Privacy notice
Last updated 13 October 2026, version 2.0
This notice explains how Home Turf Studios collects, uses, shares and protects personal data, and the rights that you have in relation to it. It is written to meet the requirements of Articles 13 and 14 of the UK General Data Protection Regulation (the "UK GDPR"), the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PECR"). Please read it in full. If anything in it is unclear, you can contact us using the details in section 1.
1. Who we are
1.1 Home Turf Studios is an independent game studio based in Manchester, United Kingdom. In this notice, "we", "us" and "our" mean Home Turf Studios, and "you" means any individual whose personal data we process.
1.2 Home Turf Studios is the controller of the personal data described in this notice, which means that we decide why and how that personal data is processed. Until the company described in clause 1.3 is registered, Home Turf Studios is the trading name of its founder, an individual who carries on the business on their own account and who is the controller.
1.3 A private limited company, Home Turf Studios Ltd, is to be registered in England and Wales. Once it is registered, references in this notice to Home Turf Studios mean Home Turf Studios Ltd, a company registered in England and Wales with company number [company number to follow], whose registered office is at [registered office address to follow]. On registration, the business and the personal data described in this notice will pass to the company, which will then be the controller. The purposes for which the personal data is used will not change as a result, and this notice will be updated to show the company's details.
1.4 Our contact details for all privacy matters are as follows.
| Contact method | Details |
|---|---|
| [email protected] | |
| Post | [registered office address to follow] |
1.5 We have not appointed a data protection officer, because we are not required to do so under Article 37 of the UK GDPR. The founder is responsible for data protection matters and reads every message sent to the address above.
1.6 We are based in the United Kingdom and have not appointed a representative in any other country.
1.7 On our own assessment, we are not at the date of this notice required to pay a data protection fee to the Information Commission, because our processing falls within the exemption for processing for the purposes of advertising, marketing and public relations in respect of our business, activity, goods or services, in paragraph 2(2)(e) of the Schedule to the Data Protection (Charges and Information) Regulations 2018. We will pay the fee before our processing extends beyond that exemption, and in any event when the game's store page on Steam is published.
2. Scope of this notice
2.1 This notice applies to personal data that we process in connection with the following:
(a) our website at https://hometurfstudios.co.uk (the "website"), including the form on the website that allows you to ask to receive updates (the "updates list");
(b) our game, Home Turf: Manchester (the "game"), which is intended for adults and is made available for Windows and Mac computers through Steam, a service operated by Valve Corporation;
(c) email correspondence sent to or from [email protected]; and
(d) our accounts on Instagram and TikTok.
2.2 This notice does not apply to the processing of personal data by Valve Corporation, Meta Platforms, Inc., TikTok or Apple when they act on their own account as controllers. Those organisations are responsible for their own processing and publish their own privacy information, which is referred to in the relevant sections below.
2.3 Online play in the game is planned for a later release and is not available at the date of this notice. Section 6.10 explains what will happen before it is introduced.
3. Summary of our processing
3.1 The table below summarises the processing described in this notice. The sections that follow give the full detail, and they take precedence over this summary.
| Activity | Personal data | Purpose | Lawful basis (UK GDPR Article 6) | How long we keep it |
|---|---|---|---|---|
| Visiting the website | IP address and technical request information, processed by our hosting provider | Delivering the website securely | Legitimate interests, Article 6(1)(f) | We keep no visitor logs (section 4) |
| Joining the updates list | Email address, confirmation that you are 18 or over, date and time of sign-up, the website page used | Sending you updates about the game that you asked for | Consent, Article 6(1)(a) | Until you unsubscribe or 12 months after the game is released, whichever is sooner |
| Protecting the sign-up form from abuse | A one-way hash of your IP address and a counter | Preventing automated or repeated sign-ups | Legitimate interests, Article 6(1)(f) | At most one hour |
| Crash reports, only if you agree to send one | Technical information about your device, operating system and the state of the game | Finding and fixing faults in the game | Legitimate interests, Article 6(1)(f), with your agreement under PECR to send the report | 90 days |
| Public reviews and discussion posts about the game on Steam | Steam display name and the content of the post | Finding faults and understanding feedback | Legitimate interests, Article 6(1)(f) | We do not keep copies linked to names (section 6) |
| Emails to and from us | Your email address, name if given, the content of your message and anything you attach | Responding to you and keeping a record of the correspondence | Legitimate interests, Article 6(1)(f); legal obligation, Article 6(1)(c), for data protection requests and complaints; contract, Article 6(1)(b), for business agreements | See the retention table in section 13 |
| Instagram and TikTok | Your username, public profile, comments, messages and interactions with our accounts; aggregated statistics | Running and moderating our accounts and understanding their reach | Legitimate interests, Article 6(1)(f) | See section 8 and section 13 |
4. The website
4.1 The website does not set cookies, does not use analytics, does not contain advertising or tracking technologies, does not load scripts, fonts or other content from third parties, and does not use a CAPTCHA or any other third-party bot-detection service.
