Effective 19 August 2026 — replacing the version dated 4 July 2026.
FreeFireSpace — the free tool for making a spaced, blank or invisible Free Fire name — runs no analytics, shows no ads and sets no cookies of its own. The name you type into the tool stays in your browser and is never sent to our server. But some things still reach us: server log lines, anything you type into the search box, and your real IP address if our firewall blocks you or a login here fails. All of it is set out below.
What we collect, in one table
From a normal visit, FreeFireSpace collects a web server log line and any text you type into the site search box — nothing more. The table below also lists the few extra records that appear only if the firewall blocks you, a login here fails, or you email us.
| Data | Do we collect it? | Where it lives | Kept for |
|---|---|---|---|
| The name you type into the tool | No — it stays in your browser | Your device only | Until you close the tab |
| Your name, email, phone | No — there is no visitor account and no contact form | — | — |
| Analytics on your behaviour | No — no analytics tool is installed | — | — |
| Advertising / profiling data | No — the site shows no ads | — | — |
| Web server log: Cloudflare’s IP, time, page, browser | Yes — automatic, like every web server | Our server | Months — currently back to Feb 2026 |
| Anything typed into the search box | Yes — it travels inside the web address | Same server log | Same as the log above |
| Your real IP, if the firewall blocks you | Yes — only for a blocked request | Firewall database | About 30 days |
| Your real IP, if a login here fails | Yes — only for a failed login | Firewall + scanner files | Months — back to Feb 2026 |
| Encrypted nightly backup of our database and site files | Yes — it includes the security records above, but not the server logs | Backblaze B2 | About 2 weeks |
| Email you choose to send us | Yes — because you sent it | Our mailbox | Until the matter is closed |
On this page
- What we collect, in one table
- What happens to the name you type
- The site search box
- Analytics and advertising: we run none
- Cookies
- Server logs, and how long we keep them
- When we do see your IP address
- Who else sees anything
- Who is responsible, and where data goes
- If you email us
- Children’s privacy
- Your rights (GDPR, CCPA, India DPDP)
- Changes to this policy
- Non-affiliation and the Unicode character
What happens to the name you type
The name you type into the tool never leaves your device. The tool is plain JavaScript running in your browser: it puts the invisible character U+00A0 into a text box and copies the result to your clipboard. Nothing is submitted, and no database row is created. If you asked us for your old names, we could not show them. We never had them.
You can check this yourself in about ten seconds. Open your browser’s developer tools, go to the Network tab, type a name and press copy: nothing carrying your text is sent. You may see the site quietly loading pages you hover over — that is a speed feature, and it never carries your text.
The site search box
The search box is the one part of this site that does send your text to us. A search travels inside the web address — freefirespace.com/?s=your+words — so it is written into the ordinary server log, exactly like any other page address.
We store searches nowhere else, we do not analyse them, and there is no search history feature. But they are in the log, and that log is currently kept for months. If you would not want a nickname sitting in a server log, paste it into the tool instead of the search box. The tool never sends it.
Analytics and advertising: we run none
This site runs no analytics and no advertising. As of 19 August 2026 it loads no Google Analytics, no Google Tag Manager, no Google AdSense, no Meta/Facebook pixel, no Microsoft Clarity and no Hotjar. We do not know how many visitors we get on any given day.
You can check this too: view the page source, and every script and stylesheet comes from freefirespace.com itself. Until 19 August 2026 our theme also told your browser to open a connection to Google’s font servers. It loaded no font — it was left over from a setting we do not use — and we removed it the same day we found it.
An earlier version of this policy said we “may use services like Google Analytics”. That sentence came from a template and never described this site.
Cookies
We set no cookies of our own. No analytics cookie, no advertising cookie, no preference cookie — we checked the live server response with several browsers on 19 August 2026 and no cookie from us was set.
Cloudflare, which protects and speeds up the site, may set its own short-lived security cookie such as __cf_bm. It exists to tell real people apart from bots, it is not used for tracking or advertising, and it usually expires within about half an hour. We cannot turn it off without dropping the protection, so we name it here instead. There is no cookie banner on this site because there is nothing from us to consent to, and the tool works fine if you block cookies completely.
Server logs, and how long we keep them
Our web server keeps two logs — an access log and an error log — and there are two things you should know about them.
Neither log contains your IP address. Every request reaches us through Cloudflare, and our web server is not set up to recover the original visitor address, so what gets written down is Cloudflare’s address, not yours. We checked the last five thousand entries on 19 August 2026 and every visitor entry was a Cloudflare address.
We keep those logs much longer than we meant to. The housekeeping rule that is supposed to clear them only fires once a file passes 100 MB, and neither has reached that size since 24 February 2026 — so both still hold every request since then. Alongside Cloudflare’s address it holds the time, the page requested (including any search), your browser’s identification string and the page you arrived from. We had believed this was a matter of days. We are removing the size condition so the log clears daily, and we will update this section with a date once that is done.
When we do see your IP address
Our security plugins do receive your real IP address from Cloudflare, and they write it down in two situations: when the firewall blocks your request, and when a login attempt on this site fails. Normal browsing is never recorded — the firewall’s visitor-logging feature is switched off here.
- Blocked requests are kept for about 30 days, then cleared automatically.
