Privacy Policy

Who we are and what this policy covers

The operator and named contact is MOHAMMAD WASEEM YAQUB, using the MCDONALDSMENUUK brand for the game discovery website at https://gamehub.mcdonaldsmenuuk.com. This policy explains information handled through our own pages and the privacy implications of loading independently hosted games. For questions or to make a privacy request, contact [email protected]. We do not require a MCDONALDSMENUUK account to browse or play.

Third-party developers and hosting providers operate the embedded games. Their own notices apply to information they collect inside those games. Our inclusion of a game does not make us its developer or the controller of every use of information by that provider.

Privacy at a glance

You can browse our catalog without creating an account. Our homepage, category pages and game detail pages load Google Publisher Tag. No separate first-party analytics tag is configured. The business model planned for this website is advertising-supported game discovery using Google AdSense and, if an authorised relationship is established, Google Ad Manager / Ad Exchange (AdX). The configured GPT integration can connect to Google; references to other planned products do not mean they are all enabled.

• Saved games and recent game history use browser-local identifiers rather than a named online profile.
• A game detail page describes an external game; the separate Play page connects to that game's host.
• Email support involves information you choose to send and is handled separately from browsing.
• Any future optional advertising storage and personalisation must follow the applicable consent or opt-out requirements.
• Use the footer's Privacy choices link to inspect the current status and clear our local game data. This control does not currently record an advertising-consent decision.

The sections below give the detail behind this overview. For a question about information handled by this website, contact MOHAMMAD WASEEM YAQUB at [email protected]. We do not ask you to register, supply a phone number or purchase anything to submit a privacy request.

Current features and advertising status

This version loads Google Publisher Tag (GPT) on the homepage, category pages and individual game detail pages. The homepage displays placements Content1 and Content2; categories display Content3; game details display Content2 and Content3. No first-party analytics tag or third-party consent platform is included in this build. Browsing a game detail page does not load that game's external frame. A third-party game connects only when you open its dedicated play page using Play. That choice allows the connection; it is not consent to personalized advertising or all processing by the game provider.

Google Ad Manager ad-unit paths are configured under network 23390214768. Loading GPT connects to Google and may initiate ad delivery and associated processing. Whether an ad fills depends on inventory, demand, settings and eligibility. AdSense and additional AdX demand relationships are not established by these tags alone. Applicable consent and opt-out tools still need to be configured; our local-data dialog is not an advertising CMP.

Information involved in using the website

• Connection and security information: your browser sends an IP address, request URL, timestamp, browser and device information, and potentially a referring page to the infrastructure serving the site. Hosting and security providers may keep operational logs according to their configuration.
• Saved games: if you select Save game, game identifiers are stored in local storage on your device. No account, name or email is needed. These favorites are not intentionally transmitted to a MCDONALDSMENUUK profile server.
• Recently played: local storage keeps up to 20 game identifiers and the times you opened them, for up to 30 days. This history stays in this browser and does not save your in-game progress. You can clear it from Recently played or Privacy choices.
• Discovery state: session storage holds the previous homepage selection so the next visit can show a different ordering. Search and category filtering run in the browser; our interface does not send search terms to a dedicated analytics endpoint.
• Messages you send: contacting us by email provides your email address, message and any attachments you choose to include. Our email provider processes that correspondence.
• External games: once loaded, a game host receives connection information and may process game actions, identifiers, cookies, local saves, audio settings, progress and advertising data under its own policies.

We do not ask for payment information, a precise location, government identifiers, contacts, camera or microphone access. Please do not include sensitive personal data in support emails.

Sources of information and data categories

Information can come directly from you, from the browser requesting a page, and from service providers carrying out an activity you initiate. We do not currently import purchased audience lists, collect a social-media contact graph, or require a sign-in with Google or another social network.

We do not intentionally request special-category information such as health, religion or political beliefs, and do not build first-party audiences around those subjects. Please redact unrelated personal information from screenshots or reports. Advertising-related categories in this table describe a possible future integration rather than a completed inventory of currently enabled vendors.

Purposes and legal bases

We use information needed to deliver requested pages and features, maintain security, troubleshoot errors, answer correspondence, respect rights requests and comply with applicable obligations. Where the GDPR or UK GDPR applies, relevant bases may include providing a requested service, legitimate interests in a functioning and secure website, compliance with a legal obligation, and consent for processing that legally requires it. We assess the circumstances of the particular processing; a legal basis is not a blanket permission for unrelated use.

Where required, optional cookies, advertising personalization and associated data processing must depend on prior valid consent. You may withdraw consent without affecting the lawfulness of processing carried out before withdrawal. Merely browsing, accepting the service terms, or loading a game does not replace legally required consent.

