Privacy Policy
Effective 8 August 2026.
Proposed administrator connection review
A limited account-link review feature is being prepared and starts disabled. Before activation, its purpose, privacy assessment, notices and retention periods require owner approval. The proposal uses keyed representations of exact connection addresses and sampled activity times, with no historical plaintext address log or external address-enrichment service.
Proposed limits are at most 90 days for observations, 180 days from case creation for review notes and decisions, and 90 days for investigation access audits. Authorised global administrators would need an investigation reason; shared connections would not prove common control or a game-rule breach, and this feature would take no automatic moderation action. Account closure would remove the account's observations and pair cases; ordinary exports would include only the account's sampled activity records.
Controller and contact
Shadow, trading as Shadow Government, is the controller of personal data processed to operate the game, except where a provider acts as an independent controller for its own purposes.
Office 1761, 3 Fitzroy Place, 1/1, Sauchiehall Street, Finnieston, Glasgow Central, G3 7RH, UK[email protected]
A shorter explanation for users aged 13 to 17 is available in our young person's privacy guide.
What we collect
- Account data: email, display name, password hash, exact date of birth, age band, settings, roles, display-name change history, sessions and two-factor state.
- Security data: IP address, coarse location supplied by trusted infrastructure, last-seen time, authentication records, abuse controls and audit events.
- Game and community data: memberships, parties, activity, forum posts, direct messages, news, lore, reports, blocks and moderation actions, including snapshots of reported profiles or public content used for moderation review.
- Support and rights data: requests, complaints, acknowledgement and update history, handler, evidence and final response.
- Uploads and generated content: submitted files, scan status, object-storage references and generation/usage metadata.
- Optional integrations: Discord identity/routing/delivery data; email delivery records; text sent for read-aloud; and voice-advisor operational metadata.
- Payments: tier, consent wording/version, amount, currency, tax, payment path, transaction/invoice/subscription IDs, status, renewal, cancellation and refund data. We do not receive full card numbers or card security codes.
- Diagnostics: ordinary server and first-party operational errors; and, only after a separate opt-in, masked Sentry browser replay and performance traces.
Purposes and lawful bases
| Activity | Purpose | Lawful basis | Required or optional |
|---|---|---|---|
| Registration, authentication, gameplay, forums and messages | Create and secure the account and provide the game and requested community features. | Contract. Security controls also rely on legitimate interests in preventing abuse and protecting users. | Email, password, display name and date of birth are required by the current registration design; most posting is optional. |
| Date of birth and age band | Enforce the 13+ rule, age-based upload review and age-appropriate safeguards, and recalculate age bands. | Contract and legitimate interests in safeguarding and operating an age-appropriate service. Exact DOB is not represented as required by law. | Required to register under the current design; proportionality remains under the Children's Code DPIA review. |
| Sessions, IP/location and security/audit records | Authenticate, detect abuse, investigate incidents and preserve service integrity. | Legitimate interests in security, fraud prevention and legal claims; legal obligation where a specific record must be kept. | Generated as part of secure use. |
| Reports, moderation and safety complaints | Review content, protect users, enforce rules, handle appeals and meet applicable online-safety duties. | Legitimate interests and applicable legal obligations. Contract also supports enforcement of the Terms. | Submitting a report is optional; some safety records must then be retained. |
| Support, formal rights requests and data-protection complaints | Answer requests, verify identity, investigate, acknowledge and communicate outcomes. | Contract, legitimate interests, and legal obligations under data-protection and consumer law. | Optional unless needed to exercise a right or resolve a problem. |
| Email notifications and Resend delivery | Send essential account messages and user-selected service notifications. | Contract for essential messages; contract and legitimate interests for selected operational notifications. The service does not treat this as consent to unrelated marketing. | Essential messages are required; topic notifications are configurable. |
| Discord | Link an account and deliver optional commands, relays and notifications. | Contract to provide the feature deliberately enabled by the user; legitimate interests in delivery security and deduplication. | Optional and can be unlinked. |
| Stripe/Link and local accounting records | Take payment, deliver premium access, manage subscriptions/refunds, prevent fraud, reconcile entitlements and keep required records. | Contract, legal obligations for accounting/tax/consumer records, and legitimate interests in fraud prevention and legal claims. | Required only if premium is purchased. |
| Cartesia read-aloud and voice advisor | Generate requested audio or run an explicitly started, read-only voice conversation and reconcile quotas. | Contract to provide the requested feature; legitimate interests in security, cost and misuse controls. | Optional; microphone capture requires a deliberate start and browser permission. |
| OpenAI-backed metadata/portrait features | Generate a result requested by an authorised user and manage usage, cost and abuse. | Contract and legitimate interests in service operation and abuse prevention. | Optional premium features. |
| Cloudmersive upload scanning and object storage | Check player uploads for malware and store approved assets. | Contract and legitimate interests in platform security. | Required only when a user chooses to upload. |
| Sentry browser Replay and performance traces | Diagnose browser errors and reliability problems at individual-session level. | Consent. Replay and browser tracing are off until the separate diagnostics preference is positively enabled. | Optional and withdrawable in Settings. |
| Ordinary server-side error monitoring | Detect faults, attacks and operational failures without optional browser replay. | Legitimate interests in security and reliable service operation. | Operational. |
Providers, recipients and payment roles
Authorised operators and moderators receive role-limited access. Relevant recipients may include hosting/object-storage and infrastructure providers; Stripe/Link and financial institutions; Discord; Sentry; Cartesia; OpenAI; Resend; Cloudmersive; professional advisers; regulators; courts; law enforcement; and a purchaser or successor where legally permitted.