4.2 The website is hosted by Cloudflare, Inc. ("Cloudflare"), using its Cloudflare Pages service. When you visit the website, your device sends a request to Cloudflare's network. To deliver the page and to protect the website and its network against attacks and misuse, Cloudflare necessarily processes technical information about that request, including your IP address, the address of the page requested, the date and time of the request, and information that your browser sends automatically, such as its type and version.
4.3 Cloudflare processes this information as our processor, on our behalf and under our instructions, under its Self-Serve Subscription Agreement and the Cloudflare Customer Data Processing Addendum, which that agreement incorporates. Cloudflare may also process limited information about network traffic for the purposes of operating and securing its own network, as described in its own privacy policy at https://www.cloudflare.com/privacypolicy/.
4.4 We do not keep logs of visitors to the website, and we do not have access to information that would allow us to identify the individuals who visit it.
4.5 Our lawful basis for this processing is our legitimate interests, under Article 6(1)(f) of the UK GDPR, in making the website available to the public in a secure and reliable way. A website cannot be delivered without processing the address of the device that requests it. Because the information is processed only to deliver and protect the website, and is not used by us for any other purpose, we consider that this processing does not override your interests, rights or freedoms.
4.6 The website instructs browsers not to send the address of the page you came from when you follow a link away from the website, so that the operators of other websites are not told which of our pages you were reading.
5. The updates list
What we collect
5.1 If you use the form on the website to ask for updates about the game, we collect and store the following:
(a) your email address;
(b) your confirmation that you are 18 or over;
(c) the date and time at which you signed up; and
(d) a short label identifying the page of the website on which you used the form.
5.2 We do not ask for your name, and we do not collect any other information about you through the form. If you sign up more than once with the same email address, we keep a single record and update the date and time of sign-up.
5.3 This information is collected directly from you. The form also contains fields that are not visible to people and a record of when the page was loaded. These are used only to recognise automated submissions at the moment the form is sent and are not stored.
Why we use it and our lawful basis
5.4 We use your email address only to send you updates about the game, such as news of its development and release, and to manage your place on the list. We do not use it for any other purpose, and we do not add it to any other list.
5.5 Our lawful basis is your consent, under Article 6(1)(a) of the UK GDPR. You give your consent by completing the form and asking to receive updates. Sending updates by email to individuals also requires consent under regulation 22 of PECR, and we rely on the same consent for that purpose.
5.6 You can withdraw your consent at any time, without giving a reason, by using the unsubscribe link included in every update or by emailing [email protected]. Withdrawing consent does not affect the lawfulness of anything we did with your consent before you withdrew it.
5.7 We use the confirmation that you are 18 or over because the game is intended for adults and we do not send updates about it to children. See section 16.
5.8 We use the date and time of sign-up as a record of when consent was given, and the page label to understand which parts of the website lead people to sign up. The page label is not used to build any profile of you.
How the list is stored and used
5.9 Your sign-up record is stored in Cloudflare Workers KV, a storage service provided by Cloudflare as our processor. There is no online administration page for the list and no login page through which it can be reached. We obtain a copy of the list only by running a command from our own computer, which requires access to our Cloudflare account. Copies made in this way are kept only for as long as they are needed for the task in hand, such as sending an update, and are then deleted.
5.10 At the date of this notice we have not yet sent any updates, and we do not send a confirmation email when you sign up. Because any person can enter an email address in the form, the first update we send will explain why the recipient is receiving it and how to be removed from the list straight away.
5.11 If we use an email delivery service to send updates, that service will act as our processor and will receive your email address only for the purpose of sending updates on our behalf. We will name it in this notice before it receives any email address.
Protecting the form from abuse
5.12 To prevent automated or repeated sign-ups, the form accepts no more than five sign-ups from a single connection within an hour, and further sign-ups from that connection within the hour are not recorded. To do this, the sign-up function of the website, which runs on Cloudflare's systems, converts the IP address of the connection into a shortened one-way cryptographic hash and keeps a count against that hash. The hash and the count are deleted automatically within one hour. The hash is never stored with, or linked to, any sign-up record, and your IP address itself is not stored.
