Privacy policy

The website and the game are run by [Publisher name], [Registered address], [Country] ("we", "us"). We are the controller of the personal data described here.

For anything about privacy, email [email protected]. For everything else, [email protected].

Our representative in the EU and the UK, where the law asks for one: [EU / UK representative, if needed].

The website is a plain information site. It does not use cookies, local storage or similar tracking, it has no user accounts, no newsletter sign-up and no forms. The data it does touch is listed below.

Analytics is switched off right now. If we switch it on, we will use privacy-friendly, cookieless analytics from [Analytics provider: Plausible Analytics (EU) or self-hosted] that works as described here, and we will update this page.

What it records, only as totals across all visitors:

• pages viewed and the site that sent you here (the referrer)
• browser, operating system and device type (desktop, tablet or phone)
• country, worked out from your IP address. The IP address itself is not stored.

To count unique visitors without cookies, the analytics tool makes a daily changing hash of your IP address and browser details. The hash is thrown away after 24 hours, so we cannot recognise you on later days or link visits to you. See the provider's data policy (opens in a new tab) for details.

Why: to understand which pages are useful and fix what is not. Our legal basis is our legitimate interest in running a good website (GDPR Article 6(1)(f)). The result is anonymous statistics.

Like almost every web server, ours writes a short line for each request. Each line holds:

• your IP address
• your browser user agent (browser and system name and version)
• the date and time of the request
• the address (URL) you asked for, and the response status

Why: to keep the site secure and running, for example to spot attacks, abuse and errors. Our legal basis is our legitimate interest in security (GDPR Article 6(1)(f)). We keep these logs for 14 days and then delete them, unless we need a specific log for longer to deal with an attack. The server is run by [Hosting provider, server country], which stores the logs on our behalf.

If the site shows a video from YouTube, it does not load anything from YouTube until you click play. We use YouTube's privacy-enhanced mode (youtube-nocookie.com). Once you click, the video loads from YouTube and Google's privacy policy (opens in a new tab) applies to what they collect.

The Steam buttons take you to the Steam store, run by Valve Corporation. We do not send them any data about you (your browser only tells them which site you came from), but once you are on Steam, Valve's privacy policy (opens in a new tab) applies. The same goes for any other site we link to, such as our social media pages.

If you email us, we get your email address, your name if you give it, and whatever you write. We use it only to answer you and to keep a record of the conversation.

Our legal basis is our legitimate interest in answering messages (GDPR Article 6(1)(f)), or taking steps you asked for (Article 6(1)(b)). We keep emails up to 2 years after our last message, unless the law asks us to keep it longer. Our email provider stores them on our behalf.

Crisp Bills is sold on Steam. Buying the game, your Steam account, achievements, cloud saves and friend lists are all handled by Valve under the Steam Subscriber Agreement (opens in a new tab) and the Steam privacy policy (opens in a new tab). We do not see your payment details.

• No personal data beyond Steam. The game uses only what Steam gives it to work, such as your Steam ID and display name for co-op and achievements. We do not run our own accounts or servers that store it.
• Your saves are yours. Save files are stored on your computer, and in Steam Cloud if you have it turned on.
• Co-op. When you play together, the players in your session can see your Steam display name. The connection runs through Steam.
• No crash reports or analytics in the game today. If we ever add them, they will be opt-in, we will say so in the game, and we will update this policy first.

We do not sell or rent your personal data, and we do not use it for advertising. We only share it with the services that help us run the site (our hosting provider, analytics provider and email provider), who may use it only on our instructions, or when the law requires it.

Some of these providers may process data outside your country. Where data leaves the EU or UK, we rely on an adequacy decision or the standard contractual clauses to protect it.

If you are in the EU, the EEA or the UK, you have the right to:

• get a copy of the personal data we hold about you
• have wrong data corrected
• have your data deleted
• restrict or object to how we use it, including use based on our legitimate interests
• receive your data in a portable format, where that applies
• complain to a data protection authority: in the EU, the authority in your country (opens in a new tab); in the UK, the ICO (opens in a new tab)

To use any of these rights, email [email protected]. We will answer within one month. Note that for most website visitors we hold nothing that can be linked to you: analytics data is anonymous and server logs are deleted after 14 days.

We do not sell or share your personal information as those words are defined in the California Consumer Privacy Act (CCPA), and we do not use it for cross-context behavioural advertising. The categories we collect are the ones listed above: internet activity (server logs and anonymous analytics) and identifiers (IP address in logs, email address if you write to us).

You can ask to know what we hold about you, ask us to correct or delete it, and you will not be treated differently for doing so. Email [email protected].

The website and the game are not aimed at children under 13, or under 16 in the EU and UK. We do not knowingly collect personal data from them. If you think a child has sent us personal data, email [email protected] and we will delete it.

The site is served over HTTPS and only the people who run it can read the logs. No system is perfectly secure, but collecting very little in the first place is the best protection we know.

If we change how we handle data, we will update this page and the "Last updated" date at the top. For big changes, such as adding analytics to the game, we will also say so in the patch notes on our changelog.

[Publisher name], [Registered address], [Country]. Privacy questions: [email protected]. Everything else: [email protected].