Privacy Policy

Last updated: [EFFECTIVE DATE] · Data controller: [OPERATOR NAME]

1. Overview

This Privacy Policy explains how [OPERATOR NAME] ("we", "us") collects and uses your personal data when you use the account portal and game Abyss Floors. We are the data controller. We aim to collect only what we need to run the Game and keep your account secure.

2. What we collect

  • Account data — your email address and a securely hashed password. We never store your password in plain text. If you sign in with Steam, we store your Steam ID and the fact that the account is linked, not your Steam password.
  • Technical data — your IP address and basic request information, used to authenticate you, to apply rate limits, and to protect the service against abuse. A single essential cookie keeps you signed in (see Section 5).
  • Gameplay data — your characters, progress, inventory, in-game economy activity, and related logs generated as you play. This is created by using the Game and is tied to your account.
  • Communications — the transactional emails we send (such as email confirmation and password reset), and any messages you send us for support.

We do not ask for or intentionally collect special categories of data (such as health or biometric data).

3. How we use your data

  • To create and operate your account and let you sign in (email/password or Steam).
  • To run the Game — save your characters and progress, and provide the shared, server-authoritative world and economy.
  • To keep accounts and the service secure — verify email ownership, reset passwords, apply rate limits, and detect and prevent cheating, fraud, and abuse.
  • To send you essential service messages (for example, confirmation and password-reset emails). We send marketing or news emails only where you have opted in, and you can opt out at any time.
  • To operate, maintain, debug, and improve the Game, and to comply with our legal obligations.

4. Legal bases (GDPR / UK GDPR)

Where the GDPR or UK GDPR applies, we rely on:

  • Performance of a contract — to provide the account and the Game you asked for.
  • Legitimate interests — to secure the service, prevent abuse and cheating, and keep the Game running, balanced against your rights.
  • Consent — for any optional marketing/news emails; you can withdraw it at any time.
  • Legal obligation — where we must retain or disclose data to comply with the law.

5. Cookies

We use a single essential authentication cookie to keep you signed in and to protect sign-in forms against cross-site request forgery. It is strictly necessary for the portal to work, so it is set without a consent banner. We do not use advertising or third-party tracking cookies.

6. Who we share it with

We do not sell your personal data. We share it only with service providers who help us run the Game, and only as needed:

  • Hosting / infrastructure provider ([HOSTING PROVIDER]) — stores the database and runs the servers.
  • Email provider ([EMAIL PROVIDER]) — delivers our confirmation and password-reset emails.
  • Steam (Valve) — if you choose to sign in with or link Steam, to verify your Steam identity, under Valve's own privacy terms.
  • Payment provider ([PAYMENT PROVIDER, e.g. Steam]) — if you make a purchase, to process payment. We do not receive your full payment-card details.
  • Authorities — where we are legally required to, or to protect our rights, users, or the security of the Game.

7. How long we keep it

We keep your account and gameplay data for as long as your account is active. If you delete your account, we delete or anonymise your personal data within a reasonable period, except where we must keep certain records to comply with the law, resolve disputes, or enforce our agreements. Short-lived security tokens (such as confirmation and reset links) expire quickly by design.

8. How we protect it

We use appropriate technical and organisational measures — including password hashing, TLS encryption in transit, access controls, and rate limiting — to protect your data. No online service can be completely secure, but we work to keep the risk low and to respond promptly to any incident.

9. Your rights

Depending on where you live, you may have the right to:

  • access the personal data we hold about you, and receive a copy;
  • correct data that is inaccurate or incomplete;
  • delete your data ("right to be forgotten");
  • restrict or object to certain processing;
  • data portability; and
  • withdraw consent at any time where we rely on it.

To exercise any of these, contact us at [PRIVACY EMAIL]. You also have the right to complain to your local data-protection authority.

10. International transfers

Your data is processed in [PRIMARY PROCESSING LOCATION / REGION]. If any provider processes data outside your region, we take steps to ensure it receives an adequate level of protection (for example, through appropriate safeguards such as standard contractual clauses).

11. Children

The Game is not intended for children under [MINIMUM AGE, e.g. 16]. We do not knowingly collect personal data from children under that age. If you believe a child has given us personal data, contact us and we will delete it.

12. Contact us

For any privacy question or request, contact [OPERATOR NAME] at [PRIVACY EMAIL], [OPERATOR POSTAL ADDRESS]. If we make material changes to this policy, we will update the "Last updated" date above and, where appropriate, notify you.