What we collect, and what we do with it.

1. Who this covers

This policy covers sharedspecies.com and play.sharedspecies.com, run by SharedSpecies, a business based in Ohio, United States ("we" or "us"), reachable at support@sharedspecies.com. It explains what personal data we collect, why, who sees it, how long we keep it, and what you can ask of us.

2. What we collect

• Account. Your username and a scrambled (hashed) version of your password. We cannot read the password. We do not ask for an email address, a real name, or a phone number. If you later choose to sign in with a third-party account such as Google, we receive the email address and name that provider shares, and we use the email to recognize your account.
• Purchases. What you bought, when, the price, and the payment reference Stripe gives us. Your card number, expiry, and billing details go to Stripe, never to us.
• What you make. The names, colors, and shapes of your species and houses, when you created them, and where they landed. All of this is public in the world.
• Activity. When you last visited, and which species pages you opened and what you saw there, so the site can show you what changed since. Kept with the account.
• Technical data. Your IP address, which our server holds in memory for a few minutes to limit abuse and does not write down; Cloudflare, which fronts the site, keeps its own traffic logs with IP addresses. A session cookie that keeps you signed in. Stripe records the IP address and browser of a payment on its side, and we use that record if a payment is disputed. We do not collect your browser type ourselves.

3. Why we use it

• To run the game: sign you in, take your order, create and show your species.
• To stop abuse: rate limits, bot detection, card-testing detection.
• To handle payments, refunds, and disputes, and to keep the records tax law requires.
• To fix bugs and understand how the site is used, in aggregate.

Where a legal basis is needed: we process account and purchase data to perform our contract with you, technical data for our legitimate interest in a working and safe service, and payment records to meet legal duties.

4. What is public

The world is shared. Every species and house you create, its name, its look, where it lives, how it does, and your username as its creator are visible to everyone who opens the map or the species page, and may appear in share images and in material about the game. Do not put anything in a name that you want kept private.

5. Who else sees data

• Stripe processes payments and receives your card, billing details, and the email address you give the checkout directly. See Stripe's privacy policy.
• Cloudflare serves the site and protects it, and sees traffic data such as IP addresses in doing so.
• OVHcloud hosts the game server, in a data center in the United States.
• Google, only if and when you choose to sign in with Google.

We do not sell personal data and we do not show ads. We share data only with the providers above, to run the service, or when the law requires it.

If you are in the European Economic Area, the United Kingdom, or Switzerland: your data is processed in the United States. We rely on the standard contractual clauses in our agreements with Stripe, Cloudflare, and OVHcloud, and on the transfer being necessary to provide the service you asked for. Write to us for a copy of the safeguards.

6. Cookies

One cookie, ss_session, keeps you signed in. It is set only after you sign in, it is not readable by scripts, and it expires on its own. We set no tracking or advertising cookies. Your browser may also keep small local settings for the map, which never leave your device.

7. How long we keep it

• Account data: while the account exists. When you ask us to close it, we replace your username with an anonymous one everywhere it appears within 30 days; the purchase records stay for the period below, without the username.
• Purchase records: as long as tax and payment rules require, usually seven years.
• IP addresses: minutes, in memory, on our server; Cloudflare's traffic logs follow Cloudflare's own retention.
• Species and houses: they are part of the world's history and stay in it. Closing an account removes your username from them.

8. Your choices and rights

You can ask us to show you the data we hold about you, to correct it, or to delete your account. Depending on where you live you may have further rights, such as to object to processing, to restrict it, to receive a copy of your data in a portable form, or to complain to a data protection authority. Write to support@sharedspecies.com with your username and, for an account that bought something, the receipt number from Stripe's email; we may ask you to prove the account is yours before we change or disclose anything, and we answer within 30 days.

9. Children

The site is not for children under 13, and we do not knowingly collect their data. If you believe a child under 13 has an account, tell us and we will delete it.

10. Security, changes, and contact

Passwords are stored hashed, traffic is encrypted, and the server is backed up nightly. No system is perfect; if a breach affects you, we will tell you.

We may update this policy. The date and version at the top change when we do, and material changes are announced on the site.

Questions: support@sharedspecies.com.