Summary, provided for convenience only. This summary does not form part of the Policy and does not replace the sections below. We run no accounts, no analytics, no advertising and no third-party trackers. We hold no profile for you. Your save file stays on your device. The only personal data that reaches us at all is the IP address your device has to disclose to connect to anything, and we keep it no longer than the connection requires.
1. Who we are, and what this covers
This Privacy Policy (the "Policy") is issued by Cygnus Works LLC ("Cygnus Works", "we", "us" or "our"), which is the controller of the personal data described below.
It applies to the game Thanatide (the "Game") in every form we publish it:
the Android application (com.cygnusworks.thanatide), the desktop builds, the browser
demo, and this website at thanatide.cygnusworks.com (together, the
"Services"). "You" means the person using them.
Anything you reach by following a link away from the Services is somebody else's site, run under somebody else's policy. This one stops at our boundary.
2. Data stored on your own device
Your progress, meaning campaign completion, inventory, loadout, settings and local leaderboard scores, is written to storage on the device you are playing on: app-private storage on Android, the equivalent application data directory on desktop, and browser local storage in the browser demo.
That data stays there. It is not transmitted to us. We do not receive it, hold it, back it up, or have any means of reading it. Deleting it is entirely within your control: clear it from the Game's own settings, clear the site data in your browser, or uninstall the application. Once it is gone we cannot restore it, for the simple reason that we never had a copy.
3. Permissions requested
On Android the Game declares one permission, INTERNET, used solely for the
purposes set out in sections 4 and 5. The Game does not request, and cannot obtain, access to
your location, contacts, camera, microphone, photos, files, the advertising identifier, or any
other persistent device identifier.
4. Online co-op
Co-op sessions are peer-to-peer. If, and only if, you host or join a lobby:
- Your device opens a short-lived connection to a signaling service we operate, which exchanges the technical details two devices need to find each other. It handles connection setup and nothing else. It carries no game state, holds no accounts, and has no database behind it.
- Connection setup also queries a public STUN server operated by Google, which is how your device learns its own externally visible address. Google's handling of that request is governed by Google's privacy policy and not by this one.
- Your device then connects directly to the other players' devices. Where a direct connection cannot be established, traffic is carried by a relay (TURN) server we operate, which forwards packets without inspecting, decrypting or storing them.
Because these are direct connections, the other players in your lobby, our signaling and relay servers, and the STUN server can see your IP address. That is a technical necessity of peer-to-peer networking and is true of most online multiplayer games. We use it to set up and hold open the connection you asked for. We do not log it for analysis, we do not profile it, and we do not disclose it to anyone other than the peers you chose to play with.
If you never host or join a co-op lobby, none of the above happens and your device never contacts the signaling service at all.
5. Update checks and hosting
The application periodically requests a static manifest file from our update host to determine whether newer game content is available, and downloads that content if it is. This website and the browser demo are served from the same infrastructure.
As with any request made over the internet, our host and the content delivery network in front of it receive that request in the ordinary course of serving it, and may record it in operational logs containing your IP address, the file requested, the time of the request and your browser or device user-agent string. Those logs exist to keep the Services running and secure. We do not analyze them, build profiles from them, or combine them with any other data.
6. Purchases and storefronts
Where the Game is distributed or sold through a third-party storefront, including Google Play and Steam, your purchase, refund, entitlement and any account relationship are handled by that storefront under its own terms and its own privacy policy. We never receive your payment card details, billing address, or storefront account credentials. What we receive from the storefront is aggregate sales reporting that does not identify individual purchasers.
7. What we do not do
- No advertising, and no advertising identifier is requested or used.
- No analytics, crash reporting, telemetry, or session recording of any kind.
- No accounts, no email collection, no sign-in, no newsletter.
- No cookies set by us, and no third-party tracking scripts on this website.
- No access to location, contacts, camera, microphone, photos or files.
- No sale of personal information, and no sharing of it for cross-context behavioral advertising, as those terms are defined under California law.
8. Retention
We operate no system that stores personal data from which you could be identified, so for the most part there is nothing to retain. The operational logs described in sections 4 and 5 are rotated and deleted within thirty (30) days on infrastructure under our direct control. Our hosting and content delivery providers keep their own request logs under their own retention schedules, which we do not control.
9. Legal bases for processing
Where the EU or UK General Data Protection Regulation applies, we rely on the following legal bases. For the connection data described in section 4: performance of a contract with you, under Article 6(1)(b), namely delivering the multiplayer session you requested. For the operational logging described in section 5: our legitimate interests, under Article 6(1)(f), in keeping the Services available, functioning and secure against abuse.
10. International transfers
The Services are delivered from servers and content delivery infrastructure that may sit outside the country you are playing from. Because we store no personal data, no international transfer of stored personal data takes place. Transient connection data is processed by whichever server handles the connection at the time it is made.
11. Security
Peer-to-peer traffic is encrypted in transit by the DTLS and SRTP encryption that WebRTC requires. This website, the browser demo and the update host are served over HTTPS. No system is perfectly secure, but the surface here is deliberately small: there is no database to breach, no credential store to steal, and no archive of player data to lose.
12. Children
The Game depicts sustained graphic violence and is intended for an adult audience. It is not directed to children and we do not knowingly collect personal information from any person, including any person under 13 years of age, or under 16 where local law sets that threshold. We have no actual knowledge of selling or sharing the personal information of consumers under 16 years of age, and we do not do so. If you believe a child has provided personal information to us, contact us at section 15 and we will act on it, though in practice there is nothing held for us to delete.
13. Your rights
Depending on where you live, you may hold rights under the EU or UK GDPR, the California Consumer Privacy Act as amended by the CPRA, or comparable legislation. These typically include the right to know what personal data is held about you, and to obtain access to it, correct it, delete it, receive it in a portable form, restrict or object to its processing, and not to be treated worse for having asked.
We can act on those rights only to the extent that we hold data about you, and we hold none. There is no account to access, no profile to correct, no record to export, and nothing to delete. Data the Game creates lives on your device and is under your sole control at all times, as set out in section 2.
You may nonetheless write to us at the address in section 15 to exercise any right, and we will respond within thirty (30) days. If you are in the EEA or the UK, you also have the right to lodge a complaint with your local supervisory authority.
14. Changes to this Policy
We may revise this Policy from time to time. The effective date at the top of the page changes when we do, and the current version is always published at this address. Where a change is material, we will note it in the Game's patch notes. Continuing to use the Services after a revision takes effect means you accept the revised Policy.
15. Contact
Questions, requests and complaints about this Policy go to [email protected], addressed to Cygnus Works LLC.