Privacy policy
Last updated 3 October 2026.
Short version: you can read every guide without an account and without giving us anything. If you make an account we store your email, a hash of your password, and which items you ticked. We use one cookie to keep you logged in. There is no analytics on the site. Free accounts and visitors see ads from Google AdSense, which uses cookies; see section 5.
1. Who is responsible
FinalUnlock runs this site and is responsible for the data described here. Contact for privacy requests:
2. What we collect, and why
| Data | When | Why | Legal basis | Kept |
|---|---|---|---|---|
| Email address (stored in lower case) | When you sign up | To identify your account and let you log in | Contract (providing the account you asked for) | Until you delete the account |
| Password, stored only as a salted scrypt hash (we never store or see the password itself) | When you sign up | To check your password at log-in | Contract; security | Until you delete the account |
| Plan (free or paid) and sign-up date | When you sign up or change plan | To apply the free-plan limit and show your account page | Contract | Until you delete the account |
| Progress: which item in which guide you ticked, and when | When you tick items while logged in | To sync your checklist across your devices | Contract | Until you untick it, reset the guide or delete the account |
| Log-in session: a random token (only a keyed hash of it is stored), your account number, creation and expiry time | When you log in | To keep you logged in | Contract; strictly necessary | Until it expires (30 days by default), you log out, or you delete the account |
| Your IP address, held in the server's memory only | On log-in, sign-up and account-deletion attempts | To rate-limit repeated failed attempts (abuse and password-guessing protection) | Legitimate interests (security) | Up to 1 hour, never written to our database |
The application itself does not write an access log and does not send email. The web host or reverse proxy in front of it may keep standard server logs (IP address, time, page requested).
We do not ask for your name, date of birth, location or payment details. We do not verify email addresses, so use an address you control: there is no password-reset email at present.
3. Cookies and similar storage
The site sets one cookie, and only after you log in or sign up. It is strictly necessary for the log-in to work, so under the EU/UK ePrivacy rules it does not need a consent banner.
| Name | Kind | Purpose | Lifetime |
|---|---|---|---|
eday_sid | Cookie (first party, HttpOnly, SameSite=Lax, Secure when served over HTTPS in production) | Keeps you logged in | 30 days by default, or until you log out |
guide-progress:<game> | Browser local storage | Your ticked items on this device (everything when logged out; overflow beyond the free-plan limit when logged in) | Until you clear it or reset the guide |
eday-guide-theme | Local storage | Your light/dark theme choice | Until cleared |
eday-guide-expand, eday-guide-hide | Local storage | Whether item details are expanded and whether found items are hidden | Until cleared |
eday-last:<game>, eday-nav-collapsed:<game> | Local storage | Where you were last reading and which sidebar sections you collapsed | Until cleared |
Local-storage items stay in your browser and are never sent to us, except that progress kept on the device is uploaded when you choose to sign up or log in and it fits within your plan.
4. What we do not do
- No analytics or statistics service and no fingerprinting by us. Google AdSense measures ad views and clicks for its own reporting (section 5).
- The only third-party content is Google AdSense: its script, its ad frames and its consent messages, loaded for free accounts and visitors only. Fonts, images and everything else come from our own server under a content security policy. Game logos, key art and screenshots are not used.
- Ads are never placed between checklist items, and paid accounts see none.
- We do not sell your data, and we do not use it for profiling.
Links to other sites leave this site. Those sites have their own privacy policies.
5. Advertising
Free accounts and visitors see ads served by Google AdSense (Google LLC, or Google Ireland Limited for visitors in the EEA, the UK and Switzerland).
- Third-party vendors, including Google, use cookies to serve ads based on your earlier visits to this site or to other sites.
- Google's advertising cookies let Google and its partners show you ads based on your visits to this site and/or other sites on the internet.
- You can opt out of personalized advertising in Google's Ads Settings, and opt out of some other vendors' use of cookies for personalized advertising at aboutads.info.
- How Google uses information from sites that use its services: Google's explanation.
- In the EEA, the UK and Switzerland, Google asks for your consent before personalized ads. If you say no, you may still see ads that are not personalized, or "limited ads" that use no cookies or identifiers. You can change your answer with the "Ad choices" link at the bottom of each page.
- In US states with privacy laws, Google shows a "Do Not Sell or Share My Personal Information" link. Using it, or sending a Global Privacy Control signal, opts you out of personalized ads.
Data collected by Google AdSense is handled by Google under its own privacy policy. We receive only totals (ad views, clicks, earnings), never data about you as a person.
6. Payments
The paid plan is not on sale yet, so no payment is taken and no payment details are collected. When it goes on sale, this section will say which payment provider is used and what it receives.
7. Who we share data with
Google, as our ad provider, as described in section 5. Apart from that, nobody, except the service providers that run the site for us and anyone we are legally required to tell.
8. Where data is stored
The site and its database are hosted in the United States.
9. How long we keep data
Account data and progress are kept until you delete your account. Sessions expire after 30 days (by default) or when you log out. Deleting your account removes your email, password hash, plan, progress and sessions from the database straight away.
10. Your rights and how to use them
- Get a copy (export): Account page → “Export my data” downloads a JSON file with your email, plan, sign-up date and every saved check with its time.
- Delete: Account page → “Delete account” (asks for your password) deletes the account, saved checks and log-in sessions on every device at once. Data in your own browser is not touched; clear it in your browser settings.
- Correct or restrict, or object to processing: write to the contact address above. Your email can be corrected by deleting the account and signing up again; we will also do it on request.
- EU/UK visitors: you also have the right to portability, to withdraw any consent you gave, and to complain to your data-protection authority (in the UK, the Information Commissioner's Office).
- California residents (and residents of other US states with privacy laws): you may ask what we collect, to have it deleted or corrected, and to opt out of the sale or sharing of personal information for advertising. Use the "Do Not Sell or Share My Personal Information" link Google shows, or a Global Privacy Control signal. We will not discriminate against you for using these rights.
We answer requests within one month.
11. Age
The site is for people aged 13 and over. Do not create an account if you are under 13. We do not knowingly collect data from children under 13; if we learn that we have, we will delete it. If you are a parent and think your child has made an account, contact us.
12. Security
Passwords are stored only as salted scrypt hashes. Only a keyed hash of each session token is stored, so a copy of the database cannot be used to log in. The session cookie is HttpOnly, SameSite=Lax and, in production, Secure. Requests that change data must come from our own site. Repeated failed log-ins are slowed down. No system is perfectly secure; tell us if you find a problem.
13. Changes
We will update this page when what we do changes (for example when ads or real payments are added), and change the date at the top. For significant changes affecting account holders we will try to tell them.