Cookies and device storage

Browser settings can block or delete cookies and site data, including third-party storage. Blocking storage can affect saved games or game functionality. The Privacy choices controls clear MCDONALDSMENUUK's three storage keys; they cannot delete storage held on another domain.

Google advertising and data use

For configured Google Ad Manager placements, third-party vendors including Google may use cookies, web beacons, IP addresses, device identifiers and similar technologies to serve and measure ads. Those vendors may serve ads based on your previous visits to this website and other websites. Google's advertising cookies enable Google and its partners to present ads based on visits to this and other sites across the Internet, subject to applicable permissions and settings.

Ad-related processing can include ad delivery, frequency capping, aggregate reporting, viewability and performance measurement, fraud and invalid-traffic detection, security and, when permitted, personalization. Non-personalized advertising can still involve cookies or other storage for functions such as measurement and fraud prevention; it does not automatically remove consent obligations.

Read How Google uses information from sites or apps that use its services, Google's Privacy Policy and Google's advertising technology information. Manage Google's personalized advertising through My Ad Center. Additional industry choices are available through DAA WebChoices and Your Online Choices. These controls may be specific to a device or browser and do not necessarily stop all advertising.

Google Publisher Tag is the configured first-party advertising integration. No separate header-bidding vendor or AdX partner has been configured in this build. The deployed consent interface must identify the actual participating vendors, their purposes and privacy notices. We do not send names, email addresses or other directly identifying personal information to Google through advertising tags.

AdSense, Google Ad Manager and AdX: different roles

Google AdSense is a publisher service that can display ads on eligible website inventory. Google Ad Manager is a system for managing advertising inventory and delivery. Ad Exchange, commonly called AdX, is programmatic advertising demand that may be available through an eligible publisher arrangement or an authorised partner. Mentioning these products does not imply that this website has been accepted into them or has direct access to AdX.

If activated, ads may be selected using the page context, broad location, device characteristics, permitted identifiers, advertiser criteria and available demand. An ad auction is used to choose advertising opportunities; it is not a gambling or wagering feature for website visitors. Actual bidders and technology providers depend on the publisher account, enabled demand and consent configuration.

The website operator remains responsible for this site's own integration and notices. Google and other participating providers may have independent responsibilities under their terms and privacy policies. Their role is determined by the actual service and activity; we do not describe every participant as a processor acting only on our instructions.

We do not currently operate header bidding, a first-party advertising audience service or a named third-party monetisation partnership on these pages. If a partner or additional demand source is introduced, we must identify the relevant organisation, explain its processing and make its policy and available controls accessible before relying on that integration.

Ad requests, auctions, measurement and fraud prevention

An enabled advertising request can convey information needed to evaluate and deliver an ad, such as the domain and page context, the available ad size, browser and device attributes, network information, approximate geography, privacy signals and permitted cookies or other identifiers. The exact fields depend on the product, region, account settings, consent status and browser restrictions. An advertiser's landing page can collect separate information if you choose to visit it.

Advertising providers can use technical events to report whether an ad was delivered or viewable, prevent excessive repetition, measure performance, investigate suspicious traffic and protect against malware or fraud. Where permitted, some providers may associate activity across sites or devices. We do not intentionally supply email correspondence, names, contact details, passwords or other directly identifying support information as advertising parameters.

Our own page code must not add personal information to ad targeting values or deliberately include it in advertising URLs. Avoid entering private information in a game search field or sharing a URL that contains it. Future production diagnostics should minimise unnecessary URL parameters and avoid recording private message content.

We do not use an advertising score to make decisions about employment, credit, housing or similar eligibility. Choices made by ad-delivery systems can affect which advertisement you see; they do not create a right to a reward or change your legal access to ordinary game browsing.

Personalised, contextual and limited advertising

Personalised advertising may use permitted information about previous activity or inferred interests to choose an ad. Contextual advertising may relate to the page you are viewing, its general subject or other permitted context. Non-personalised and limited-ad modes are product settings with their own technical conditions; their names should not be read as a guarantee that no personal data, network connection, security event or device storage is involved.

We must configure the actual service to match the choices you make and the rules that apply to you. Refusing an optional purpose should not be treated as permission for that purpose under another label. If a supported configuration cannot serve an ad under the applicable privacy state, the site can continue showing its ordinary content without that ad.

Your Google account settings, browser restrictions, site-level choices and vendor settings may each affect delivery. A choice on one device, origin or provider does not necessarily propagate to every other environment. Clearing cookies can remove a stored choice and cause the relevant platform to ask again.

