Privacy Policy

In short

We collect the minimum: your email (if you chose to keep your hero), your language, your time zone, and whatever you wrote in the game yourself. There are no third-party trackers and no advertising; we do not sell your data and do not hand it to anyone for their own purposes.

Page views are counted anonymously: your IP address and browser string are stored nowhere — not in the database, not in the server logs. That is exactly why there is no cookie banner: there is nothing to consent to.

Who is responsible

The data controller is spacelifesimulator.xyz, a private non-commercial project.

Data requests, withdrawal of consent, complaints — legal@spacelifesimulator.xyz. We answer within 30 days.

What we collect

Everything we hold about you falls into four groups.

• Account: your email address (if you registered) or your Google account identifier and address (if you signed in with Google), the chosen language, the browser's time zone, the time of your last visit, and the opt-out flag for letters.
• Game: the hero and his history — name, temperament, events, goals, relationships. This also covers what you write yourself: free-text orders, suggestions on entries, likes, and follows of other heroes.
• Notifications: if you enabled browser notifications — the subscription address issued by your browser and the chosen hour of delivery.
• Visits: the path of the page opened, an anonymous daily visitor code, the device and platform category (phone or desktop), the domain of the referring site, and the campaign tag if you arrived through a tagged link.

Why, and on what basis

• To run the game and keep the hero from getting lost — account and game data. Basis: performance of a contract with you (Art. 6(1)(b) GDPR) — the Terms are that contract.
• To send letters about your hero and browser notifications — email address and subscription address. Basis: your consent, withdrawable in one tap (a link in the letter, a button in Account).
• To understand how many people play and where they drop off — anonymous visit statistics and in-game events. Basis: legitimate interest (Art. 6(1)(f) GDPR) in maintaining and improving the project; the data is collected in anonymous form and never used for advertising.
• To protect the server from brute force and abuse — request counters and daily scan summaries, with no content and no addresses. Basis: legitimate interest in security.

What we never do

• We do not store IP addresses or browser strings — not in the database, not in application logs, not in web-server logs. The IP is read in exactly one place, to derive the daily anonymous visitor code, and is forgotten immediately.
• We do not install third-party counters or advertising pixels, and we let no foreign scripts or fonts onto our pages.
• We do not sell or pass data to third parties for their own purposes; the exception is the processors listed below and the requirements of law.
• We do not profile you and make no automated decisions with legal effects for you.
• We do not keep advertising click identifiers: a campaign tag is a campaign, not a person.

Cookies and browser storage

We use only what the game cannot work without:

• a session marker — recognises you between pages; without it there is no game;
• the chosen language and time zone — so we do not ask twice;
• a debug marker — used by the developer only, behind a secret link.
• We have no advertising or analytics cookies. The anonymous visitor code is not stored in your browser: it is recomputed on the server every day, and yesterday cannot be linked to today through it.

Who else sees the data

We do not work in a vacuum — some tasks are performed by processors. There are four of them:

• hosting: Hetzner Online GmbH, Germany — servers and database are located in the European Union;
• letters: Resend (USA) — delivery of sign-in codes and letters about your hero;
• prose: Google (Gemini models, USA) — descriptions of in-game circumstances and the text of your orders go there so the game can parse and voice them; plus Google sign-in, if you use it;
• notifications: the push service of your own browser (Google, Mozilla or Apple, depending on the browser).

Transfers outside Europe

Some processors are in the USA. Transfers rely on the European Commission's Standard Contractual Clauses and/or an adequacy decision (the Data Privacy Framework), and only to the extent a given task needs.

Do keep in mind: the free-text order you type is sent to a language model for parsing. Do not write there anything you would not entrust to an outside service — neither your own real-life details nor anyone else's.

How long we keep it

• Account and hero — while you play, and until you delete the account yourself.
• A guest account with no email attached — up to six months of silence, then deleted automatically.
• Anonymous visit statistics — indefinitely: by construction it cannot be tied back to a person.
• The internal log of language-model calls — 30 days; daily statistics and security summaries — 90 days.
• Database backups — 30 days, then overwritten by rotation. Deletions reach the backups within that window.

Your rights

Under the GDPR (and comparable laws) you have the right to know what data we hold about you, to receive a copy, to have it corrected or erased, to restrict processing, to object to processing based on legitimate interest, to withdraw consent, and to lodge a complaint with your national supervisory authority.

The easiest right to use is erasure: the button on the Account tab wipes your email, Google link, notification subscriptions, time zone, likes, follows and the texts you sent. Your hero stays in the shared history of the world, but nothing ties him to you any more — there is no way to tell whose he was.

For everything else, write to legal@spacelifesimulator.xyz. We will ask you to confirm that the letter comes from the address attached to the account: that is what protects your data from someone else's requests.

Children

The game is not intended for children under 16 and deliberately collects no children's data. If it turns out an account was created by a child under that age, we will delete the account and its data. You can report this to legal@spacelifesimulator.xyz.

Security

The connection is protected by HTTPS, the database is reachable only from the server itself, staff pages are locked behind a client certificate, and accounts have no passwords — so there is nothing to steal. Perfect safety does not exist: should a breach occur, we will notify those affected and the supervisory authority as the law requires.

Changes

This policy may change along with the game. The date of the last revision is at the top of the page; material changes are announced in the game and, for those who left an address, by email.