PRIVACY NOTICE

Hendrik Malan, an individual trading as SHADOWFLOW, is the data controller for the personal data described here. This notice explains what we collect, why, who we share it with and what rights you have.

DATA WE COLLECT AND WHY

• Account data — email address, login credentials and, if you sign in with Google, the basic profile Google returns. Used to create and secure your account and to link your season pass. Legal basis: performance of our contract with you.
• Gameplay data — chosen username, times, deaths, jumps, medals, ghost replay paths, achievements and chambers you build or publish. Used to provide the game, records and leaderboards. Legal basis: performance of our contract.
• Purchase records — the fact that an account holds a season pass, and a reference to the corresponding order. Used to grant access. Legal basis: contract and legal obligation. Payment card details are collected and processed by Paddle, not by us.
• Technical and usage data — IP address, device and browser information, error logs and basic usage events. Used for security, fraud prevention, debugging and improving the game. Legal basis: our legitimate interest in a secure, working service.
• Support messages — anything you send us by email. Used to answer you. Legal basis: legitimate interest and contract.

WHO WE SHARE DATA WITH

• Service providers and subprocessors that host the game, its database and authentication, and provide error logging.
• Paddle.com, our Merchant of Record, for the sale of the product, subscription and order management, payments, invoicing and tax compliance.
• Professional advisers such as legal and accounting providers, where necessary.
• Authorities, where we are required to disclose data by law.

We do not sell personal data.

INTERNATIONAL TRANSFERS

Our providers may process data outside your country, including outside the UK and EEA. Where that happens we rely on appropriate safeguards such as adequacy decisions or Standard Contractual Clauses.

RETENTION

We keep account, gameplay and purchase data for as long as your account is active and for up to 24 months afterwards, except where a longer period is needed for tax, accounting or legal reasons. Technical logs are kept for a shorter period, typically up to 12 months. After that, data is deleted or anonymised.

YOUR RIGHTS

Depending on where you live, you may have the right to access your data, correct it, delete it, restrict or object to processing, receive a portable copy, and withdraw consent where processing is based on consent. You can also complain to your local data protection authority. Email us and we will respond within one month.

SECURITY

We use appropriate technical and organisational measures, including encryption in transit, access controls and row-level database permissions so that your records are only readable by your account.

COOKIES AND LOCAL STORAGE

We use strictly necessary cookies and browser local storage to keep you signed in and to store your settings, best times and ghost replays on your device. We do not use advertising cookies. You can clear this data in your browser settings, or from the in-game settings screen, though doing so signs you out and removes locally stored records.

CHILDREN

SHADOWFLOW is not directed at children under 13 (or the minimum age in your country). If you believe a child has given us personal data, contact us and we will delete it.

CONTACT

Hendrik Malan (trading as SHADOWFLOW) — hfcm95@gmail.com