Privacy Policy

Server access logs that record a visit to this site are kept for ninety days and then destroyed. Entries in the editorial contact inbox are kept for two years from the date of the last message in the thread, and then purged on the next quarterly cleanup. Where a reader has asked to be notified of a review update by email, the address is kept for as long as the subscription is active, plus thirty days after unsubscribing to confirm removal. Backups follow the primary retention schedule with a one-month lag — a message deleted today disappears from backup copies within thirty-one days. We do not resell or rent any contact information to third parties, including Slapkong itself.

A small number of third-party services help this review site stay up and useful. Our hosting provider processes the raw web traffic, and sees the same IP addresses the server does. Our affiliate network records the referral when a reader clicks through to Slapkong — the record is a hashed click identifier, not a name or an email. If analytics are enabled, they are configured to drop the last octet of the visitor IP before storage, and we do not pass pseudonymous identifiers to advertising networks. None of these services receive content from the editorial inbox. All third-party contracts include a Canadian data processing clause consistent with PIPEDA.

If you are a Canadian resident, you have the right to request a copy of what this site holds about you, to correct it where it is wrong, and to ask us to delete it. Requests should be sent to the privacy inbox listed in the footer, from the same email address the data is linked to; where that is not possible, we will ask one or two confirmation questions to prevent impersonation. We answer in writing within thirty days of a verifiable request. If you believe we have not done enough, you can escalate to the Office of the Privacy Commissioner of Canada at priv.gc.ca; we will cooperate with any inquiry that body opens.

On a normal visit, this site collects only what the browser sends to the server: the IP address, the time of the request, the page requested, the referring page if any, and the user-agent string. If you fill in the contact form, we collect the name you type, the email you give us, and the body of the message. If you subscribe to review updates, we collect the email address and the time of the subscription. We do not run invisible fingerprinting scripts, we do not collect geolocation beyond the country level that your IP already reveals, and we do not require any Canadian government identifier.

Traffic to and from this site is served over TLS, and the certificate is renewed automatically every ninety days. The editorial inbox lives on an email provider with multi-factor authentication and audit logging; only two people have access to it. Server-side storage is encrypted at rest, backups are encrypted in transit, and the decryption keys are held in a password manager that is itself behind two-factor authentication. We review access logs for the inbox and the server on the first Monday of each month, and we rotate any shared credentials every six months even when nothing suspicious has shown up.

The data this site collects is used for three narrow purposes: to serve the pages you asked for, to reply to messages you send us, and to understand which review pages readers find useful enough to come back to. Analytics data is aggregated monthly and used to decide which Slapkong topics deserve a longer page — for example, if the no-deposit bonus page gets steady traffic from Canadian cities, we will spend more time keeping it current. Nothing on this site is used to build a personalised advertising profile, and nothing is shared with Slapkong, the affiliate network, or any other operator.

This site uses two kinds of cookies. A session cookie keeps you logged in to the contact form if you have started a message and gone away; it is set only on the form page, and it expires when you close the tab. An affiliate click cookie is set when you click through to Slapkong from one of our links; it holds a hashed identifier so that the operator knows the referral came from us, and it expires after thirty days. There are no advertising cookies and no social-network trackers. A longer, section-by-section explanation of each cookie lives on the cookies page in the footer.