5.13 Although a hash of this kind does not reveal your IP address directly, we treat it as personal data. Our lawful basis is our legitimate interests, under Article 6(1)(f) of the UK GDPR, in keeping the updates list accurate and the form secure without using third-party bot-detection services. We consider that the very short retention period, the absence of any link to your sign-up record and the fact that the hash is used for no other purpose mean that this processing does not override your interests, rights or freedoms.
How long we keep it
5.14 We keep your sign-up record until whichever of the following happens first:
(a) you unsubscribe or ask us to remove you, in which case we delete your record promptly and in any event within 30 days; or
(b) 12 months have passed since the game was first released for sale on Steam, including any early access release, in which case we delete the whole list.
5.15 After deletion, residual copies may remain in our provider's systems for a short period until they are overwritten in accordance with that provider's own deletion processes. We do not use or restore those copies.
6. The game
Purchases through Steam
6.1 The game is sold and delivered through Steam, which is operated by Valve Corporation ("Valve"). When you buy, download or play the game through Steam, Valve collects and uses personal data about you as an independent controller, under its own terms and the Steam Privacy Policy at https://store.steampowered.com/privacy_agreement/. Valve processes your payment. We do not receive your payment details, your billing address or your Steam account email address.
6.2 Through Steamworks, the service that Valve provides to developers, Valve gives us sales and usage reports. As described in Valve's documentation, these reports show revenue, units, player counts and similar statistics broken down by territory and region. We use them only in aggregate, to understand how the game is performing, and we do not use them to identify any individual.
6.3 Valve's privacy policy states that developers of a game can obtain certain information about the users of that game through the Steamworks programming interface, including at a minimum the fact that a user owns the game, together with information needed for any Steam features that the developer chooses to use, such as achievements, leaderboards, game progress or matchmaking. Valve also states that public Steam profile information, such as a display name and avatar, is available through that interface to anyone who has a user's Steam ID.
6.4 At the date of this notice, the game does not send your Steam ID, your Steam display name or any other information about your Steam account to us. Where the game uses Steam features, such as achievements or cloud saves, the related information is held by Valve on its systems and is subject to Valve's privacy policy. If you choose to give us your Steam ID or display name, for example when you email us about a problem, we use it only to deal with your message, as described in section 7.
6.5 You can read and post public reviews and discussion threads about the game on Steam. These are published by Valve on the Steam Community, not by us. We read the reviews and discussion posts about the game in order to find faults and understand what players think of it. When we do so we process the Steam display name of the author and the content of the post. The source of this personal data is the Steam Community, operated by Valve. We record the problems reported and how often they are reported, but we do not keep copies of posts or lists of the people who made them. We do not promise to reply to individual posts.
6.6 Our lawful basis for reading and summarising public reviews and discussion posts is our legitimate interests, under Article 6(1)(f) of the UK GDPR, in improving the game and fixing faults that affect players. The posts are published by their authors for the purpose of being read, including by the developer of the game, and we record only the substance of the problem reported. We therefore consider that this processing does not override the interests, rights or freedoms of the authors.
Crash reports
6.7 If the game stops working unexpectedly, it will ask whether you wish to send a crash report to us. A report is sent only if you agree. You can also set in the game's Settings whether you wish to be asked, and you can change that choice at any time.
6.8 A crash report contains technical information about the fault, including information about your device and its hardware, your operating system and its version, the version of the game, and the state of the game at the time of the fault. The game is designed so that crash reports do not include your name, your email address, your IP address or your Steam account details. Technical files such as error logs can occasionally contain incidental information from your computer, such as the name of the user account that appears in a file location. We do not use any such information to identify you, and we remove it if we notice it. The server that receives a report necessarily sees the IP address of the connection while the report is transmitted, but that address is not stored with the report.
6.9 The details of crash reports are as follows.
(a) Purpose. We use crash reports only to find, understand and fix faults in the game. We do not use them for marketing, for profiling or to make decisions about any individual.
(b) PECR. Where the rules in regulation 6 of PECR on accessing information stored on a device apply to the collection of a crash report, the agreement you give in the game is the consent required for that purpose.
