Privacy notice

1. Who we are

This notice covers corvathane.com, run by Corvathane. For data protection purposes we are the controller of the personal data described here. You can reach us about privacy at privacy@corvathane.com or through the form on Reach us.

2. What we collect

• Messages you send. Through the contact form: your name, email address, chosen topic and message, with the time it arrived. By email: whatever you include.
• Server logs. Like every website, our hosting records technical details of each request: IP address, time, page requested, browser type and response code. These logs are used to keep the site secure and working.
• Abuse protection. To stop the contact form being flooded, we keep a one-way keyed hash of the sender's IP address for one hour. It cannot be turned back into the address.

We do not collect your game play, sparks, Codex, settings or self-check answers. We use no analytics, no advertising, no social media plug-ins and no third-party fonts or scripts.

3. What stays in your browser

Your age answer, storage choice, pauses, sparks, Codex and settings are saved in your browser's local or session storage, never on our servers. The cookies and storage notice lists each item. You can delete them at any time from the Codex or your browser settings.

4. Why we use data, and on what basis

• Answering your message: our legitimate interest in replying to people who contact us, or taking steps at your request.
• Server logs and abuse protection: our legitimate interest in keeping the site secure and available.
• Responding to legal requests: our legal obligations.

We never sell personal data, use it for advertising or make automated decisions about you.

5. How long we keep it

Contact messages are kept for up to 12 months after our last reply and then deleted, unless we need them longer to deal with a complaint or a legal claim. Server logs are kept for no more than 30 days. The abuse-protection hash expires after one hour.

6. Who sees it

Only the people who answer messages for Corvathane, and our hosting provider, which stores the site and its logs on our behalf under a data processing agreement. We share data with authorities only where the law requires it.

7. Where it is kept

The site and its data are hosted on servers in the United Kingdom or the European Economic Area. If data ever needs to move to another country, we will make sure it is protected by safeguards recognised under UK data protection law, such as the International Data Transfer Agreement.

8. Your rights

Under the UK GDPR and the Data Protection Act 2018 you can ask to see the personal data we hold about you, to have it corrected or deleted, to restrict or object to our use of it, and to receive a copy in a portable format. Write to privacy@corvathane.com. We reply within one month. There is no charge.

9. Children

Corvathane is for adults. We do not knowingly collect data from anyone under 18. If you believe a child has sent us personal data, tell us and we will delete it.

10. Security

The site is served only over HTTPS, uses strict security headers and a content security policy that blocks third-party scripts, and stores contact messages in files that cannot be opened over the web. No method is perfect, but we keep the amount of data small so there is little to protect.

11. Changes and complaints

We will update this notice if our practices change and show the new date at the top. If you are unhappy with how we have handled your data, please tell us first. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.