Privacy policy
What we know about you when you play From Ashes, why we need it, and how you stay in control of it.
The short version
- You can play without an account. Then everything stays in your own browser and we never see it.
- If you make an account, we keep your email, username, saved game, friends list, how many minutes you play each day, any bug reports you send and what you buy.
- We don't show ads, we don't use analytics or tracking tools, and we don't sell or share your data for advertising.
- Card payments are handled by Stripe. We never see your card number.
- A few trusted companies help run the game (database, hosting, payments, sign-in, fonts). They're all listed below.
- You can ask for a copy of your data, or for your account to be deleted, at any time by emailing [contact email].
This summary is here to help. The full policy below is what applies.
Who we are
From Ashes is made and run by [Your legal name or company] of [postal address], [country] (“we”, “us”). We decide how and why your personal data is used, which makes us the controller of it under data protection law, including the EU and UK General Data Protection Regulation (GDPR).
Questions about privacy go to [contact email]. A real person reads that inbox.
What we collect
What we hold depends on how you play.
If you play without an account
Your settings and progress are kept in your browser's local storage on your own device. Offline accounts, which some builds of the game offer, live only in that browser too. None of it is sent to us. Our Cookies and storage page lists exactly what is stored.
If you make an account
| What | Details | Where it comes from |
|---|---|---|
| Account | Your email address, your username, an account ID, when you joined. Your password is stored only as a secure hash by our sign-in provider; we can't read it. | You, when you sign up. If you choose Google sign-in, Google shares your email address, name and profile picture link; we use only the email address. |
| Saved game | Your progress: chapter, checkpoint, where you are standing, shillings and copper, what you own, which characters you have met, the in-game clock and weather, and when you last saved. | The game, when it saves. |
| Friends | Friend requests you send and accept, and your friends list. Other signed-in players can find you by your username, but never see your email. | You. |
| Play activity | When you were last playing, and how many minutes you played on each day. While the game is open and on screen, it sends a short signal about once a minute. | The game, while you are signed in. |
| Purchases | What you bought, the shillings it added, the price and currency, the time, Stripe's payment reference, and whether it was refunded. Not your card details. | Stripe, after you pay. |
| Bug reports | Your message, the game version and the time. If you leave “Include game details” ticked: your browser type and version, screen size, your game settings, and where you are and what you're doing in the game. | You, from the pause menu. |
| Technical data | Your IP address and basic request details (such as time and browser type), which our hosting, database and payment providers record to deliver the game and protect it from abuse. | Your browser, automatically. |
What we don't collect
No advertising IDs, no analytics or tracking scripts, no third-party tracking cookies, no precise location, no contacts, and no access to your camera or microphone. We don't ask for sensitive information such as health, religion or ethnicity, and you shouldn't include it in usernames or bug reports.
Why we use it, and our legal basis
Data protection law asks us to name a legal reason for each use. These are ours.
| Why | Data used | Legal basis |
|---|---|---|
| Run your account, sign you in and keep your save across devices | Account, saved game | Needed to provide the game you asked for (contract) |
| Let you add and find friends | Username, friends | Contract |
| Take payments and deliver what you bought | Account, purchases | Contract |
| Keep payment and tax records | Purchases | Legal obligation |
| Count how many people play and for how long, to keep the servers healthy and decide what to build next | Play activity | Our legitimate interest in running and improving a small game. We only look at it as totals and per-player summaries, never for advertising. |
| Find and fix bugs | Bug reports | Legitimate interest. The extra game details are optional: untick the box and they aren't sent. |
| Send account emails (confirm your address, reset a password) and payment receipts | Contract | |
| Keep the game secure, stop cheating, fraud and abuse, and enforce our terms | Account, activity, purchases, technical data | Legitimate interest, and legal obligation where it applies |
We don't make decisions about you by automated means that have legal or similarly significant effects, and we don't profile you for marketing. We won't send you marketing email unless you have separately agreed to it.
Who helps us run the game
We use a small number of service providers. They process data on our instructions and under data processing terms. Each has its own privacy policy:
| Provider | What they do | Privacy policy |
|---|---|---|
| Supabase | Accounts, sign-in, database for saves, friends, activity, purchases and bug reports. Sends account emails. | supabase.com/privacy |
| Stripe | Payment pages and card processing. Stripe also acts as an independent controller for some data, for example to prevent fraud and meet financial rules. | stripe.com/privacy |
| Vercel | Hosting the website and the small server functions that start payments. | vercel.com/legal/privacy-policy |
| Cloudflare | Hosting and delivering the website's files quickly and securely. | cloudflare.com/privacypolicy |
| Google sign-in, only if you choose it. Google Fonts: your browser downloads the game's fonts from Google's servers, which see your IP address and browser details. | policies.google.com/privacy |
Depending on how a version of the game is deployed, it may be hosted by Vercel, by Cloudflare, or by both.
