Privacy policy
Each section below opens with a short summary. The summaries are provided for clarity only; the provisions that follow them are the operative terms.
Scope and controller
This policy covers the game and this website. We are the data controller.
This policy explains what personal data we collect when you use the A Universe Away mobile game (the “game”) and auniverseawaygame.com (the “website”), the purposes for which we process it, and the rights available to you. A Universe Away is an independent game, and we act as the data controller for the personal data described here. Questions and requests may be sent to auatraveler@gmail.com.
Personal data we collect
Account details from your sign-in provider, the progress you make in the game, and limited technical data.
We collect the following categories of personal data.
Account and identity data. When you sign in using Google or Apple, we receive and store the unique account identifier issued to us by that provider and, where the provider makes them available and you have permitted their release, your email address, display name and profile image address. We do not receive or store your password.
Game data. The progress you make in the game, including your callsign, ship, cargo, credits, fuel, position, lifetime records and in-game log.
Session data. A record of each sign-in session and its expiry, so that you remain signed in between uses. The session token itself is not retained; we hold only a cryptographic hash of it, from which the token cannot be reconstructed.
Technical data. When your device or browser connects to the service, we record technical information including the originating IP address, the time of the request and the resource requested.
Data we do not collect
No location, contacts, or advertising identifiers. We do not sell personal data.
The game does not request access to your location, contacts, photographs, microphone or camera. It contains no advertising software and no advertising identifier, and displays no advertising. It contains no third-party analytics.
We do not sell or rent personal data, and we do not disclose it to data brokers or advertisers. We do not use personal data for profiling, or for automated decision-making producing legal or similarly significant effects.
The game does not currently offer real-money purchases. This policy will be updated before any such functionality is introduced.
Legal bases for processing
Principally the performance of our contract with you: you asked us to provide the game.
Where the UK or EU General Data Protection Regulation applies, we rely on:
- Performance of a contract — for account, identity, session and game data, which are necessary to provide the service you requested by signing in.
- Legitimate interests — for technical data, in order to maintain the security and availability of the service, prevent abuse, and diagnose faults.
- Consent — for website analytics only. You may withdraw your consent at any time, with no effect on your use of the game or the website.
Information visible to other players
Your callsign and your in-game records. Never your name or email address.
The in-game leaderboard displays your callsign, your depth record and your lifetime earnings. No other information about you is made visible to other players. Your email address, display name, profile image and account identifier are never shown to another player.
Disclosure to third parties
Your sign-in provider, processors acting on our instructions, the analytics provider if you consented, and anyone the law compels.
We disclose personal data only as set out below.
- Sign-in providers. Google and Apple authenticate you at your request, and necessarily process the fact of that sign-in. Their processing is governed by their own privacy policies.
- Processors. We engage service providers who process personal data on our behalf, only on our instructions and under contract, for the purpose of operating the service.
- Analytics provider. Google Analytics, on the website only, and only where you have given consent.
- Legal disclosure. Where required by law or legal process, or where necessary to establish, exercise or defend legal claims.
Retention
For as long as your account exists. Deleting the account deletes the data with it.
Account, identity and game data are retained for as long as your account exists, and are erased without undue delay once you delete it.
Sign-in sessions expire automatically 60 days after they are created, and access tokens expire after one hour. The in-game log is subject to a fixed limit, and older entries are discarded automatically as newer ones are added. Technical data is retained for a short period and then deleted.
Your rights
Access, rectification, erasure, restriction, objection, portability, and complaint.
Subject to applicable law, you have the right to request access to the personal data we hold about you, to have inaccurate data corrected, to have your data erased, to restrict or object to its processing, and to receive it in a portable form.
Erasure is available to you directly and takes effect immediately: delete your account. This erases your identity, game data, standings and log, and cannot be reversed. For any other request, contact auatraveler@gmail.com; we will respond within 30 days.
If you are in the United Kingdom or the European Economic Area, you also have the right to lodge a complaint with your national supervisory authority.
Children
The game is not directed at children under 13.
The game is not directed at children under the age of 13, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, contact us and we will delete the account.
Changes to this policy
The effective date above changes with the policy, and material changes are notified in the game.
We will revise the effective date shown above when this policy changes. Where a change materially affects the personal data we collect or the parties to whom we disclose it, we will additionally notify you within the game.
Data we process
| Data | Source | Purpose |
|---|---|---|
| Account identifier | Google or Apple sign-in | Identifying your account between sign-ins |
| Email address | Your sign-in provider, where released | Account recovery and support |
| Display name and profile image | Your sign-in provider, where released | Shown to you within the game |
| Callsign | You | Shown to other players on the leaderboard |
| Game data (ship, cargo, credits, fuel, records) | Your use of the game | Providing the game |
| In-game log | Your use of the game | In-game history; limited and rotated |
| Session record (hashed token, expiry) | Signing in | Keeping you signed in for up to 60 days |
| Technical data (IP address, time, resource) | Your device or browser connecting | Security, availability and diagnostics |
| Analytics data (visits, pages) | The website, only with consent | Measuring visits |