Consent and advertising choices

Before serving relevant Google ads to visitors in the European Economic Area, United Kingdom or Switzerland, we must implement the applicable Google consent requirements, including a Google-certified consent management platform integrated with the IAB Transparency and Consent Framework where required. Optional tags must respect the choices collected by that platform. A generic notice or our local Privacy choices dialog is not a substitute for that certified platform.

You should be able to review, refuse or change optional purposes and withdraw consent through the deployed consent platform when advertising is introduced. At present, Privacy choices explains the advertising implementation and lets you clear the site's saved game and discovery data. For other requests, email [email protected].

EEA, United Kingdom and Switzerland

Where applicable data-protection and electronic-communications rules require prior consent, optional access to or storage of information on your device must wait for a valid choice. Accepting the Terms of Service, continuing to browse, or pressing Play is not a substitute for consent to unrelated advertising purposes.

Before serving personalised Google publisher ads to visitors in the EEA, UK or Switzerland, the applicable integration requires a Google-certified CMP supporting the IAB Transparency and Consent Framework. The deployed platform must communicate the relevant purposes and vendors, collect the appropriate choices, and pass supported signals to the advertising stack. Certification of a CMP does not by itself establish that every aspect of a publisher's implementation complies with privacy law.

When implemented, the consent controls should let you review purposes and vendors, reject optional processing, make a granular choice where supported, and revisit or withdraw consent. Where an applicable legal basis permits an objection rather than consent withdrawal, the interface should explain that distinction. Withdrawal applies prospectively and does not reverse processing that was lawful before the change.

You may complain to the supervisory authority responsible for your location, including the UK Information Commissioner's Office where applicable. Contact us first if you would like help understanding an activity on this site; doing so is not a condition for exercising a right to contact a regulator.

Additional information for United States residents

Privacy rights and the definitions of sale, sharing and targeted advertising vary by state and can depend on whether a business and activity fall within a particular law. This section does not claim that every state law applies to this website. The information-category, purpose and recipient sections above explain our described activities; we do not claim a historical twelve-month processing inventory that has not been verified.

Google Publisher Tag is configured on selected pages. If the actual advertising configuration amounts to a sale, sharing or targeted advertising under applicable law, we must provide the required notice and effective opt-out mechanism before the relevant processing. A promise to consider a preference later does not implement that mechanism.

Where legally required, recognised opt-out preference signals such as Global Privacy Control must be respected for the applicable processing. Our current local-data dialog does not implement a full US advertising opt-out platform and must not be presented as one. Browser Do Not Track and Global Privacy Control are different signals. Future ad scripts must not start restricted processing merely because no consent button was clicked.

Where applicable, you may request access, correction, deletion, portability, information about recipients, or an opt-out, and may use an authorised agent subject to proportionate verification. We do not offer financial incentives in exchange for personal information. We will not penalise an exercise of statutory rights. An appeal, where provided by law, can be requested by replying to a rights decision with “Privacy appeal”.

Recipients and international processing

Information may be processed by hosting, security and email service providers as needed to deliver those services; by game hosts you choose to connect to; and, if enabled in future, disclosed advertising and consent-management partners. We may disclose relevant information when legally required, to respond to valid process or to protect users and the service against abuse. We do not operate a first-party personal-data marketplace. The production hosting provider, log configuration and any future ad-technology vendors must be confirmed and reflected in the disclosures before additional processing is enabled. Contact us about a particular recipient; we do not invent provider names, business addresses or transfer safeguards.

Infrastructure, email and game providers can process information in countries other than your own. Where applicable, transfers of personal data require an appropriate legal mechanism and safeguards. Contact us for details about a specific MCDONALDSMENUUK-controlled transfer; independent game providers are responsible for their own transfers and notices.

Retention and security

Local favorites remain until you remove them or clear browser data. Recently played history retains up to 20 entries for up to 30 days; expired entries are ignored and removed when the history is next read or updated. Discovery state lasts for the browser tab session. We keep support correspondence only as long as reasonably needed to address the matter and meet legitimate legal or security needs. Operational log retention depends on the hosting provider's configuration. We do not claim a fixed log-retention period that has not been verified with the production host.

We use proportionate measures to protect information and minimize unnecessary third-party requests. No website, transmission or external game can be guaranteed completely secure. Report suspected security issues privately to [email protected]; include the affected URL and sufficient detail to reproduce the issue without exposing other visitors' data.

Retention criteria and deletion limits

Different activities need different retention periods. Local feature durations are listed in the storage table. For support correspondence, relevant factors include whether a matter is open, whether follow-up is reasonably expected, whether the material is needed for a rights or security investigation, and any applicable legal retention requirement. We aim to avoid keeping unrelated attachments or unnecessary sensitive information.

