Privacy notice

1. Who is responsible

The data controller is Cedarvaux Play Ltd, Unit 4, Mill Reach, Feeder Road, Bristol BS2 0SB, United Kingdom, registered in England and Wales, company no. 15837264. For anything in this notice, write to hello@cedarvaux.com with Privacy in the subject line.

2. The uncommon part: your play never leaves you

Your account record — profile details, balance, level, Resin, favourites, round history and seed pairs — is stored in your browser's local storage, on your device. It is not transmitted to us in the ordinary course of play. That is why progress is per-browser, why clearing site data erases it, and why we could not read your balance even if you asked us to.

3. What does reach us, and why

• Contact messages. Name, email address, topic and message text, kept so we can answer you and see the thread if you write again. Legal basis: our legitimate interest in running a support desk.
• Verification and reset emails. When you ask for a code or a reset link, the address passes through our mail sender with that single message. Legal basis: taking steps you request.
• Server logs. Standard, short-lived request logs (IP address, path, time) used for security and fault-finding. Legal basis: legitimate interest in keeping the site working and honest.
• Optional visit counting. Only if you accept the optional cookie, a first-party counter tallies page visits. It profiles nobody. Legal basis: consent, withdrawable any time via the cookie policy page.

4. What we never do

• No selling or renting of personal data — to anyone, for anything.
• No advertising profiles, no cross-site tracking, no third-party analytics scripts.
• No processing of payment details, because payments do not exist here.
• No marketing email unless you ticked the box, and every note carries an unsubscribe that works.

5. How long things are kept

• Contact messages: up to 24 months, then deleted.
• Server logs: rotated within 30 days.
• Marketing preference: until you change it or your account closes.
• Everything in your browser: entirely under your control, for as long as your browser keeps it.

6. Who else touches the data

Our hosting provider processes traffic on our instructions, and our mail relay carries the emails described above. Both act as processors under contract. No data is transferred outside the UK and EEA except with safeguards recognised by UK law.

7. Your rights

UK GDPR gives you the rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent where consent is the basis. Write to hello@cedarvaux.com and we answer within a month. You can also complain to the Information Commissioner's Office — though we would appreciate the chance to fix things first.

8. Children

The site is for adults (18+) and we do not knowingly hold data about anyone younger. If you believe a minor has registered, tell us and the account goes.

9. Changes

Material changes to this notice are flagged in the journal and dated at the top of this page. The current version always lives at this address.