Privacy Policy

1. Who the data controller is

The controller is the team making the game Osiedlowy. Full identification and contact details are in the site footer.

2. What changed in this version

Version 1 described the newsletter and nothing else. The site now also has Steam sign-in, a playtest portal and a bug report board, and we check whether a signed-in account owns our game. This version says so plainly. It also corrects four statements from version 1 that had stopped being true: about cookies, about IP addresses, about transfers outside the EEA, and about automated decisions.

3. What we collect

3.1 When you subscribe to the newsletter

Data	Why
email address	to tell you about the playtest and the release
normalised form of the address	so one person cannot take several places on the list
site language	to write to you in Polish or English
hashed IP address	to limit abuse of the form
subscription and confirmation dates	to demonstrate that consent was given
version number and checksum of this document	to know which text you agreed to

3.2 When you sign in through Steam

Signing in happens on Steam's side — we never see your password and we have no access to your Steam account. After you sign in, Valve passes us the following, and we store it:

Data	Why
Steam account identifier (SteamID64)	to recognise you next time you sign in
profile name (persona)	so we know who we are talking to in the panel and on reports
avatar URL	to show your avatar in the panel
Steam account creation date	to limit handing keys to accounts created to game the system
whether the account is limited	as above

Steam does not give us your email address. If you want to take part in the playtest you provide one separately — without it we have no way to tell you a key is waiting.

3.3 Whether you own our game

For every account linked to Steam we regularly ask Valve whether it has the playtest and whether it has the full game in its library. We store the answer (yes / no / no answer) and the date of the check.

Two reasons: to know whether an issued key was actually redeemed, and to admit only people who have access to the game onto the report board. The check covers our two applications only — we cannot see the rest of your Steam library, your friends list, your playtime or your purchase history.

3.4 When you apply for the playtest

Your form answers (including information about your hardware), consent markers, a hashed IP address, your browser name and version, the page you arrived from, and any campaign parameters in the link (utm). Plus the status of the application and the date of the decision.

3.5 When you file a bug report

The title and body of the report, any screenshots you attach, an optional run identifier and whatever technical details you add yourself, a hashed IP address, and your votes on other people's reports. A screenshot can contain personal data — your player name, a friends list, desktop notifications. Have a look at the image before you send it.

3.6 Game keys

The number and status of the key issued to you, when it was assigned, when you first revealed it, and when it was activated. Keys are stored encrypted.

3.7 Technical data needed to run the site

• Session. To keep you signed in we store a session identifier and, with it, your IP address and browser name in readable form. The session record expires automatically.
• Administrative audit log. We record significant actions in the panel (approving an application, issuing a key, activation) together with the account identifier and the Steam identifier.
• Server logs. Standard application error logs.

Apart from the session record, the server logs and the data in 3.4, we do not store IP addresses in readable form — they go into the database as an irreversible cryptographic hash.

4. Cookies

The site uses only cookies strictly necessary for it to work:

Cookie	Why
session cookie	keeping you signed in and carrying data between form steps
CSRF token	protecting forms against abuse from another site

We use no analytics, marketing or tracking cookies, we embed no third-party analytics and we do not profile visitors. That is why we do not ask for cookie consent — cookies strictly necessary to provide the service you asked for do not require it.

The Baloo 2 font is served from our own server, not from an external CDN. Opening the site does not send your IP address to any third party.

5. Legal basis

What	Basis
newsletter	Art. 6(1)(a) GDPR — your consent, confirmed by clicking the link
account, application, key, reports	Art. 6(1)(b) GDPR — steps necessary to give you access to the playtest, that is, to perform the arrangement you asked for
ownership checks, audit log, abuse limits	Art. 6(1)(f) GDPR — our legitimate interest in keys reaching real testers and the report board admitting only those entitled to it

Newsletter consent is entirely voluntary; withholding it limits neither your use of the site nor your participation in the playtest. Where we rely on Art. 6(1)(f) you have the right to object — see section 9.

6. How long we keep it

• Unconfirmed newsletter addresses are deleted 30 days after subscription.
• Confirmed addresses are kept until you unsubscribe.
• After unsubscribing we keep the fact and date of it for 12 months — to prove the request was carried out, and to avoid writing to you again.
• Account data is kept until you delete it. You can do that yourself at any time: panel → "Your account and data".
• Applications, reports and attachments are deleted along with the account.
• The record of an issued key survives account deletion, but with no link to you — only the fact that a key was issued and activated. Without it there would be no way to account for the key pool Valve entrusted to us.
• The administrative audit log is kept for 24 months.

7. Who we share it with

• Valve Corporation — the operator of Steam. We query Valve for your profile and for ownership of our applications, sending your Steam identifier in the process. See section 8.
• our hosting provider,
• our outgoing mail provider.

The hosting and mail providers act on our instructions under a data processing agreement. We do not sell or share data for marketing purposes.

8. Transfers outside the EEA

Yes, we transfer data outside the European Economic Area — specifically to Valve Corporation, based in the United States. This concerns your Steam identifier, sent when you sign in, when we fetch your profile, and during the periodic check of whether you own our game.

This is necessary to offer Steam sign-in and a Steam playtest at all. Valve also processes this data as a controller in its own right, under its own privacy policy. Transfers to Valve are governed by our distribution agreement with Valve.

(To be completed before publication: the transfer mechanism — adequacy decision or standard contractual clauses — after verifying Valve's current status.)

9. Your rights

You have the right to:

• access your data and receive a copy of it,
• rectification of inaccurate data,
• erasure ("the right to be forgotten"),
• restriction of processing,
• portability of your data,
• object to processing based on legitimate interest,
• withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal,
• lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland) if you believe we process data unlawfully.

How to exercise them:

• Newsletter — click "unsubscribe" in any message from us. The link never expires and needs no sign-in.
• Your account and everything attached to it — panel → "Your account and data" → delete account. Deletion is immediate and irreversible.
• A copy of your data — panel → "Your account and data" → download a copy.
• Anything else — write to the contact address in the footer. We answer within 30 days.

⚠️ Deleting your account does not unsubscribe you from the newsletter, and vice versa — they are two separate things resting on two different legal bases. To disappear completely, do both.

10. Automated decisions

Playtest applications may be approved automatically, based on the age of the Steam account and whether it is a limited account.

The automation never rejects an application. It can only approve one outright or route it to a human for review — in every case a refusal is made by a person, not by a program. It therefore produces no legal or similarly significant effect on you within the meaning of Art. 22 GDPR. Regardless, you can always ask for human review by writing to the address in the footer.

We do not profile you for any other purpose.

11. Changes to this policy

Every version of this document carries a number and an effective date, shown at the top of the page. We record which version you consented to. We will announce significant changes by email.