- Failed logins are kept by count rather than by date — the newest 2,000 attempts — which in practice reaches back to 28 February 2026. Our file scanner keeps its own copy of the same events, with the IP and browser used. That copy reaches back further still — to 24 February 2026 — and nothing clears it automatically.
If you only ever read pages and use the tool, none of this applies to you: nothing here records an ordinary visitor’s IP address.
Who else sees anything
- Cloudflare — sits in front of the site, so every request passes through it and it sees your real IP address. It is also the source of the security cookie described above. See the Cloudflare Privacy Policy.
- Wordfence — the firewall. It stores the IPs described above and shares attack patterns with the Wordfence Security Network so other sites can be protected. See the Wordfence Privacy Policy.
- Sucuri Scanner — checks our files for tampering. It has no API key here, so it uploads no audit log and makes no request on your behalf. It does keep local files recording failed logins, with the IP and browser of whoever tried; nothing clears them automatically.
- Backblaze B2 — holds our nightly backups, which include the security records above. They are scrambled on our server before upload, so B2 stores only data it cannot read. See the Backblaze Privacy Notice.
- Telegram, and the mailboxes that receive our alerts — every message this site sends by email is also copied to a private Telegram channel we use for monitoring, and the alerts themselves land in two ordinary mailboxes, one of them at a large email provider. Security alerts can carry the IP address of a blocked request or a failed login, so Telegram and both mailbox providers can see it. Nothing about an ordinary visit is sent this way. See the Telegram Privacy Policy.
Our database holds no records of ordinary visitors — only the blocked requests and failed logins described above. There is no visitor account system, no comment section and no visitor profile of any kind.
Who is responsible, and where data goes
FreeFireSpace is run by a single private individual publishing under the editorial name FreeFireSpace Editorial. That person is the data controller — the one responsible for the decisions described on this page — and is reachable at contact@freefirespace.com. The same address is our complaints channel, including complaints made under India’s Digital Personal Data Protection Act 2023.
Where the GDPR applies, our legal basis is legitimate interest — Article 6(1)(f), the reason that lets a website keep a security log without asking you first. It covers the server log, the firewall and any reply we send you by email. We rely on consent for nothing, because we set no cookies and run no tracking that would need it.
Cloudflare, Wordfence, Backblaze, Telegram and the two mailboxes that receive our alerts all run worldwide infrastructure, so data passing through them may be handled outside your own country, including in the United States. Where a provider publishes its own privacy terms we have linked them in the section above. Beyond those services, we copy visitor data nowhere.
If you email us
Emailing contact@freefirespace.com is the clearest way you can deliberately give us personal data — the site search box is the other, and it is described above. We keep your message while we deal with it and for a short period afterwards in case you write again about the same thing, then delete it. We do not have a mailing list, and we never pass your address to anyone else.
There is no contact form and no comment section on this site — comments are switched off everywhere, so there is no nickname, vote or profile of yours in our database. What we can and cannot help with is on the contact page.
Children’s privacy
Free Fire has many young players, so we assume some visitors here are children and we built the site accordingly. There is no sign-up, no profile, no advertising and no behavioural tracking, and nothing on this site asks a visitor of any age to identify themselves.
We never ask anyone for personal details, so the only data of a child we could hold is a server log line and a search query. Different countries set different ages — 13 under the United States’ COPPA, 13 to 16 under the GDPR, and 18 under India’s Digital Personal Data Protection Act 2023 — and these rules apply to handling a child’s data whether or not we asked for it. If you are a parent or guardian and this worries you, email us with the approximate date and we will delete what we find and confirm when it is gone. One honest limit: encrypted backups already taken cannot be edited, so a copy may sit there until it expires after about two weeks.
Your rights (GDPR, CCPA, India DPDP)
You have the right to see, correct, delete and take a copy of your personal data, and to object to it being used. Our visitors come mainly from India and the wider English-speaking world, so the rules that realistically apply are India’s Digital Personal Data Protection Act 2023, the EU/UK GDPR and California’s CCPA/CPRA.
- See or delete your data — if you have never emailed us and were never blocked, the only trace is a log line that does not carry your IP. Tell us an approximate date and any search text, and we will look and delete what we find, apart from encrypted backups that expire on their own after about two weeks.
- Do not sell or share my personal information — we have never sold or shared personal information, and we do not do cross-site advertising of any kind. There is nothing to opt out of.
- Complain — you can complain to your local data protection authority. We would appreciate the chance to put it right first.
To use any of these rights, email contact@freefirespace.com with [PRIVACY] at the start of the subject line. We aim to answer in writing within 48 hours on weekdays, and there is no fee.
Changes to this policy
FreeFireSpace updates the effective date at the top of this page whenever the policy changes, and says what the old version claimed — as we did above for the sentence about Google Analytics. The date changes only when the wording does. If we ever add analytics, advertising or any feature that collects data, it will be described here before it goes live.
Non-affiliation and the Unicode character
FreeFireSpace is an independent project and is not affiliated with, endorsed by or sponsored by Garena or Free Fire. The blank space it provides is a public Unicode character (U+00A0, a non-breaking space), not a hack or a modified game client, and it may stop working after an OB update. You can read who we are and how we test on our About page, and the rules for using the tool in our Terms of Use.