event but stores no visitor code for it.
6. Cookies, embedded YouTube videos, and local game saves
Imaginoix uses no advertising or analytics cookies. When you open an EDU group, test, or live-quiz page, a signed, HTTP-only browser cookie limited to the EDU area is set for up to 12 hours. Its random identifier keeps password-attempt and test-action limits separate for students sharing the same school network. It does not grant access, contain your name or password, or connect to analytics. After you successfully enter the password for a protected EDU group, Imaginoix sets a separate HTTP-only, signed access cookie limited to the EDU area for up to 12 hours. It contains the group identifier and a cryptographic access proof—not your name, email address, or password—and is used only to avoid asking for the group password on every page.
After you join an EDU live quiz, Imaginoix stores the random participant token in a host-only, HTTP-only, SameSite cookie limited to the live-game page for up to eight hours. It is used only to connect that browser to the joined team while polling game state and submitting answers. The token is not placed in the new play-page address, JavaScript-readable storage, or analytics; joining another live game replaces the cookie.
When a game trailer or EDU material uses YouTube, the player comes from youtube-nocookie.com using YouTube’s Privacy Enhanced Mode. EDU video pages do not contact YouTube until you press play. Loading or using a YouTube player sends a request to Google/YouTube and may disclose technical information such as your IP address, browser details, and the site origin. YouTube states that views in Privacy Enhanced Mode are not used to personalize the viewer’s YouTube experience or advertising outside this site, although non-personalized ads and YouTube’s own storage or policies may still apply.
An individual Unity game may save preferences or progress in your browser’s IndexedDB storage. That save stays local to your browser unless a game page clearly says otherwise; Imaginoix does not use it for website analytics.
7. Legal basis
Where the GDPR applies, this limited processing relies on legitimate interests under Article 6(1)(f): providing and evaluating assigned class activities, running live classroom games and group rankings, maintaining the site, controlling access to protected teaching material, measuring whether public pages and games are useful, understanding broad technical compatibility, protecting analytics quality, and improving releases. EDU test data is limited to the information needed to identify the submitted class result and grade it. Live-quiz identity is deliberately pseudonymous and group-scoped, but its gameplay history can still be personal data when it can reasonably be connected to a student. The broader site design minimizes privacy impact by using no advertising or analytics cookies, only short-lived necessary EDU security, access, and live-game cookies, no raw stored IP addresses in analytics, daily rotation, coarse categories, and short raw-analytics retention.
8. Retention
Raw page-view and play-session analytics are kept for no more than 90 days. Summary counts are aggregated by date, page, referrer host, device class, and game; those rollups contain no daily visitor code or event-level record and are kept for up to 730 days.
EDU test names, answers, and grades are kept with the relevant class group so the teacher and student can review the result. They are removed when the associated group is deleted and may be removed earlier when they are no longer needed for the class or a valid privacy request applies.
EDU live-quiz nicknames, generated IDs, participant tokens, answers, timings, scores, placements, and cumulative points are kept with the relevant class group so future games, ID recovery, and the group leaderboard continue to work. They are removed when the associated group is deleted and may be corrected, merged, deactivated, regenerated, or removed earlier when they are no longer needed or a valid privacy request applies.
9. Your rights—and an anonymization caveat
Depending on where you live, you may have rights to access, correct, erase, restrict, object to, or receive a copy of personal data, and to complain to a data-protection authority. Email the address above to make a request.
Imaginoix has no visitor account, analytics cookie ID, or durable analytics identifier. The temporary EDU security, access, and live-game cookies are not joined to analytics. That is good for privacy, but it also means Hector usually cannot locate a particular person’s anonymous analytics rows or prove which rows belong to them. EDU test records can be located using the student name, group, test, and approximate submission date. Live-quiz records can be located using the class group plus the fictional nickname or generated player ID shown to the teacher. For anonymous analytics, details such as a date, approximate UTC time, page, and device class can help assess what can reasonably be identified without collecting more data merely to answer the request.
10. Hosting and processors
Hostinger provides the web server, network, and MySQL hosting used by Imaginoix and acts as a hosting processor. Like any host, it may process network and security logs under its own operational policies. Hostinger describes the information it may collect and how it handles that information in its Privacy Policy; the terms governing its hosting services are available in its Terms of Service. Those documents describe Hostinger’s practices and do not replace this Imaginoix Privacy Policy. Imaginoix does not add third-party advertising or analytics processors.
Google/YouTube provides privacy-enhanced embedded players for game trailers and selected EDU class videos. Google describes its practices in the Google Privacy Policy, and YouTube explains Privacy Enhanced Mode. Imaginoix uses the YouTube Player API only for playback controls and does not use it to create its own cross-site profile or analytics record.
11. Security
Imaginoix uses reasonable administrative and technical safeguards designed to protect the limited information it processes against loss, misuse, and unauthorized access or disclosure. However, no internet transmission, hosting platform, or storage system can be guaranteed to be completely secure.
12. Children
Imaginoix is a general-audience portfolio and game site, not a public service directed specifically to children. The protected EDU area may be used with enrolled students for class activities and can ask a student to enter their name and test answers. Live quizzes ask for a fictional nickname and generate a group-only ID instead of requesting a real name, email, or university registration number. Neither activity requires a visitor account or email address. A parent, guardian, student, or institution with a concern can contact Hector at the address above.
13. Changes
This policy may change when the site’s actual practices or legal requirements change. The last-updated date at the top will be revised, and material changes will be described plainly on this page.
14. Contact
Questions, objections, and privacy requests can be sent to hector@imaginoix.com.mx.