Privacy policy

The Cutaway is an unincorporated editorial collective of six people operating from a rented room in the Toffee Factory, Lower Steenbergs Yard, Ouseburn, Newcastle upon Tyne NE1 2DF. We are the data controller for anything described on this sheet. There is no parent company, no holding structure and no third party with a commercial interest in the site.

For any question about this policy, write to [email protected] or use the postal address above. Marged Fenwick handles data questions on behalf of the desk. We do not employ a data protection officer, because at our size we are not required to and it would be dishonest to pretend otherwise.

• We run no analytics. Not a self-hosted instance, not a privacy-friendly alternative, nothing.
• We run no advertising and carry no third-party tracking scripts of any kind.
• Every stylesheet, script, font and image on this site is served from our own domain. Your browser contacts nobody else while reading it.
• Two values are stored locally in your browser, described in detail on the cookie policy sheet. Neither leaves your device.
• The only personal information we ever receive is what you deliberately send us by email or post.
• We sell nothing, share nothing with advertisers and have never transferred a reader's details to anyone.

That is the complete list. There is no customer database, no membership register, no mailing list and no account system, because the site has nothing to log into.

Under the UK General Data Protection Regulation every use of personal information needs a lawful basis. Ours are as follows.

Two categories of third party are unavoidable and both are named here.

Our hosting provider operates the servers on which these pages sit and generates the request logs described above. Their infrastructure for this site is located in the United Kingdom and the Republic of Ireland. They act on our instructions under a written processing agreement and have no independent right to use anything they hold on our behalf.

Our email provider handles the desk addresses and therefore stores your messages on its infrastructure. Mail is held within the United Kingdom and the European Economic Area. We chose a paid provider specifically so that message content is not processed for advertising purposes.

Beyond those two, nobody. We have never sold, rented, swapped or otherwise transferred reader information, and there is no circumstance in which we would — not to a publisher, not to a games company, not to another publication. If the desk ever closes, the correspondence archive will be deleted rather than transferred.

All processing described on this sheet takes place in the United Kingdom, the Republic of Ireland or elsewhere in the European Economic Area. We do not use any service that routinely transfers personal information outside those jurisdictions, which is one reason every font and script on this site is served from our own domain rather than a content delivery network.

Should that ever change, this sheet will be revised before the change takes effect and the revision will be dated at the top.

Retention periods are given in the table in section three and we hold to them. In practice this means correspondence is reviewed every January and anything older than two years since the last exchange is deleted. Postal items are shredded on a twelve-month cycle. Server logs are deleted by the provider after fourteen days and we have no ability to extend that.

The exception is the published amendment log, which is retained indefinitely because it is part of the editorial record. Entries there contain no personal information beyond a town name, and even that is included only where a reader supplied it.

UK data protection law gives you a set of rights over information we hold about you. All of them are exercised by writing to [email protected], and none of them costs anything.

This site publishes long analytical writing about games and is not directed at children. We do not knowingly hold information about anyone under thirteen. If a message plainly comes from a child, we reply briefly, do not retain the address and do not add anything to the correspondence archive. If you believe we hold information about a child, write to the privacy address and we will delete it.

The site is served over an encrypted connection. Desk email accounts require two-factor authentication and are accessible only to the six people named on the bench sheet. Correspondence is not copied onto personal devices or into shared documents. Postal items are kept in a locked cabinet in the room and shredded on the schedule described above.

None of that is elaborate, and we are not going to describe it as enterprise-grade. It is proportionate to holding a small number of email threads from readers, which is all we hold.

When this policy changes we revise the date at the top and describe what changed. The last revision, on 20 July 2026, removed a section about a newsletter list we had set up and never used; the list was deleted along with the four addresses on it, and all four people were told. The version before that, dated 6 March 2026, was the first.

We will not make a material change quietly. If something significant alters — a new processor, a new category of information, anything you would want to know about — it will be described here and on the front sheet before it takes effect.