Short version: this site sets no tracking cookies, runs no analytics service, shows no advertising and has no third-party scripts on any page. It counts visits using a value that cannot be turned back into you and cannot be linked to you tomorrow. There is nothing here to opt out of.
Who is responsible
SpoilSins is a personal film review site run by Nikos Broikos. For anything on this page, including a request to see, correct or erase data, write to broikos.gr. There is no company behind it and no data protection officer, because neither the scale nor the kind of processing described below requires one.
What this site does not do
Stating the absences first, because they are the whole of it and each one is checkable by opening your browser's developer tools on any page here:
- No Google Analytics, Meta Pixel, Hotjar, Clarity or any other analytics or session-recording service.
- No advertising, no ad network, no remarketing, no conversion pixels.
- No social media embeds, no third-party comment system, no embedded video players.
- No third-party fonts. The typefaces are served from this site's own server, so no request goes to Google Fonts or anywhere else.
- No images loaded from other domains. Film stills come from TMDB but are stored here and served from here.
- Nothing is sold, rented or shared for marketing. There is no mailing list and no newsletter.
Cookies
One, and it is not for tracking.
| Name | What it does | How long |
|---|---|---|
| ss_notice | Remembers that the one-line notice about cookies has been shown, so it is not shown again. | 12 months |
That is the complete list. It is a first-party cookie, it contains the single character 1, it is never read by anyone else, and it is strictly necessary for the thing it does. Under the ePrivacy Directive article 5(3), transposed in Greece by Law 3471/2006 article 4(5), storage of that kind does not require consent, which is why this site asks for none and shows no accept or reject buttons.
Deleting it in your browser is enough to remove it. The notice will then appear once more.
How visits are counted
Every page request is recorded so the site knows which reviews are read. What is stored for each one is: the page path, the type of device as a single word, the domain of the site you arrived from if you followed a link from elsewhere, the time, and a visit key.
Your IP address is never stored. The visit key is a one-way SHA-256 hash of your address, your browser's user-agent string, today's date, and a secret held on the server. It cannot be reversed into an address. Because the date is part of what is hashed, the same person visiting tomorrow produces a completely different key, so visits cannot be joined up across days by anyone, including by whoever holds this database.
That is a deliberate limit rather than a shortcoming. It means this site can report how many visits a day a review gets and cannot build a profile, follow a person between sessions, or recognise a returning reader. There is no such thing here as a returning visitor.
Requests from bots and crawlers are identified by their user-agent and excluded from the figures.
The legal basis for this counting is legitimate interest under Article 6(1)(f) GDPR: knowing which pages are read is necessary to run the site, and it is done in the least intrusive way available. Since the result cannot be linked to an identifiable person, in practice it falls outside personal data altogether.
Search
The search box submits your terms in the address bar so the page can be shared or bookmarked. The terms are not recorded: the visit log stores the path /search and nothing after it.
Server logs
This site runs on shared hosting, and like every web server on the internet that host writes its own access log, which does include IP addresses. Those logs exist for security and fault-finding, are kept by the hosting provider under its own retention policy, and are not used to build any of the figures described above. The provider acts as a processor for that.
Contacting the site
There is no contact form on this site at the moment. If you write by email, that email and whatever you put in it are kept only as long as needed to reply and are not added to any list.
Links to other sites
Some pages link out, most often to Buy Me a Coffee for donations. Following a link takes you to a service with its own policy and its own cookies, over which this site has no control and from which it receives nothing. No such service is loaded until you click.
Children
This site is not aimed at children and asks nobody for their age, because it asks nobody for anything.
How long anything is kept
Visit records are kept for statistics and carry nothing identifying, so there is no retention limit tied to a person. The cookie described above expires after twelve months.
Your rights
Under the GDPR you have the right of access, rectification, erasure, restriction, objection and portability, and the right not to be subject to automated decision-making. None of that is applied here in the usual way, and it is worth being straight about why: this site holds nothing that identifies you, so there is no record to hand over, correct or delete on request. If you believe otherwise, write and say so and it will be looked into.
If you are unhappy with how this site handles data you can complain to the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), Kifisias 1-3, 115 23 Athens, dpa.gr.
Changes
If this site ever adds analytics, advertising, a newsletter or a contact form, this page is updated before that goes live and the date below changes. It is not a document that quietly acquires new paragraphs.
Last updated 31 August 2026.