Infrastructure log periods, email backup cycles and advertising-vendor retention are controlled by the actual services and configurations. No fixed production retention schedule has been supplied for those services, so this notice does not invent one. Ask us about a particular activity if you need more detail; vendor-specific periods and cookie lifetimes must be reflected in the actual deployed partner disclosures.

Deletion of active records may not immediately erase every encrypted backup or legally preserved record. Where an applicable exception permits retention, retained information should be protected and limited to that purpose. Removing a game from our catalog does not itself delete data previously collected by the game's independent host.

Your privacy rights

Depending on your location and applicable law, you may have rights to access, correct, delete or receive a copy of personal information, restrict or object to processing, withdraw consent, and complain to your local data-protection authority. If relevant US state privacy laws apply, these may also include rights to know, data portability, and opting out of a sale, sharing for cross-context behavioral advertising or targeted advertising. Google Publisher Tag is configured on selected pages. Where the actual advertising processing falls within those definitions, appropriate opt-out mechanisms and recognition of legally required preference signals must be implemented before that processing begins.

To request help, email [email protected] with the subject “Privacy request” and describe the request and relevant interaction. We may ask for proportionate verification, will not require unnecessary sensitive documents, and will respond within applicable legal deadlines. We will not discriminate against you for exercising applicable rights. If an applicable right to appeal exists, reply to our decision asking for review. Browser Do Not Track settings do not have a universal response standard; do not rely on that setting alone as an opt-out mechanism.

How to submit and follow up a privacy request

1. Email [email protected] with “Privacy request” and the type of request in the subject.
2. Describe the interaction involved, an approximate date and the relevant page or game URL. If the issue is only a saved game or local history, the browser controls may resolve it without disclosing further information to us.
3. Tell us the response address you want us to use. We may need reasonable verification if a request could disclose or change personal information.
4. We will assess applicable rights, locate information under our control and explain the result within the period required by the relevant law. If a lawful extension or exception applies, we will explain it as required.

We do not need a passport or payment information merely to receive a request. Do not send those documents unless a specific, proportionate and lawful need has been explained. If an agent contacts us, we may ask for evidence of authority and any verification permitted by law.

We cannot locate a browser's local favourites on a central user account because no such first-party account is created. We also cannot directly erase another provider's database or a browser's storage on a different origin. We will explain those limits and, where possible, point you to the relevant provider. Legal obligations, security needs or protection of another person's rights may limit a requested action; those limits do not remove unrelated rights.

Children and families

MCDONALDSMENUUK is a general-audience discovery service, not a service specifically directed at children under 13. We do not knowingly solicit personal information from children under 13, or below a higher applicable local age without appropriate authorization. Families should supervise access to external games, which can have separate content, advertising and age requirements. A colorful cover is not an age rating.

If you believe a child has provided us personal information, contact [email protected] so we can investigate and take appropriate action. Do not send additional information about a child beyond what is necessary to identify the concern. We do not knowingly permit personalized advertising based on the data of users for whom that processing is prohibited.

Security incidents and privacy-sensitive reports

We minimise first-party data collection and avoid loading a game frame on its descriptive catalog page. Game frames use browser isolation controls, but a sandbox and an encrypted connection do not guarantee that every provider's code, linked page or advertisement is safe.

If you suspect unauthorised access or a disclosure involving our website, email [email protected] with “Security report”. Give the affected URL, the approximate time, your browser, a brief description and safe reproduction steps. Please do not exploit the issue further, access other people's records or publish private data as evidence.

We will assess reports and take appropriate action within our control. Where a personal-data incident triggers notification duties, we will follow the applicable requirements based on the facts and risk. We do not promise a universal notification window irrespective of the law or circumstances.

External controls and useful resources

Google provides explanations of its advertising information practices at How Google uses information from sites or apps that use its services and Google advertising technologies. Google account advertising preferences are available through My Ad Center. Advertising networks other than Google may offer their own controls; those actual networks must be identified if enabled on this site.

Industry tools, including DAA WebChoices and Your Online Choices, can help with participating companies. These tools are external services, are not a replacement for a required site-level CMP, may depend on cookies or browser support, and do not necessarily prevent all advertising, measurement or information collection.

You can also inspect site permissions, block third-party cookies and clear site data in your browser. These actions can remove game progress or remembered choices. For a concern about a specific ad, use the ad's available reporting controls or send us the page URL and a safe screenshot; do not repeatedly click an ad to investigate it.

Updates and contact

This policy was updated on November 3, 2026. We will revise the date and disclosures when relevant features, partners or practices change, and provide additional notice or obtain new consent when required. Questions and complaints can be sent to [email protected]. You may also review our Terms of Service, Cookie Policy and Contact page.