Политика конфиденциальности

Last updated: 5 September 2026 · Version: 2 · Applies to: elkgameverse.com, the ELK GameVerse web app, and the ELK GameVerse mobile applications.

1. The short version

We collect what running the platform actually requires, and today your data goes to our hosting provider and nowhere else. There is no analytics script on this site. There is no advertising network. No third party receives a profile of you, because no profile of you is built.

That will not stay true forever — this is a games platform, and it will one day measure retention and show rewarded advertising. When that changes, this document changes first, and section 6 lists every recipient by name on the day they receive anything.

2. Who is responsible for your data

ELK GameVerse is operated by ELK Consulting Ltd, which is the controller of the personal data described here. The registered company details, address and publication director are set out on our Legal notice page, and that page is the authoritative record of who we are.

Write to us about anything in this document at contact@elkgameverse.com.

We have not appointed a Data Protection Officer. Article 37 of the GDPR requires one only in defined circumstances, and whether we fall into them is one of the questions still with our lawyer. If we appoint one, their contact details appear here and in the Legal notice.

3. What we collect, and why

To give you an account

Your email address; your password, stored only as an Argon2id hash we cannot reverse; your display name; the handle the platform assigns you; your chosen language, timezone and settings. If you sign in with Google or Apple we receive an identifier from them and your email address — never your password.

You can also play as a guest, which creates an account tied to a device identifier and no email at all. A guest account collects less about you than any other kind, and you can upgrade it later without losing progress.

To let you play

Which games you opened, when, and on what kind of device; the sessions you finished; the moves you made in them; your scores, levels and progression.

The moves deserve an explanation, because most platforms do not collect them. Every finished game is replayed on our servers from the moves you sent, and the score we record is the one that replay produces — never the one your device claimed. That is what makes a leaderboard worth appearing on, and it means your inputs are gameplay data we genuinely need rather than telemetry we happen to keep.

To keep your wallet honest

Every movement of in-game currency, with the balance before and after it, the reason, and a transaction identifier. This is a ledger rather than a number in a field, because a balance nobody can audit is a balance nobody should trust — including you, when you want to know where a reward went.

To keep the platform working and honest

Technical logs: IP address, device type, browser, request path and timing, and error traces. Anti-fraud signals: how fast a session was completed, whether a replay diverged from what was claimed, how many accounts a device has created.

If you buy something

A record of the purchase and the receipt the app store gave us, so we can verify it server-side and restore your entitlement on a new device. We never see your card number. The store takes the payment and tells us only whether it succeeded.

If you contact support

Your message, your account reference, and whatever you choose to include in it.

4. What we do not do

• We do not sell your personal data, and we have never disclosed it for money or

anything of value.

• We do not build advertising profiles of you.
• We do not read your messages — the platform has no chat, no direct messages

and no free-text field visible to another player.

• We do not offer a player search. You are found by a handle you chose to give

someone, which makes being findable an act by the person being found.

• We do not ask children for more than we ask anyone else.

5. Why we are allowed to hold it

| What | Lawful basis (GDPR Article 6) | | --- | --- | | Account, profile, settings, progress | Performance of a contract — Article 6(1)(b) | | Gameplay moves and server-side replay | Performance of a contract, and our legitimate interest in results that are true — 6(1)(b), 6(1)(f) | | Wallet ledger | Performance of a contract — 6(1)(b) | | Technical logs, anti-fraud, anti-cheat | Legitimate interests: a platform that works and is not defrauded — 6(1)(f) | | Purchase and tax records | Legal obligation — 6(1)(c) | | Optional emails, personalised advertising, analytics beyond what the service needs | Consent — 6(1)(a), withdrawable at any time |

Where we rely on legitimate interests we have weighed them against your rights, and you may object at any time (section 9).

6. Who else sees it

Today, one recipient.

| Recipient | What they process | Where | Why | | --- | --- | --- | --- | | Railway Corporation | Everything, as our hosting and database provider | United States | The servers and database the platform runs on |

That is the whole list. There is no analytics provider, no advertising network, no email provider, no AI provider receiving your data, because none of them is switched on. You can verify part of this yourself: load any page on this site with your browser's network panel open and count the third-party requests.

What is planned, and not yet active. Google Play Billing and Apple In-App Purchase for verifying receipts; an email provider for account recovery; Google Analytics or Firebase for product measurement; an advertising network for rewarded video. Each becomes a row in the table above, with a link to their own notice, before it processes anything of yours — and where the law requires consent, behind a consent request you can refuse without losing the game.

