Privacy Policy
What data we collect, why we collect it, how long we keep it, and how to have it removed.
Last updated
RecursionSplash is an independent game studio operated by a sole proprietor based in Canada. This policy explains exactly what we collect, why, how long we keep it, and how to get it removed.
We are reachable at privacy@recursionsplashgames.com for anything in this document.
Scope
This policy covers:
- recursionsplashgames.com — this website.
- Community Button — our game on Steam.
- Pixel Flip — our game on Steam.
It does not cover Steam itself. Valve Corporation collects and processes data under its own privacy policy, which applies whenever you use Steam and which you should read separately.
This website
We run first-party analytics only. There is no Google Analytics, no advertising network, no social pixel, and no third-party tracker anywhere on this site.
For each page view we record:
| Data | Why |
|---|---|
| Page path | To know which pages get read |
| Referring domain | To know where readers come from |
| Country (derived from IP, IP discarded) | Regional interest |
| Device class (mobile / tablet / desktop) | Layout priorities |
| Browser language | Localisation priorities |
| A daily-rotating, one-way visitor hash | To count people rather than page loads |
None of this identifies you, and we keep it as a long-term record of how the site is used so we can compare one year against another.
We do not set analytics cookies. Nothing is written to your browser. The visitor hash is generated on our server by a keyed one-way hash whose input changes every 24 hours. It is never stored in reversible form, it cannot be used to identify you, and because the input rotates daily it cannot link your activity from one day to the next.
Your IP address is never stored. It is used momentarily to derive the country and the visitor hash, then discarded.
We also record clicks on links leaving the site — to Steam, our social profiles, our own contact email addresses, and downloads of our art and logo files — so we know which links people actually use. That record contains only the destination and the page it was clicked from.
Community Button
Community Button has an online backend that we operate. When you play it, we store the following against your account:
- Your SteamID and Steam display name. Required to save your progress and to show you on leaderboards.
- Gameplay and progression data. Clicks, level, experience, coins, pets, items, achievements, daily challenge progress and your contribution to the global counter.
- Purchase records. When you buy a supporter pack or other DLC, our server records that you own it so it can unlock the right content. We never see or store your payment details — card numbers, billing addresses and the payment itself are handled entirely by Valve, and never reach us.
Approximate country. Community Button resolves an approximate country from Steam's own IP-to-country lookup, a standard Steamworks facility. We do not inspect or store your raw IP address. This country code is used briefly to attribute your clicks to a region on the live world heatmap, and is not retained against your account afterwards. The heatmap itself holds only aggregate totals by country and day, with no link to any individual player.
If we later add an option for you to set your country yourself, that choice would be saved with your account, and we will update this policy before that ships.
Pixel Flip
Pixel Flip does not send anything to any server we operate. Your saves, leaderboard scores and achievements are handled entirely by Steam under Valve's own privacy policy. We receive no personal data from Pixel Flip.
What we do not collect
- We use no third-party analytics or crash-reporting SDKs in either game. There is no Unity Analytics, no Sentry, no advertising SDK.
- We do not collect your name, email address, postal address or phone number through our games. We only ever see the Steam identity Valve exposes to us.
- We do not sell your personal data. Ever, to anyone, under any arrangement.
- We do not share it with advertisers or data brokers.
- We do not build advertising profiles or track you across other websites.
Our servers keep ordinary technical logs, which may incidentally include error information, for a short period to keep the service running and to diagnose faults.
Why we are allowed to process it
For players in the UK and European Economic Area, our lawful bases under the GDPR are:
| Purpose | Lawful basis |
|---|---|
| Running your game account and saving progress | Performance of a contract |
| Recording which DLC you own | Performance of a contract |
| Preventing cheating and abuse | Legitimate interests — protecting the integrity of shared leaderboards and the global counter for all players |
| Aggregate, non-identifying website analytics | Legitimate interests — understanding which pages are useful, using the least identifying method available to us |
For players in Canada, we rely on your consent, given by choosing to play an online game whose purpose plainly requires an account and a shared counter, consistent with PIPEDA.
Who else touches your data
We share data only with the service providers needed to run the service:
- Valve Corporation (Steam) — account identity, cloud saves, achievements, leaderboards and all payment processing. United States.
- Supabase — the database behind Community Button and this site's analytics. United States.
- Vercel — hosting for this website. Your IP address reaches Vercel as part of any ordinary web request. United States.
- Cloudflare — DNS and email routing for our contact addresses. United States.
Each acts as a service provider under its own standard terms. We have not negotiated bespoke data processing agreements beyond those standard terms.
Where your data goes
We operate from Canada, and the providers above are based in the United States, so your data is processed in Canada and the United States. If you are in the UK or EEA, that means your data leaves your region. We rely on the providers' own standard transfer protections for this.
How long we keep it
- Community Button account and progression data: for as long as your account exists. You can have it deleted at any time by asking us — see Your rights below.
- Purchase records: at least 6 years, to meet Canadian tax and accounting record-keeping requirements.
- Website analytics: kept indefinitely as a long-term record of how the site is used. This data does not identify you: no cookie is set, your IP address is never stored, and the visitor hash cannot be reversed or linked from one day to the next.
- Approximate country in Community Button: used at the moment of the click and not retained against your account.
Your rights
Wherever you live, you can ask us to:
- See what we hold about you
- Correct anything wrong
- Delete it
- Get a copy in a portable format
- Object to or restrict how we use it
Email privacy@recursionsplashgames.com with your SteamID and what you want done. We will respond within 30 days. There is no charge.
Deleting your Community Button data removes your progress, your place on the leaderboards and your record of purchases. Clicks you have already contributed to the global counter cannot be subtracted, because the counter holds only a total and has no link back to you.
If you are unhappy with how we have handled your request, you can complain to:
- Canada: the Office of the Privacy Commissioner of Canada (priv.gc.ca)
- UK: the Information Commissioner's Office (ico.org.uk)
- EEA: your national data protection authority
Children
Our games are not directed at children under 13, and we do not knowingly collect personal data from them. Steam requires its own minimum age to hold an account. If you believe a child has provided us data, email privacy@recursionsplashgames.com and we will delete it.
Security
Data is transmitted over TLS and stored on access-controlled infrastructure. We apply least-privilege access and keep the website's analytics database entirely separate from game data, so a problem with one cannot expose the other. No system is perfectly secure, but we do not pretend otherwise or collect more than we need.
Changes
If we change this policy we will update the date at the top of this page and, for anything significant, say so in the devlog.