Privacy Policy

What data we collect, why we collect it, how long we keep it, and how to have it removed.

Last updated 30 July 2026

⚠️ TEMPLATE — NOT LEGAL ADVICE. This document is a structural starting point, filled in with your actual details, written to cover the data flows this site and these games actually have. It has not been reviewed by a lawyer. Have a qualified solicitor review it against GDPR, UK GDPR, CCPA/CPRA and any other regime that applies to you before you rely on it.

Who we are

RecursionSplash ("we", "us", "the studio") develops and operates the games and websites described in this policy. For data protection purposes, the data controller is:

Entity: RecursionSplash
Registered address: Sole operator — no registered business address at this time.
Contact: privacy@recursionsplashgames.com

Scope

This policy covers:

recursionsplashgames.com — this website.
Community Button — our game distributed on Steam.
Pixel Flip — our game distributed on Steam.

It does not cover Steam itself. Valve collects and processes data under its own privacy policy, which you should read separately.

What we collect on this website

We run first-party analytics only. There is no Google Analytics, no advertising network, no social pixel, and no third-party tracker on this site.

For each page view we record:

Data	Why	Retention
Page path	To know which pages get read	13 months
Referring domain	To know where readers come from	13 months
Country (derived from IP, IP discarded)	Regional interest	13 months
Device class (mobile / tablet / desktop)	Layout priorities	13 months
Browser language	Localisation priorities	13 months
A daily-rotating, salted, one-way visitor hash	To count people rather than page loads	24 hours

We do not set analytics cookies. The visitor hash is generated server-side from a salt that rotates every 24 hours and is never stored in reversible form. It cannot be used to identify you or to link your activity across days.

We also record outbound clicks on links to Steam and our social profiles, so we know which links people actually use. That record contains only the destination host and path.

What we collect in our games

The exact set differs per title. Broadly:

Steam account identifier (SteamID). Required to save your progress, place you on leaderboards and honour purchases.
Gameplay and progression data. Levels, currencies, items, achievements, statistics and, for Community Button, your contribution to the global counter.
Purchase records. For in-app purchases, we store a record of the transaction. We never see or store your payment card details — those are handled entirely by Valve.
Diagnostic data. Crash reports, error logs and performance samples, used to fix faults.

Community Button additionally processes an approximate country, resolved via Steam's own IP-to-country lookup (a standard Steamworks facility — we do not independently inspect or store your raw IP address), for two distinct purposes:

The live world heatmap. Click totals are aggregated by country and day. This aggregate has no link to your account or SteamID and cannot be traced back to an individual player.
Regional store and entitlement checks (for example, region-specific DLC availability). For this purpose only, the resolved country is stored against your account.

What we never do

We do not sell your personal data. Ever, to anyone, under any structure.
We do not share it with advertisers or data brokers.
We do not build advertising profiles.
We do not track you across other websites.

Legal bases (UK/EU)

Purpose	Lawful basis
Running your game account and saving progress	Performance of a contract
Purchase records and refunds	Legal obligation / contract
Anti-cheat and abuse prevention	Legitimate interests
Aggregate, non-identifying site analytics	Legitimate interests
Diagnostic crash reporting	Legitimate interests

We share data only with processors that are necessary to run the service:

Valve Corporation (Steam) — account identity, achievements, cloud saves, purchases.
Supabase — database and backend infrastructure for game and account data.
Cloudflare, Inc. — email routing for support and contact correspondence.

Each operates under its own standard terms of service as a service provider to us; we have not negotiated bespoke data processing agreements beyond those standard terms.

International transfers

Our infrastructure — the game backend and this website — is hosted in the United States. If you are located in the UK or European Economic Area, your data is transferred to and processed in the US as a result. A qualified solicitor should confirm the appropriate transfer mechanism (such as the UK Extension to the EU-US Data Privacy Framework, or Standard Contractual Clauses) before this policy is relied on for UK/EEA users at scale.

Retention

Account and progression data: kept while your account is active, and for 24 months after it becomes inactive.
Purchase records: kept for 7 years, as required for tax and accounting.
Diagnostic logs: 30 days.
Website analytics: as listed in the table above.

Your rights

If you are in the UK or EEA, you have the right to access, rectify, erase, restrict, port and object to processing of your personal data. Similar rights apply under CCPA/CPRA in California and comparable laws elsewhere.

To exercise any of them, email privacy@recursionsplashgames.com with your SteamID. We will respond within one month.

You may also complain to your supervisory authority. In the UK that is the Information Commissioner's Office (ico.org.uk).