Privacy policy
We are two people making games. We collect as little about you as we can, and we never sell your data. This page explains exactly what we collect, why, and what you can do about it.
Last updated 17 October 2026
This text is a template: it must be reviewed by a qualified lawyer and every placeholder in [square brackets] completed before launch.
1. Who is responsible for your data
The controller of your personal data is [COMPANY NAME], [REGISTERED ADDRESS], [COUNTRY] (company registration number [COMPANY REGISTRATION NUMBER]), operating ChaosInOurMind at https://chaosinourmind.com. You can reach us about anything privacy-related at legal@chaosinourmind.com. We have not appointed a data protection officer because the law does not require one for a service of our size. [PLACEHOLDER: confirm, or add DPO contact.]
2. What we collect and why
Visiting the site
When you open any page, our hosting provider's servers automatically process technical data: your IP address, the date and time, the page requested, your browser and operating system, and the referring page. We need this to deliver the page, keep the service secure and find errors. Server logs are deleted after [PLACEHOLDER: X] days unless we need them longer to investigate a specific security incident.
Your account
If you register, we store your email address, display name, password, role (for example player or admin) and the date you created the account. Your password is never stored in readable form: we keep only a bcrypt hash of it. At signup you confirm that you are at least 16 years old or have your parent's or guardian's consent.
When you log in, we create a random session token. We store it in a cookie called com_session in your browser (httpOnly, valid for 30 days) and keep only a hashed copy on our server. This is how we know it is you on the next page load.
Game saves
Our games save your progress through a small save system built into the site. Where the save ends up depends on whether you are logged in:
- Logged in: the save data (a small JSON file, at most 64 KB per game) is stored on our server and linked to your account, so you can continue on another computer.
- Not logged in: the save stays in your own browser's local storage (keys starting with com-save:). It is never sent to us. If you clear your browser data, it is gone.
Save data contains game progress only, such as levels, scores and settings. Our games do not ask for personal information.
Supporter purchase
If you buy Supporter status, the payment is handled by Stripe through Stripe Checkout. You enter your card details directly with Stripe. We never see or store your card number. From the purchase we keep a record of the amount, currency, the Stripe payment reference, the time of purchase, and the time you gave your express consent to immediate access and acknowledged that you lose your 14-day right of withdrawal. Stripe tells us whether the payment succeeded and may share basic billing details we need for invoicing and tax. [PLACEHOLDER: if a Merchant of Record such as Paddle is used instead of Stripe, replace this section: the Merchant of Record then sells to you directly and is a separate controller for the payment.]
Developer submissions
If you submit a game, we store what you put in the form: game title, studio name, genre, pitch, description, contact email, an optional build URL and an optional uploaded .zip file (up to 50 MB, stored privately and only visible to our review team). We also store the review status (pending, approved or rejected) and our review note. If your game is accepted, we will also need your payout and tax details. See the developer agreement.
Contacting us
If you email us, we use your email address and message to answer you, and keep the conversation for as long as needed to deal with your request.
Optional analytics and ads
At the moment the site uses no analytics tool and shows no ads from an ad network. We plan to add ads later to keep the games free. Before that happens, we will name the provider here and in the cookie policy, and measurement or personalised advertising will only run if you say yes.
3. Legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Account, login session, cloud saves | Contract, Art. 6(1)(b) |
| Supporter purchase | Contract, Art. 6(1)(b) |
| Reviewing submissions, developer agreement, payouts | Contract and pre-contract steps, Art. 6(1)(b) |
| Keeping purchase and payout records for accounting and tax | Legal obligation, Art. 6(1)(c) |
| Security, fraud prevention, abuse prevention, basic server logs | Legitimate interest, Art. 6(1)(f): keeping the service safe and working |
| Answering your emails | Legitimate interest, Art. 6(1)(f), or contract where the email is about your account or purchase |
| Analytics and personalised ads | Consent, Art. 6(1)(a), and for the cookies themselves the ePrivacy rules on device storage |
Where we rely on legitimate interest, you can object at any time (see section 7). Where we rely on consent, you can withdraw it at any time through Cookie settings in the footer. Withdrawing does not affect processing that happened before.
