DRAFT for review: replace [OPERATOR] and [CONTACT EMAIL], and have it reviewed, before Plant Life opens to the public.
Privacy Policy
Last updated: [DATE]
Plant Life is a social online game run by [OPERATOR] ("we"). This page explains what we collect when you play, why, who helps us run the game, how long we keep it, and the choices you have. Plant Life is for players aged 13 and older.
What we collect
| What | Why |
|---|---|
| Your email address and password | To create your account, verify it, let you sign in and reset your password. Passwords are stored only as a secure hash by our account provider; we never see them. |
| Your birthday | Only to check your age when you sign up. We don't keep the date: we keep only whether the account is an adult's or a teen's (13–17). |
| Your Plant: its name, look, coins, items, Treehouse and game progress | To save your game. Your Plant's name and look are shown to other players. |
| Chat | Chat is delivered to the players in the same room and isn't stored. If someone reports a player, the reported player's last few messages are saved with the report so we can review it. |
| Safety records | Reports, blocks, suspensions and a log of chat our filter masked or slowed down (the kind of event only, not the words). |
| Technical data: IP address, browser and device type, times of visits | To deliver the game, keep it secure, prevent abuse and fix problems. |
| Data in your browser | If you choose "Remember me", your browser keeps a sign-in token so you stay signed in. We don't use advertising or tracking cookies. |
What we don't do
We don't sell your personal information, show ads, or share your information for advertising. Real-money purchases aren't available.
Who helps us run Plant Life
These service providers process data for us, only to run the game:
- Supabase (accounts and game saves; data stored in the United States)
- DigitalOcean (the game and website servers, in New York, United States)
- Resend (sending account emails such as verification and password reset)
- Cloudflare (the website's domain name service)
We may also share information if the law requires it, or to protect players' safety.
How long we keep it
- Your account and Plant: until you ask us to delete them.
- Server access logs (which include IP addresses): 14 days.
- Safety log: 90 days. Reports: until reviewed, then 180 days. Suspension records: 2 years after they end.
Your choices and rights
You can ask us for a copy of your information, to correct it, or to delete your account and its data, by writing to [CONTACT EMAIL] from the email address on your account. Depending on where you live, you may have more rights under the law (for example in the EU, UK or California), including objecting to processing or complaining to your data protection authority. We'll answer within 30 days.
Children
Plant Life is for players aged 13 and older; sign-up refuses anyone younger. We don't knowingly collect information from children under 13. If you believe a child under 13 has made an account, tell us at [CONTACT EMAIL] and we'll delete it. Teens (13–17) should have a parent's or guardian's permission to play; parents can ask us to see or delete their teen's information.
Security
Connections use encryption (HTTPS and secure WebSockets), passwords are hashed, and the game's database is reachable only through the game's own checked functions. No system is perfectly secure, so please use a password you don't use elsewhere.
Changes
If this policy changes in an important way, we'll tell players in the game or by email before the change takes effect.
Contact
[OPERATOR] · [CONTACT EMAIL]