Other than these providers, we only share personal data when the law requires it (for example a valid court order), to protect people's safety or our legal rights, or if the game is transferred to a new owner, who would then have to respect this policy. We will tell you before that happens.
We do not sell your personal data, and we do not share it for cross-context behavioural advertising.
How long we keep it
| Data | Kept for |
|---|---|
| Account, saved game, friends, play activity | As long as your account exists. When you ask us to delete your account, we delete these within 30 days. Copies in our provider's backups expire on their normal cycle after that. |
| Purchase records | As long as tax and accounting law requires, usually 6 to 10 years. If you delete your account, the record is unlinked from you and kept only for those legal reasons. |
| Bug reports | Until the bug is dealt with, and no longer than 24 months. If you delete your account, your reports are unlinked from it. |
| Technical logs | For the short period our hosting and database providers keep them, typically days to weeks. |
| Data in your browser | Until you clear it. See Cookies and storage. |
Your rights
Wherever you live, you can ask us to:
- See your data and get a copy of it.
- Export it in a machine-readable format (we send JSON) so you can take it elsewhere.
- Correct it. You can change your username yourself in the game; for anything else, ask us.
- Delete it, including your whole account.
- Object to, or ask us to restrict, how we use it, including the uses based on legitimate interest.
- Withdraw consent where we rely on it, without affecting what happened before.
How to ask
Email [contact email] from the address on your account, and say what you'd like. If you write from another address, we may ask a few questions to check the account is yours, so nobody else can get your data. It's free, and we reply within one month (we'll tell you if a complex request needs longer, as the law allows).
Deleting your account also deletes your saved game, friends and play activity. Any shillings and items you had are lost and can't be restored or refunded, except where the law says otherwise. Data stored only in your browser isn't something we can reach: clear it in your browser's settings.
Complaints
If you're unhappy with how we've handled your data, please tell us first so we can put it right. You also have the right to complain to a data protection authority, such as the one in the country where you live or work. In the UK that is the Information Commissioner's Office.
If you live in the United States
This section adds detail required by US state privacy laws, including the California Consumer Privacy Act as amended by the CPRA.
- Categories we collect: identifiers (email, username, account ID, IP address); commercial information (purchase records); internet or other electronic network activity (play activity, bug report details, technical logs). Sources and purposes are described above.
- Disclosure: in the last 12 months we disclosed these categories only to the service providers listed above, for the business purposes described in this policy.
- No sale or sharing: we do not sell personal information or share it for cross-context behavioural advertising, and have not done so in the last 12 months. We do not knowingly sell or share the personal information of anyone under 16.
- Sensitive information: account sign-in details are used only to sign you in. We don't use sensitive personal information to infer characteristics about you.
- Your rights: to know, access, correct and delete your personal information, and not to be treated differently for using these rights. You can use an authorised agent; we'll ask for proof of their authority and may verify your identity.
- Global Privacy Control: we honour it, though since we don't sell or share data there is nothing extra for it to switch off.
Children
From Ashes contains realistic violence and is intended for players aged 16 and over (see the content notice). You must be at least 13 to make an account. In countries where the law requires a parent's consent below a higher age, such as 16 in parts of the European Union, you must be at least that age, or have your parent or guardian's consent.
We don't knowingly collect personal data from children under 13. If you think a child has made an account, email [contact email] and we will delete it.
Where your data is stored
We are based in [country]. Our database is hosted in the [Supabase region] region. Our providers operate worldwide, so your data may be processed in other countries, including the United States, whose laws may differ from yours.
When personal data from the European Economic Area, the UK or Switzerland is transferred to a country without an adequacy decision, we rely on safeguards such as the European Commission's Standard Contractual Clauses (with the UK addendum where needed), offered by our providers in their data processing terms. You can ask us for more detail about these safeguards.
How we protect it
The game is served only over encrypted connections (HTTPS). Passwords are stored as secure hashes by our sign-in provider. Database rules make sure each player can only reach their own saves and purchases. Card details go straight to Stripe and never touch our servers. Access to the admin tools is limited to the people who run the game.
No system is perfectly secure. If a breach puts your data at risk, we will tell you and the authorities as the law requires. If you find a security problem, please email us before telling anyone else.
Changes to this policy
When we change this policy we update the effective date at the top. If a change matters, for example a new kind of data or a new provider, we'll tell you in the game or by email before it takes effect. Older versions are available on request.
Contact
[Your legal name or company]
[postal address], [country]
[contact email]