This policy explains what personal data Lostgamer collects when you use lostgamer.io, why, who it's shared with, how long it's kept, and the rights you have over it. We've tried to keep it plain: if anything's unclear, ask us.
1.Who we are
Lostgamer is run by Edenstorm Ltd, a company registered in England and Wales (company number 13442311), whose registered office is at 128 City Road, London, EC1V 2NX, United Kingdom. We're the controller of the personal data described here, under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and the EU GDPR where it applies to you.
For anything about your data, email us at [email protected].
2.What we collect
When you play without an account
The first time you do something that needs a player (starting a game, joining a room), we make you a guest player with a generated name and avatar, tied to your browser by a cookie. Your games are kept under it, as they would be for an account.
Your account
- Sign-up details: your email address, username and password. We keep your password only as a one-way hash (Argon2id), never the password itself.
- Your profile: anything you add to it, such as your country, your banner, the badge and title you show, and your avatar.
- Linked accounts: if you link Twitch, Kick, YouTube or Discord, we keep that account's id, its name or handle and whether the platform verified it. We never keep the platform's access tokens.
What you do on Lostgamer
- Games: the games you play, your guesses, scores, distances and times, the rooms you join and the daily challenges, duels and leaderboards you take part in, and the titles you earn.
- Replays: while you play a round, your browser records what you do (how you look around and move, and the guess map's view) and sends it with your guess. We keep it so you and others can watch the round back, and to check games are played fairly.
- Things you make or send us: maps you create, reports about locations, suggestions, and anything you write in them.
- Duel matchmaking: while you search for a duel, the games you picked and how long you waited.
Payments
If you subscribe to Ad-free or Premium, payment is handled by Stripe. We never see or store your card details. We keep your Stripe customer id, your subscription's tier and status, and the periods you've paid for.
Technical information
- Sign-ins: for each signed-in browser, the IP address and browser details (user agent) it signed in from, to keep your account secure.
- Rate limits: to stop abuse, we count some actions (signing in, signing up, starting games, reports) per IP address, email or account. These counters store only a one-way hash, never the address itself, and expire with their time window.
- Cookies and similar technologies: see our Cookie Policy, which also covers analytics and advertising.
3.How we use it, and why we're allowed to
Data protection law requires a lawful basis for each use of your data. Ours are:
- To provide Lostgamer (contract): running your account and games, leaderboards, rooms, duels, replays, linked accounts and your subscription; sending you sign-up codes and account emails.
- Our legitimate interests: keeping Lostgamer secure and fair (rate limits, checking replays, spotting cheating and abuse), checking new passwords against known breaches, fixing problems, and understanding how Lostgamer is used so we can improve it. We only rely on this where it isn't outweighed by your interests.
- Your consent: analytics and personalised advertising cookies, and sharing a hash of your email with our ad partner, where the law requires consent (see the Cookie Policy). You can withdraw consent at any time.
- Legal obligations: keeping financial records and answering lawful requests from authorities.
We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.
4.What other players can see
Lostgamer is a game played with and against others, so some of what you do is public:
- Your username, avatar and profile (country, banner, badge, title and earned titles).
- The linked account you choose to show beside your name, with a link to it.
- Your scores and places on leaderboards, including the daily challenge's.
- In a room or a duel, your guesses and scores, seen by the other players while you play.
- Maps you publish (or share by link), shown with your username as their creator.
- Results you share, through the share link and its preview card.
Your email address, password, payment details and sign-in details are never shown to other players.
6.International transfers
Some of the companies above are based in, or process data in, countries outside the UK and the European Economic Area, such as the United States. Where they do, we rely on safeguards recognised by UK and EU law, such as adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework), the UK International Data Transfer Agreement or Addendum, and the EU Standard Contractual Clauses.
7.How long we keep it
- Your account and games: until you delete your account (see below).
- Sign-ins: a signed-in browser's session ends after 30 days without a visit, and its record goes with it.
- Sign-up and email change requests: until their code expires.
- Rate limit counters: until their window ends, at most a day.
- Duel searches: deleted within a day.
- Guest players: kept with their games, so the results and leaderboards they're part of stay whole. Email us to have yours removed.
- Payment records: as long as tax and accounting law requires, usually six years.
8.Deleting your account
You can delete your account at any time from Settings. When you do, at once:
- Your account goes: your email address, password, profile and linked accounts, and every signed-in browser.
- Your singleplayer games, their replays and your leaderboard places are deleted.
- A running subscription is cancelled, so you're never charged again.
- Your username is free for someone else to take.
Some things are woven into other players' games, so they stay without anything that identifies you: your part in multiplayer games shows as a “Deleted player”, maps you published stay playable as made by a deleted player, and reports and suggestions you sent stay with us, no longer tied to an account. We send a final email confirming the deletion.
9.Your rights
Under UK and EU data protection law you have the right to:
- Get a copy of the personal data we hold about you.
- Have inaccurate data corrected (much of it you can change yourself in Settings).
- Have your data deleted.
- Restrict or object to how we use it, including where we rely on legitimate interests.
- Receive the data you gave us in a portable format.
- Withdraw your consent at any time, where we rely on it.
To use any of these, email [email protected]. We'll reply within a month, and may need to confirm it's really you first. If you're unhappy with how we've handled your data, you can complain to the UK Information Commissioner's Office (ico.org.uk) or, in the EU, your local data protection authority, though we'd like the chance to put it right first.
If you live in a US state with its own privacy law, such as California, you have similar rights to know about, correct and delete your data, and to opt out of “sharing” for targeted advertising, which you can do in the ad consent settings, by turning off Improve quality of ads in your settings, or by emailing us. We won't treat you differently for using them.
10.Children
Lostgamer is for players aged 13 and over. If you're under the age of digital consent where you live (16 in some EU countries), you need a parent or guardian's permission to make an account. We don't knowingly collect data from children under 13; if you believe a child has given us their data, email [email protected] and we'll delete it.
11.Security
We protect your data with encryption in transit (HTTPS), passwords stored only as strong one-way hashes, sign-in cookies that scripts on the page can't read, and access to our systems limited to the people who need it. No service can promise perfect security, so please use a password you don't use anywhere else.
12.Changes to this policy
We'll update this policy when what we do with your data changes, and change the date at the top. If a change is significant, we'll tell you on the site or by email before it takes effect.
13.Contact us
Email [email protected], or write to Edenstorm Ltd, 128 City Road, London, EC1V 2NX, United Kingdom.