For a Stripe Managed Payments purchase, Link is the merchant of record for the payment transaction and provides transaction, order, refund and subscription support through Link. Shadow Government operates and supplies the game and remains responsible for product delivery, product support, its content, advertising, statutory notices and its own legal obligations.
Link/Stripe is an independent controller for its Managed Payments transaction, Link account, fraud, order-support and merchant-of-record obligations. Use Link order management or Link support for those records and transactions. Shadow Government remains controller for its game account, product delivery, local entitlements, support, consent and compliance records.
If you enable Discord, we share the Discord user ID and username needed to link and route the feature, plus the content required for a requested command, relay or notification. Discord handles its platform data under the Discord Privacy Policy. Shadow Government deletes terminal Discord delivery records after 90 days under the current application rule; Discord's own retention is controlled separately.
Some other providers act as processors for Shadow Government; some may be independent controllers for their own account, security or legal purposes. The production compliance checklist requires the operator to verify each current DPA, role and subprocessor list before launch rather than treating every provider identically.
International transfers
Providers may process data outside the UK. Where Shadow Government makes a restricted transfer, the operator must verify and document an applicable UK adequacy regulation, the UK International Data Transfer Agreement or UK Addendum to approved standard clauses, plus a transfer-risk assessment and supplementary measures where needed. Provider locations and safeguards are production checklist items; this policy does not invent safeguards that the repository cannot prove.
Special-category and criminal-offence information
The game does not ask users to state real-world political opinions, religion, health, sexual orientation or criminal history, and it must not infer those traits from gameplay. Users may nevertheless disclose sensitive information in free text, reports or support requests.
Users should avoid unnecessary real-world sensitive information. Access is limited to those who need the content for delivery, moderation or legal handling. Deliberate special-category inference or systematic criminal-offence processing requires a separately approved Article 9 or DPA 2018 condition before launch; unresolved cases are escalated for human legal review.
Retention and account closure
Active profile and content data is kept while the account and relevant game content remain active. Sessions and one-time tokens have bounded validity; Discord terminal delivery and voice-advisor operational records have 90-day application rules. Detailed categories, implemented jobs and unresolved purge-job work are recorded in the internal retention schedule.
Financial, checkout-consent, tax, refund and accounting records; safety/moderation evidence; complaint records; fraud/security records; legal-claim evidence; and backups may remain after closure for their applicable statutory or documented limitation/operational period. Provider retention is controlled separately and must be verified in production settings.
Closure revokes sessions and removes local email/name, exact DOB and age band, Discord identity and pending link state, two-factor secrets/recovery state, outstanding token use, and recent IP/location/last-seen fields. Retained content and records remain linked to a persistent internal account ID, so the result is described as closed and de-identified, not anonymously erased. Closure does not erase records independently controlled by Link/Stripe, Discord or another provider.
Your rights
Depending on the processing, you may have rights of access, rectification, erasure, restriction, data portability, and objection. Where processing genuinely relies on consent, you may withdraw it without affecting earlier lawful processing. Rights can have exceptions, including security, other people's rights, legal claims and records that must be kept.
The JSON download on Data Rights is a convenience export and may not include every item covered by a formal access request. Use Support and choose Formal data-rights request for access, rectification, erasure, restriction, objection, portability or processing questions.
To complain about our handling of personal data, choose Data-protection complaint. We record the acknowledgement, investigation updates and outcome. You also have the right to complain to the Information Commissioner's Office.
Automated decisions
Shadow Government does not make solely automated decisions producing legal or similarly significant effects about users. Automated age-band, entitlement, rate-limit, malware-scan and game-simulation rules support service operation, but moderation, complaints and legal-rights outcomes require human handling. A future qualifying decision or special-category inference needs a fresh assessment and notice before use.