(c) Lawful basis. Our lawful basis under the UK GDPR for using the contents of a crash report is our legitimate interests, under Article 6(1)(f), in identifying and fixing faults so that the game works properly for its players. We have assessed that interest against your interests, rights and freedoms as follows. Crash reports are necessary for that purpose, because many faults cannot be reproduced or understood without information about the conditions in which they occurred. The information is limited to what is needed to diagnose a fault and is designed to exclude direct identifiers. A report is sent only when you have agreed, so its collection is within your control and within your reasonable expectations. Reports are used for no other purpose, are seen only by us and our processors, and are deleted after 90 days. Fixing faults also benefits players directly. For these reasons we have concluded that our interest is not overridden by your interests, rights or freedoms.
(d) Retention. Crash reports are deleted 90 days after they are received.
(e) Processor. Crash reports will be received and stored by a service provider acting as our processor. The game has not been released at the date of this notice, and we will name that provider, and the place where reports are stored, in this notice before crash reporting is made available.
(f) Identification. Because crash reports are designed not to identify you, we may not be able to find a particular report if you ask us about it. In that case Article 11 of the UK GDPR applies, and we will explain this to you. If you can give us information that allows us to find the report, such as the date and time of the crash and the version of the game, we will try to do so.
Online play
6.10 Online play is planned for a later release of the game. Before any online features are made available, we will publish either a separate privacy notice for online play or an updated version of this notice. It will describe any personal data needed for online play, such as a Steam ID used for matchmaking, together with the purposes, lawful bases, recipients and retention periods that apply. We will not begin processing personal data for online play until that information has been published.
7. Emails and other correspondence
7.1 Our email address, [email protected], is provided through Apple's iCloud Mail service. When you email us, we receive and store your email address, your name if you include it, the content of your message, any attachments, and the technical information that accompanies an email, such as the date and time it was sent. We also keep copies of our replies. If you write to us by post, we keep your letter and any copy of our reply.
7.2 We use this information to read and reply to your message and to keep a record of the correspondence. The lawful bases that apply depend on the subject of the message, as follows.
(a) General enquiries, comments about the game and press enquiries. Our lawful basis is our legitimate interests, under Article 6(1)(f) of the UK GDPR, in responding to people who contact us and keeping an accurate record of what was said. You choose to contact us and expect a reply, and we use your information only for that purpose.
(b) Requests to exercise your data protection rights, and complaints about our use of personal data. Our lawful basis is compliance with a legal obligation, under Article 6(1)(c), namely our obligations under Articles 12 to 22 of the UK GDPR and section 164A of the Data Protection Act 2018. We keep a record of each request or complaint, and of how we dealt with it, so that we can show that we have met those obligations.
(c) Businesses. Local businesses may contact us about the way they appear in the game, or about an agreement to show their premises in the game, and we may contact businesses about the same subjects. Where the business is run by an individual, or where we deal with a named individual on behalf of a business, we process that individual's name, contact details and the content of our correspondence. Where we enter into an agreement, our lawful basis is that the processing is necessary for the performance of that agreement, or to take steps at your request before entering into it, under Article 6(1)(b). Where there is no agreement, including where a business asks us to change or remove its name or appearance from the game, our lawful basis is our legitimate interests, under Article 6(1)(f), in dealing with the request and keeping a record of the change so that it is not reversed in a later update. Where we must keep records for tax or company law purposes, our lawful basis is compliance with a legal obligation, under Article 6(1)(c).
7.3 Apple provides our email service and stores the messages on its systems in order to provide that service to us. For people in the United Kingdom, Apple's privacy policy states that the responsible Apple entity is Apple Distribution International Limited, of Ireland. Apple's privacy policy is at https://www.apple.com/legal/privacy/.
7.4 Please do not send us special category data, such as information about your health, or any information about other people, unless it is necessary for your message. If you do, we will use it only to deal with your message.
8. Social media
8.1 We have accounts on Instagram, which is provided by Meta, and on TikTok. When you follow, view, like, comment on, share or send a message to our accounts, we can see your username, your public profile information, the content of your comments and messages, and the fact that you have interacted with our content. The source of this information is you and the platform concerned.
8.2 We use this information to publish content, to moderate comments on our accounts (including by holding comments for review and removing spam or abusive content), to read any messages you send to us and, where appropriate, to reply. We may also receive statistics from each platform about the reach of our content and the people who interact with it. These statistics are provided to us in aggregated form, and we do not use them to identify any individual.
8.3 Our lawful basis is our legitimate interests, under Article 6(1)(f) of the UK GDPR, in maintaining a presence on these platforms, keeping our accounts free of spam and abuse, and understanding in general terms how our content is received. You choose to interact with our accounts in a public or semi-public setting, and we do not collect information from these platforms for any other purpose or combine it with other information about you.
