Giveaway Privacy Notice
Last updated:
This notice covers the Age of Failon – Steam Key Giveaway. Read it with the Official Rules, version AOF-GIVEAWAY-2026-V1 and our Website Privacy Policy.
1. Controller and contact
The controller is Miloš Tutko, a self-employed individual operating under the brand Xarox Games.
- Business Identification Number (IČO): 24039314
- Registered Business Address: Opavská 109/27, 793 42 Rýmařov – Janovice, Czech Republic
- Email: [email protected]
- Website: xaroxgames.com
2. Information processed and its sources
We receive the giveaway code registered through the demo and the information you provide through the entry form or correspondence. The service also creates records to verify and administer entries:
- Your Reddit username, including a normalized form used to detect duplicate entries.
- Your Reddit account age and combined post and comment karma, where checked by the Organizer during the final eligibility review against the requirements at the entry deadline.
- Your required public Reddit comment, its author and posting time, and the result of the Organizer's manual comparison with the submitted username and code.
- Your unique giveaway code, verification attempt identifier, assigned questions and temporary verification session.
- Your selected quiz answers, calculated result and the drawing weight described in the Official Rules.
- Your feedback, rules acceptance, accepted rules version and acceptance/submission timestamps.
- Entry status and a submission fingerprint used to recognize an already-submitted entry.
- Winner notifications, replies, prize claims and fulfillment records when prizes are awarded.
- Technical request information needed to deliver and secure the service, including an IP address used for request-rate limits and technical or security logs processed by the hosting provider.
If you email us, we receive your email address and message. Please do not include passwords, payment details, sensitive personal information or unnecessary information about other people in feedback or correspondence.
3. Purposes and legal bases
Where the GDPR applies, we use these bases for the respective purposes:
- Participation (Article 6(1)(b)): processing necessary to administer your requested entry under the Official Rules, verify eligibility, record answers and rules acceptance, conduct the draw, contact winners and deliver prizes.
- Legitimate interests (Article 6(1)(f)): securing the service, preventing duplicates and abuse, resolving disputes, defending legal claims and using feedback to understand player experiences and improve the game, subject to your rights and interests.
- Legal obligations (Article 6(1)(c)): processing or retaining records where an applicable law requires it.
Accepting the Official Rules is not consent to marketing. Personal data will not be sold to advertisers. Submitting feedback does not grant permission to publish it with your identity for promotional purposes; that requires a separate appropriate legal basis or permission.
4. Participation and automated processing
Participation is voluntary. The code, Reddit username, eight answers, feedback of 80–1,000 characters and rules acceptance are required by the entry process. Without them, the service cannot accept a complete entry. The form does not require an email address. Winner notifications use Reddit private messages from u/mtutko.
The service automatically validates submissions and calculates the quiz result. Under the Official Rules, all valid entries remain eligible: 0–2 correct answers give a weight of 1×, 3–4 give 3×, 5–6 give 6×, and 7–8 give 10× in the random draw. A higher weight improves the chance of selection but does not guarantee a prize; each selected winner is removed from later draws. Feedback sentiment does not affect eligibility or drawing weight.
Individual results and drawing weights will not be publicly disclosed. Contact us if you believe an entry has been handled incorrectly or wish to raise a concern about the processing or drawing procedure.
5. Hosting, recipients and external services
After successful website submission, you must publicly post the same giveaway code under the official Reddit giveaway post using the account named in your entry. This makes the code and its connection to your Reddit username visible to other Reddit users and potentially search engines or people who copy public content. The Organizer checks the comment manually on the draw day. Both steps must be completed before 20 November 2026, 00:00 UTC; keep your comment available for that check.
Cloudflare provides website hosting through Pages and the giveaway service through Workers and D1. It processes hosted entry data on our behalf and technical information needed to operate and secure its services. See the Cloudflare Privacy Policy and Data Processing Addendum.
Reddit processes your account and private messages under its own Privacy Policy. We use it for participant identification and winner communication. If you email us, the email services involved also process that correspondence. Information may be disclosed to competent authorities where legally required or as necessary to establish, exercise or defend legal claims.
Steam processes activation and use of a prize key under its own Privacy Policy. The giveaway form does not request Steam login credentials.
6. International processing
Cloudflare operates internationally, so information may be processed outside the European Economic Area. Its Data Processing Addendum describes the applicable transfer framework, including Standard Contractual Clauses and additional safeguards for restricted transfers. Contact us for information about safeguards relevant to your data. Reddit and Steam describe their own international processing in their policies linked above.
7. Retention
The Organizer will retain ordinary Giveaway data only for as long as reasonably necessary to complete the Giveaway and prize distribution, with a target of deletion within 30 days after the final prize distribution process is completed.
Certain records may be retained longer where necessary to comply with legal obligations or establish, exercise or defend legal claims. Cloudflare technical and security information is also subject to its service and retention arrangements; the target for ordinary Giveaway data does not promise deletion of all provider logs within that period.
Correspondence is kept for as long as necessary to address the enquiry or claim and related obligations.
Deleting Giveaway records held by the Organizer does not automatically delete your Reddit comment or copies held by others. Reddit manages its own retention and removal processes under its policy. Removing the required comment before verification makes the entry invalid under the Official Rules.
8. Drafts, sessions and browser storage
The form keeps your draft and verification token in the current open page. It does not save them in cookies, local storage or session storage. Reloading or closing the page clears the draft. Re-verifying the same code in the same open page can restore access to that draft; it does not retrieve an unfinished draft from the server.
After server-confirmed submission, the page displays your code so you can copy it into the required Reddit comment. The code remains only in that open page; it is not added to the page URL or browser storage. Save it privately before leaving the page if you have not completed the comment step.
Code verification creates a server-side attempt record and assigned question set, even if you do not submit. A submitted entry remains on the server after the browser page is closed. The giveaway form does not add advertising or analytics tracking.
9. Your rights
Depending on the circumstances, you may request access, correction, erasure, restriction or portability. You may object to processing based on legitimate interests. These rights have legal conditions and exceptions; a request does not necessarily require deletion of every record.
Email [email protected] to exercise your rights. Include enough information to identify the relevant entry, such as your Reddit username, but do not send passwords. We may need proportionate information to verify your identity.
You may complain to the Czech Office for Personal Data Protection (ÚOOÚ) or another competent supervisory authority, including where you live or work in the EU.
10. Updates
Changes will be published on this page with an updated date. Questions can be sent to [email protected].