Website Privacy Notice

Last updated: October 13, 2026

This notice covers watercreststudio.com (this website). The controller responsible for website data is WaterCrestStudio, North Carolina, USA. Contact: jasonrobinson65@gmail.com. Privacy for our games is covered separately by our game privacy policy.

Summary

• No accounts, no email required, no analytics, no tracking, no advertising cookies.
• Nothing is stored in your browser unless you click Accept on our banner (see the Cookie Policy).
• We only collect what you type into the feedback form, and it doesn't ask for your name or email.
• We do not sell or share your personal information.

What we collect

The feedback form does not ask for your name or email. When you submit it we store:

• A random reference ID (like WC-7KQ2M9XA) that we create and show you once, so you can refer to your feedback by email if you want. It is not linked to your identity, and it is not stored on your device.
• The game, feedback type and your message
• Your phone model (optional)
• An optional screenshot (we strip embedded metadata such as location)
• Your browser's user-agent string (technical info about browser/device type)
• A one-way hashed (keyed) version of your IP address, used only to stop spam and abuse. It is purged from the record within 24 hours.

Our server also holds your IP address in memory (not on disk) for up to 24 hours to enforce rate limits against spam. It is cleared automatically and when the server restarts. Like any web server, our hosting provider and reverse proxy may keep short-lived technical logs for security.

Visiting pages without submitting anything does not create any record about you on our side. Our website stores nothing in your browser on a first visit; if you click Accept on the cookie banner, a single localStorage entry (wcs_consent) records that choice, and if you click Decline nothing is stored. Details are in our Cookie Policy.

Why we use it, and our legal basis

• To read and act on your feedback (fix bugs, consider ideas): based on your consent (GDPR Art. 6(1)(a)), given with the checkbox on the form.
• To prevent spam and abuse (hashed IP, rate limits, anti-bot checks): our legitimate interest in keeping the service secure (GDPR Art. 6(1)(f)).

Retention

• Feedback (and any screenshot) is deleted automatically 12 months after submission, or sooner if we delete it once it's handled.
• The hashed IP is removed from each record within 24 hours.

Security

The site uses HTTPS. Feedback and screenshots are encrypted at rest (AES-256-GCM) on our server. Only the studio team can access them, through a password-protected admin area or a private access key. No system is perfectly secure; if a security incident ever affects your personal information, we will notify affected people and authorities where the law requires.

Sharing and selling

We do not sell or share your personal information (as those terms are defined by the California Consumer Privacy Act as amended by the CPRA), and we do not use it for targeted advertising or profiling. The website runs on a server rented from Kinetic Hosting (Dapper Fox Group Ltd, a UK company) in its Washington, D.C.-area (Virginia) location in the United States. Kinetic Hosting acts as our hosting provider ("processor") and stores the encrypted data on that server. Website traffic first passes through a secure reverse proxy (Pangolin) that WaterCrestStudio runs itself in North Carolina, USA, to provide HTTPS; it is not a third party. We may disclose information if required by law.

Automated decisions

We do not use your data for automated decision-making or profiling.

Do Not Track and Global Privacy Control

This website does not track visitors across sites or over time, and does not allow third parties to do so, so it treats every visitor the same whether or not a Do Not Track or Global Privacy Control signal is sent.

Your rights

Depending on where you live (for example the EU/EEA, the UK under the UK GDPR, or California under the CCPA/CPRA), you may have the right to access, correct, delete, or get a copy of your data, to object to or restrict processing, and to withdraw consent at any time (this does not affect processing already done). California residents have the right to know, delete and correct, and to not be discriminated against for using these rights. We do not sell or share data, so there is nothing to opt out of.

To make a request, email jasonrobinson65@gmail.com with your reference ID (or, if you don't have it, the approximate date, the game and details of your message). Because we don't collect names or emails, the reference ID is the easiest way for us to find your feedback. We will respond within the time required by law (generally 30 days under GDPR, 45 days under the CCPA). You can also complain to your local data protection authority.

Children

This website is not directed to children under 13 (or under 16 in some EU countries), and we do not knowingly collect personal information from them. If you are under 13, please do not submit the feedback form; ask a parent or guardian to send feedback for you. If you believe a child has sent us personal information, contact jasonrobinson65@gmail.com and we will delete it.

International users

We are based in North Carolina, USA, and the website server is located in the United States. If you submit feedback from outside the United States (for example from the EU or UK), your data is transferred to and stored outside your country. We rely on your consent for this transfer (GDPR Art. 49(1)(a)) and protect the data with encryption and the safeguards described above. The United States may not offer the same level of data protection as your country.

Changes and contact

We will update this page if our practices change. Questions: jasonrobinson65@gmail.com.