8.4 The platforms process your personal data as controllers on their own account, under their own terms and privacy policies, for purposes that we do not decide, including their own advertising. For people in the United Kingdom:
(a) Instagram is provided by Meta Platforms, Inc., whose privacy policy is at https://privacycenter.instagram.com/policy/; and
(b) TikTok is provided by TikTok Information Technologies UK Limited and TikTok Technology Limited, whose privacy policy for users in the United Kingdom is available from https://www.tiktok.com/legal/.
8.5 For the creation of analytics about how users interact with our content, TikTok's terms provide that TikTok and the account holder are joint controllers under the TikTok Analytics Joint Controller Addendum, which is published at https://www.tiktok.com/legal/page/global/tiktok-analytics-joint-controller-addendum/en. Under that addendum TikTok is responsible for enabling you to exercise your rights in relation to that data. Meta publishes a comparable arrangement, the Page Insights Controller Addendum, for statistics about Facebook Pages. To the extent that we are a joint controller with Meta for statistics about our Instagram account, and that arrangement or an equivalent one applies, Meta is primarily responsible for providing information about that processing and for responding to requests to exercise your rights in relation to it.
8.6 You may send a request about this processing to us or to the platform. If you send it to us, and it relates to processing for which the platform is responsible, we will pass it to the platform within seven calendar days, as the platforms' terms require, and we will tell you that we have done so.
9. Our lawful bases and legitimate interests
9.1 Sections 4 to 8 state the lawful basis for each purpose. This section brings together the legitimate interests on which we rely, because Article 13(1)(d) of the UK GDPR requires us to identify them.
| Purpose | Our legitimate interest | Why we consider it is not overridden by your interests |
|---|---|---|
| Delivering the website (section 4) | Making the website available securely and reliably | Processing is technically necessary, carried out by our hosting provider only, and not used by us for any other purpose |
| Rate limiting the sign-up form (section 5) | Keeping the updates list accurate and the form secure | Only a one-way hash is used, kept for at most one hour and never linked to a sign-up record |
| Crash reports (section 6) | Finding and fixing faults so the game works properly | Sent only with your agreement, limited to technical data, used for no other purpose and deleted after 90 days |
| Public Steam reviews and posts (section 6) | Improving the game and fixing reported faults | Published by the author to be read, and only the substance of the problem is recorded |
| Correspondence (section 7) | Replying to people who contact us and keeping an accurate record | You chose to contact us and expect a reply, and the information is used only for that purpose |
| Business requests about the game (section 7) | Dealing with the request and keeping a record so that changes are not reversed | Limited to business contact details and the request itself |
| Social media (section 8) | Maintaining our accounts, keeping them free of abuse and understanding their reach | Interaction is chosen by you and visible on the platform, and statistics are aggregated |
9.2 You have the right to object to any processing that we carry out on the basis of legitimate interests. See section 17.
10. Who we share personal data with
10.1 We do not sell personal data, and we do not share it with anyone for their own marketing. We share personal data only with the recipients described in this section, and only to the extent necessary for the purposes described in this notice.
| Recipient | Role | What they receive and why |
|---|---|---|
| Cloudflare, Inc. | Processor | Hosts the website, receives website requests, and stores the updates list and the temporary rate-limiting hashes |
| Apple Distribution International Limited (iCloud Mail) | Service provider for our email | Stores emails sent to and from [email protected] so that we can receive and send them |
| An email delivery service, if we use one | Processor, to be named before use | Will receive email addresses on the updates list only to send updates on our behalf |
| A crash report service | Processor, to be named before crash reporting is available | Will receive and store crash reports on our behalf |
| Valve Corporation (Steam) | Independent controller | Collects your information directly when you use Steam. We do not send personal data to Valve, other than any information you ask us to pass on in connection with a support request |
| Meta Platforms, Inc. (Instagram) | Independent controller, and joint controller to the extent described in section 8 | Processes your interactions with our Instagram account |
| TikTok Information Technologies UK Limited and TikTok Technology Limited | Independent controllers, and joint controllers for analytics as described in section 8 | Process your interactions with our TikTok account |
| Professional advisers, such as accountants and solicitors | Independent controllers or processors, bound by duties of confidentiality | Only where needed for advice, for example about a complaint, a legal claim or our accounts |
| Public authorities, regulators, courts and the police | Independent controllers | Only where we are required to disclose information by law, or where disclosure is necessary to establish, exercise or defend legal claims |
| Home Turf Studios Ltd, and any future purchaser of our business | Successor controller | On the registration of the company described in section 1, and if the business or its assets are ever sold or transferred, in which case the recipient must use the personal data in accordance with this notice |
10.2 Each processor acts only on our documented instructions and is subject to duties of confidentiality and security. We will update this notice before we appoint any new processor that receives personal data described in it.