4. Who we share data with
We do not sell personal data. We share it only with service providers who help us run the site, and only what they need:
- Hosting provider [PLACEHOLDER: name, location]: stores the website, database and uploaded files.
- Stripe (Stripe Payments Europe Ltd., Ireland): processes Supporter payments. Stripe is also an independent controller for some data it needs for its own legal duties, such as fraud prevention and anti-money-laundering checks. See Stripe's privacy policy.
- Ad partner: none yet. When we add one, we will name it here before it goes live.
- Email provider [PLACEHOLDER: name, location]: sends account and service emails, and handles our inbox.
- Our accountant [PLACEHOLDER: if applicable]: receives purchase and payout records for bookkeeping.
Service providers act on our written instructions under data processing agreements (GDPR Art. 28). We may also disclose data to authorities when the law requires it.
Games on the site are built by us or by independent developers, but they run inside a sandboxed frame and are not allowed to collect your personal data, show their own ads or include trackers.
5. Transfers outside the EU
Some providers, such as Stripe, may process data outside the European Economic Area, for example in the United States. Where that happens, the transfer is covered by an adequacy decision (such as the EU-US Data Privacy Framework, for providers certified under it) or by the European Commission's Standard Contractual Clauses with additional safeguards where needed. You can ask us for a copy of the relevant safeguards.
6. How long we keep data
| Data | How long |
|---|---|
| Account data | Until you delete your account |
| Login sessions | 30 days, or until you log out or delete your account |
| Cloud game saves | Until you delete them or your account |
| Guest saves (your browser) | Under your control: until you clear your browser storage |
| Purchase records | As required by accounting law, currently [PLACEHOLDER: X] years after the end of the financial year |
| Game submissions | Until 2 years after rejection, or 2 years after the developer relationship ends |
| Payout and tax records for developers | As required by accounting and tax law, currently [PLACEHOLDER: X] years |
| Server logs | [PLACEHOLDER: X] days |
| Emails with us | As long as needed to handle your request, then deleted within [PLACEHOLDER: X] months |
7. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you and get a copy.
- Rectification: have incorrect data corrected.
- Erasure: have your data deleted, unless we must keep it by law.
- Restriction: ask us to pause using your data while a dispute is checked.
- Portability: get the data you gave us in a machine-readable format.
- Objection: object to processing based on legitimate interest.
- Withdraw consent at any time, as easily as you gave it.
- Complain to a data protection authority. Ours is [NATIONAL DATA PROTECTION AUTHORITY], but you can also complain to the authority where you live or work.
You can do the most common things yourself, without waiting for us:
- Download your data: while logged in, open /api/account/export to get everything linked to your account as a JSON file.
- Delete your account: go to your account page. This deletes your account, cloud saves, submissions and all login sessions. Purchase records are kept only where accounting or tax law requires it.
- Change consent: click Cookie settings in the footer.
For anything else, email legal@chaosinourmind.com. We reply within one month. We may ask you to confirm your identity first, usually by writing from the email address on your account.
8. Security
We use HTTPS everywhere, store passwords and session tokens only as hashes, keep uploaded files private, and limit admin access to the two of us. No system is perfectly secure. If a breach puts your rights at risk, we will tell you and the authority as the law requires.
9. Children
The service is not aimed at children under 16 without parental consent. To create an account you must confirm that you are 16 or older, or that a parent or guardian has agreed. If you believe a child has given us data without that consent, email us and we will delete it. You can play without an account; then no personal data is stored on our side beyond the technical data in section 2.
10. No automated decisions
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
11. Changes to this policy
We will update this page when our practices change and show the new date at the top. If a change matters to you, for example a new type of data or a new purpose, we will tell account holders by email or on the site before it takes effect.