7. Where your data goes

Our hosting provider operates in the United States, so your data is transferred outside the United Kingdom and the European Economic Area. That transfer relies on the Standard Contractual Clauses adopted by the European Commission, together with the UK International Data Transfer Addendum, and on the technical measures in section 10 — in particular that data is encrypted in transit and at rest.

You may ask us for a copy of the relevant safeguards at contact@elkgameverse.com.

8. How long we keep it

| Data | Kept for | | --- | --- | | Account, profile, progress, wallet | While the account exists | | Anything after account deletion | Erased within 30 days, except the rows below | | Purchase and tax records | 6 years after the transaction, or as long as tax law requires | | Technical logs | 90 days | | Anti-fraud signals on a closed case | 12 months | | Anti-fraud signals on an open case, or an account we banned | Until the case closes, then 12 months | | Support conversations | 24 months | | In-app notifications | 90 days | | Backups | Up to 35 days, then overwritten |

Deleting your account removes your profile, progress and personal data. The exceptions above are the honest ones: we keep a purchase record because tax law tells us to, and we keep a ban on file because a ban you can clear by making a new account is not a ban.

9. Your rights

Under the UK GDPR and the EU GDPR you may:

• Ask what we hold and get a copy of it (Article 15). The account page has a

one-click export.

• Correct it if it is wrong (Article 16).
• Have it erased (Article 17). The account page will delete your account.
• Restrict how we use it while a dispute is resolved (Article 18).
• Take it elsewhere in a machine-readable form (Article 20).
• Object to processing based on legitimate interests, including profiling

(Article 21).

• Withdraw consent at any time, for anything we asked consent for, without

affecting what was lawful before (Article 7(3)).

We answer within one month. We do not charge for this, and we will not make your account worse because you asked.

If you think we have handled your data badly, tell us first — contact@elkgameverse.com — and if we do not put it right you may complain to a supervisory authority. In the UK that is the Information Commissioner's Office (ico.org.uk). In the EU it is the authority where you live, work, or where the problem happened.

10. Automated decisions, and where a human comes in

This matters more here than on most platforms, so it gets its own section.

We reject scores automatically. Every finished game is replayed on our servers; when the replay does not produce the score the device claimed, the result is refused and recorded. That is an automated decision about you, and it is one we consider necessary to the contract between us — a leaderboard that accepts unverified scores is not a leaderboard.

We score accounts for fraud automatically. Speed, repetition, device reuse and divergence between claimed and replayed results all feed a suspicion score. A high score can restrict an account.

Where an automated decision has a significant effect on you — a ban, a withheld reward, a refused purchase — you may ask for a human to look at it, explain your side, and contest the outcome. Write to support@elkgameverse.com with your account handle and what happened. This is your right under Article 22(3), and it is not a formality: a false positive in an anti-cheat system is a real player being punished for playing well.

11. Children

The platform is not directed at children under 13, and we do not knowingly collect personal data from them. Where an individual game is rated for a younger audience, the age given in the store listing governs it, and that rating is a legal statement rather than a label.

Where a child under the age of consent in their country — 13 to 16 depending on where you are, under Article 8 of the GDPR — has given us data, a parent or guardian may write to contact@elkgameverse.com and we will delete the account and its data. We will not ask them to prove it beyond what is necessary to be sure they are entitled to ask.

For children we know to be under 13, we do not serve personalised advertising, we do not use behavioural analytics, and consent for anything optional must come from a parent.

12. Security

Passwords are hashed with Argon2id and never stored or logged in any recoverable form. Sessions live in sealed, http-only cookies that page JavaScript cannot read. Traffic is encrypted with TLS, and data is encrypted at rest by our hosting provider. Access to production data is restricted by role and every administrative action is written to an audit log. Backups run daily and are retained for 35 days.

If you find a vulnerability, write to contact@elkgameverse.com. We will not pursue you for telling us.

If a breach happens that is likely to risk your rights, we will notify the supervisory authority within 72 hours and tell you directly where the risk is high.

13. If you are in California

We do not sell your personal information and we do not share it for cross-context behavioural advertising, as those terms are defined by the CCPA as amended by the CPRA. You have the right to know what we collect, to delete it, to correct it, and not to be discriminated against for exercising those rights. The mechanisms in section 9 serve these rights too; write to contact@elkgameverse.com.

14. Changes

When this document changes we update the version and date at the top. For a change that affects what we do with your data — a new recipient, a new purpose, a new retention period — we tell you before it takes effect, in the app and by email where we have one, and we keep the previous version available so you can see what changed.

15. Language

This document is written in English and translated. If a translation and the English text disagree, the English text is the one that governs.