11. International transfers
11.1 Some of the organisations listed in section 10 are based outside the United Kingdom or process personal data outside it. Where we transfer personal data outside the United Kingdom, or arrange for a processor to do so, we ensure that the transfer is permitted by UK data protection law, as follows.
| Recipient | Where data may be processed | Safeguard |
|---|---|---|
| Cloudflare, Inc. | The United States, the European Economic Area and other countries in which Cloudflare operates data centres. Data in Workers KV is stored in a small number of central locations and may be cached temporarily in other data centres in Cloudflare's global network when it is read. | Cloudflare states that it is certified under the UK Extension to the EU-U.S. Data Privacy Framework, which UK law recognises for transfers to certified organisations in the United States. For transfers that are not covered by that certification, or if the certification lapses, the Cloudflare Customer Data Processing Addendum (version 6.4, effective 3 April 2026) applies the European Commission's standard contractual clauses as amended by the UK's International Data Transfer Addendum. |
| Apple Distribution International Limited | Ireland, and other countries in which Apple operates | Ireland is covered by UK regulations that permit transfers of personal data to it without further safeguards. Any onward transfer by Apple is governed by Apple's own privacy policy and the safeguards it describes. |
| Valve Corporation, Meta Platforms, Inc. and TikTok | The United States and other countries | These organisations collect personal data directly from you as controllers under their own terms, and are responsible for the safeguards that apply to their own transfers. We do not transfer personal data to them, except as described in section 10. |
11.2 You can ask us for further information about the safeguards described above, including a copy of the relevant contractual terms where we are able to provide it, by contacting us using the details in section 1.
12. How long we keep personal data
12.1 We keep personal data only for as long as we need it for the purposes described in this notice, and then delete it securely. Section 13 sets out the retention periods that apply.
12.2 When a retention period ends, we delete the personal data from our own systems and from the systems of our processors that are under our control. Residual copies in providers' backup systems are overwritten in accordance with those providers' own deletion processes, and we do not use or restore them.
12.3 We may keep personal data for longer than the period stated where we are required to do so by law, or where it is necessary to establish, exercise or defend a legal claim. In that case we keep only the data that is needed, and only for as long as it is needed.
13. Retention table
| Personal data | Retention period |
|---|---|
| Website request information processed by Cloudflare | We keep no visitor logs. Cloudflare's own retention of network information is governed by its privacy policy. |
| Updates list record (email address, age confirmation, date and time of sign-up, page label) | Until you unsubscribe or ask us to remove you (deleted promptly and in any event within 30 days), or until 12 months after the game is first released for sale on Steam, including any early access release, whichever is sooner |
| Copies of the updates list made to send an update | Deleted as soon as the task for which the copy was made is complete |
| Records of people who are found to be under 18 | Deleted as soon as we become aware that the person is under 18 |
| Rate-limiting hash and counter | Deleted automatically within one hour |
| Crash reports | 90 days from receipt |
| Notes of problems reported in public Steam reviews and discussions | Kept without names or Steam display names, for as long as they are useful for improving the game |
| General correspondence by email or post | 24 months after our last exchange with you |
| Data protection requests and complaints, and our records of how we dealt with them | Three years after the request or complaint is closed |
| Correspondence and records relating to an agreement with a business | Six years after the end of the financial year in which the agreement ends, to meet tax and company law requirements and to deal with any claim |
| Records of requests by a business to change or remove its name or appearance from the game | For as long as the game remains available, so that the change is not reversed in a later update |
| Comments and messages on our Instagram and TikTok accounts | Comments that we remove are deleted when removed. Other comments remain on the platform until you or we delete them, or the account is closed. Messages are deleted by us 24 months after our last exchange, subject to the platform's own retention. |
14. How we protect personal data
14.1 We take appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage, taking into account the nature of the data and the risks involved. Those measures include the following.
(a) Data minimisation. We collect the least personal data needed for each purpose. The updates list holds only the information described in clause 5.1, and the game does not send personal data to us during normal play.
