Information you provide
Account registration stores a screen name, normalised email address, date of birth, accepted policy version and a password hash. Guest eligibility stores a session-linked player record. We do not request payment data because no purchases or withdrawals exist.
Activity and preferences
We record fictional-credit changes, resulting balances, original game rounds, bonus decisions and saved game collection progress by game and play level. We also save discoveries, selected lantern light, reminder preference and account-break end time. Optional challenge participation displays only the chosen screen name and saved discovery count after a deliberate opt-in. Do not place personal information in a public screen name.
Support and recovery
A support request contains its topic, reply email, message, reference and submission time. Password recovery uses a short-lived token digest and sends a recovery message through the configured transport. Raw recovery links must be treated as secrets. Never share a link or include it in a support message.
Purpose and access
Information is used to operate requested accounts and preferences, protect the service, reconcile fictional-credit activity, respond to requests and enforce eligibility or selected breaks. Access is limited to people and systems that need it for those purposes. Information is not presented as a commodity for sale.
Cookies and optional services
An essential first-party session links a browser to its account or guest state. It is HttpOnly and SameSite=Lax, with Secure enabled when an HTTPS deployment is configured. No analytics, advertising or third-party sign-in service is active in the current product configuration. The Cookie Notice lists actual storage.
Retention and choices
Sessions expire after 30 days and reset tokens after one hour. Account and associated activity records remain while the account is needed to operate the service and resolve security or support issues. Support requests are retained while being handled and subject to periodic review. Request access, correction, export, deletion or an explanation of retention through the Support page.
Security and limitations
Passwords are hashed rather than stored as readable text. State-changing forms are protected against cross-site requests, and sensitive actions are rate-limited. No system can guarantee absolute security. Tell the help desk promptly about suspected account access without transmitting passwords or identity documents.
Your UK privacy rights
Depending on the circumstances, UK data-protection law may give you rights to access, correct, erase or restrict information, object to some processing, receive portable data or withdraw consent for optional processing. You may raise concerns with the Information Commissioner's Office at ico.org.uk. Contact the help desk to exercise a request; avoid sending unnecessary identification.
Updates and contact
This notice takes effect on 5 November 2026. Material changes will be reflected in the published version. The product contact is hello@phattony.com.
Questions? Save a support request or use hello@phattony.com.