(b) Encryption in transit. The website is served only over encrypted connections (HTTPS), and browsers are instructed to use encrypted connections for all future visits. Sign-ups and crash reports are transmitted over encrypted connections.
(c) Restricted access. The updates list has no online administration page and can be reached only through our Cloudflare account. Access to our Cloudflare, Apple, Steamworks, Instagram and TikTok accounts is limited to the founder and protected by strong, unique passwords and two-step verification.
(d) Website protections. The website applies a strict content security policy that prevents it from loading content from other websites, prevents it from being displayed inside other websites, and limits the information that browsers share when you follow a link away from it.
(e) Separation of data. The temporary hashes used to protect the sign-up form are stored separately from sign-up records and are never linked to them.
(f) Local copies. Any copy of the updates list that we make on our own computer is kept only for as long as it is needed and is then deleted. Our computer is protected by a password and full-disk encryption.
(g) Processors. We use only processors that provide sufficient guarantees of appropriate security measures.
14.2 No method of transmission or storage is completely secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Information Commission within 72 hours of becoming aware of it where the law requires us to do so. If the breach is likely to result in a high risk to your rights and freedoms, we will also tell you without undue delay.
15. What we do not do
15.1 We do not use cookies, analytics, advertising technologies, tracking pixels or third-party scripts on the website.
15.2 We do not sell, rent or trade personal data, and we do not share it with any other organisation for that organisation's own marketing.
15.3 We do not send marketing of any kind other than the updates that you ask to receive by joining the updates list. We do not add your email address to any other list, and we do not send updates to email addresses that we obtain in any other way, including the addresses of people who email us.
15.4 We do not carry out profiling, and we do not make any decision about you based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you, within the meaning of Article 22 of the UK GDPR.
15.5 We do not collect personal data from the game during normal play. The only information the game sends to us is a crash report, and only if you agree to send it.
15.6 We do not knowingly collect personal data from children. See section 16.
15.7 We do not ask for, and do not intend to process, special category data, such as information about health, ethnic origin, religious beliefs or sexual orientation, or personal data relating to criminal convictions and offences.
15.8 We do not receive payment card details or bank details from people who buy the game.
16. Children
16.1 The website, the updates list and the game are intended only for adults. You must be 18 or over to join the updates list, and you are asked to confirm this when you sign up.
16.2 If we become aware that a person under the age of 18 has joined the updates list, we will delete their record without sending them any further updates. If we become aware that we hold any other personal data about a person under 18 that we do not need, for example in correspondence, we will delete it, except where we need to keep it to respond to a request made by or on behalf of that person or to meet a legal obligation.
16.3 If you believe that a person under 18 has given us their personal data, please contact us using the details in section 1 and we will deal with it promptly.
17. Your rights
17.1 You have the following rights under UK data protection law. Some of them apply only in certain circumstances, which are summarised below.
(a) Right to be informed. You have the right to clear information about how we use your personal data. This notice provides that information.
(b) Right of access. You have the right to ask whether we process your personal data and, if we do, to receive a copy of it together with information about how it is used. This is often called a subject access request.
(c) Right to rectification. You have the right to ask us to correct personal data that is inaccurate and to complete personal data that is incomplete.
(d) Right to erasure. You have the right to ask us to delete your personal data, for example where it is no longer needed for the purpose for which it was collected, where you withdraw consent and there is no other lawful basis, or where you object to processing and there is no overriding legitimate ground for it. This right does not apply where we must keep the data to meet a legal obligation or to establish, exercise or defend a legal claim.
(e) Right to restriction of processing. You have the right to ask us to limit the way we use your personal data, for example while we check its accuracy or consider an objection.
(f) Right to data portability. Where we process personal data that you provided to us on the basis of your consent or a contract, and the processing is carried out by automated means, you have the right to receive that data in a structured, commonly used and machine-readable format and to ask us to send it to another controller where that is technically feasible. This right applies to your updates list record.
(g) Right to object. You have the right to object, on grounds relating to your particular situation, to processing that we carry out on the basis of our legitimate interests. We will then stop that processing unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims. You also have an absolute right to object at any time to the use of your personal data for direct marketing, which includes the updates we send. If you object to receiving updates, we will remove you from the list.
(h) Right to withdraw consent. Where we rely on your consent, you may withdraw it at any time, as described in clause 5.6.
(i) Rights relating to automated decision-making. You have rights in relation to decisions based solely on automated processing. We do not make any such decisions, as stated in clause 15.4.
(j) Right to complain. You have the right to complain to us, and to the Information Commission, as described in section 19.
18. How to exercise your rights
18.1 To exercise any of your rights, please email [email protected] or write to us at the postal address in section 1. You do not need to use any particular form of words, but it helps us if you tell us which right you wish to exercise and give us enough information to find the personal data concerned. For example, if your request is about the updates list, please tell us the email address you used to sign up.
18.2 We will respond without undue delay and in any event within one month of receiving your request. If your request is complex, or if you make a number of requests, we may extend that period by up to two further months. If we do, we will tell you within the first month and explain why.
18.3 Where we need further information to confirm your identity, or where we reasonably need you to clarify your request, the time limit for our response does not run until we receive that information.
18.4 We will ask for information to confirm your identity only where it is necessary and proportionate to do so, to make sure that we do not disclose personal data to, or act on the instructions of, the wrong person. In most cases this will mean asking you to reply from, or to confirm that you control, the email address concerned. We will not ask for more information than we need, and we will delete any information provided for verification once we have dealt with your request.
18.5 When responding to a request for access, we will carry out reasonable and proportionate searches for your personal data.
18.6 There is no fee for exercising your rights. However, where a request is manifestly unfounded or excessive, in particular because it is repetitive, we may charge a reasonable fee that reflects our administrative costs, or refuse to act on the request. If we do either, we will explain why, and you may complain about our decision as described in section 19.
18.7 If we refuse a request, in whole or in part, we will tell you why and explain your right to complain to the Information Commission and to seek a judicial remedy.
18.8 If your request relates to processing for which Valve, Meta or TikTok is responsible, you may wish to contact that organisation directly, as it holds the data concerned. If you contact us, we will help you to do so, or pass your request on where section 8 provides for that.
19. Complaints
19.1 If you are unhappy with the way we have used your personal data, or with the way we have responded to a request, please tell us first by emailing [email protected], so that we have the opportunity to put things right. We will acknowledge your complaint within 30 days of receiving it, look into it, keep you informed of our progress, and tell you the outcome without undue delay.
19.2 You also have the right to complain to the Information Commission, which is the UK supervisory authority for data protection and operates as the ICO (the Information Commission's Office). You can do this at any time, including if you are not satisfied with our response to your complaint. The Information Commission may ask whether you have first raised the matter with us.
| Information Commission (ICO) | |
|---|---|
| Website | https://ico.org.uk |
| Helpline | 0303 123 1113 |
| Post | Information Commission's Office, 4th Floor, No.3 Circle Square, 5 Hawkshaw Street, Manchester M1 7BL |
19.3 If you live in the European Economic Area, you may also complain to the data protection supervisory authority in the country where you live or work, or where you believe an infringement occurred.
19.4 You also have the right to bring a claim in the courts if you consider that your rights have been infringed.
20. Whether you must provide personal data
20.1 You are not under any statutory or contractual obligation to provide personal data to us.
20.2 You need to provide your email address and confirm that you are 18 or over if you wish to join the updates list. If you do not, we cannot send you updates.
20.3 Sending a crash report is optional. If you choose not to send one, the game will work in the same way, but we may be less able to identify and fix the fault that you experienced.
20.4 If you email us, we need your email address in order to reply to you.
21. Links to other websites and services
21.1 The website and our social media accounts contain links to websites and services operated by other organisations, including Steam, Instagram and TikTok. When you follow a link, you leave the website, and the other organisation's own privacy notice and terms apply to any personal data it collects. We are not responsible for the content of other websites or for the way in which other organisations process personal data, and we recommend that you read their privacy notices.
22. Changes to this notice
22.1 We keep this notice under review and will update it when our processing changes. In particular, we will update it before the company described in section 1 takes over the business, before we appoint a new processor, before crash reporting is made available and before any online features are introduced.
22.2 The date and version number at the top of this notice show when it was last changed. If we make a material change to the way we use personal data that we already hold, we will tell the people affected before the change takes effect, using the contact details we hold for them where it is appropriate to do so. If the change requires your consent, we will not make it until you have given that consent.
23. Version history
| Version | Date | Summary of changes |
|---|---|---|
| 1.0 | 12 October 2026 | First notice published on the website |
| 2.0 | 13 October 2026 | Full revision: controller identity and contact details, lawful bases for each purpose, legitimate interests assessments, recipients and processors, international transfers, retention table, security measures, rights and how to exercise them, complaints to us and to the Information Commission, children, social media and future online play |