Privacy Policy

Who is responsible

No Shelter Lasts is operated by Marko Bajlo, an individual based in Croatia and the controller of personal data described here. Contact: info@noshelterlasts.com. This notice covers visitors to the public website and people with invited game accounts.

The information used

Account information includes your name or account label, email address, language, password hash, verification status and access permissions. Invited accounts can be created by the operator. We also receive information you send when asking for help or providing feedback.

The web server processes your IP address and request information when you visit the website, including for serving pages and maintaining access and error logs. When you use an account, the application processes session information, IP addresses and browser information for authentication and operation. If you enable two-factor authentication, it stores encrypted authentication and recovery information. If you add a passkey, it stores the credential and public-key information; the application does not receive your biometric data or the private key held by your authenticator.

Saved games include your runs, choices, dice results, survivors, inventory, resources, encounters and progress. Fictional wounds and infections describe game characters, not your health. Technical errors and security events can also generate server or application logs.

Why information is used

Account and saved-game information enables access, authentication, password recovery, the permissions assigned to your account and continuation of your game. Activity timestamps support account administration. Support correspondence is used to answer requests and investigate reported problems.

For this free, closed playtest, we rely on legitimate interests under Article 6(1)(f) GDPR in providing the invited game, administering accounts, protecting the service and resolving problems. Processing is limited to what is needed for those purposes, with regard to your rights and reasonable expectations. You may object as explained below. Handling requests to exercise statutory data-protection rights relies on Article 6(1)(c).

Individual gameplay history and activity timestamps are used for the game, administration and troubleshooting, not for separate behavioural analysis of testers. This notice does not retrospectively establish consent or acceptance of a contract.

Services involved

The game and its MySQL database are hosted on a Hetzner server in Nuremberg, Germany, under an accepted data processing agreement. Daily copies of the server disk use seven rotating backup slots in the same location. No separate snapshots, attached storage volumes or manual data exports are currently used.

Laravel Forge manages deployment and has administrative access for server management. Its standard terms incorporate Laravel’s data processing agreement, including Standard Contractual Clauses for relevant international transfers. The agreement allows processing in the United States and other locations; the German hosting location does not mean all server management takes place in the EU.

Resend sends transactional account email through its Ireland sending region. Open and click tracking are not configured for our sending domain. An EU sending region does not mean EU-only storage: Resend documents storage in the United States and a standard data processing agreement, including Standard Contractual Clauses, concluded when an account is opened.

Production password validation includes a compromised-password check using Pwned Passwords. It sends a short prefix of a password hash, not your full password or email address.

Proton Mail handles correspondence sent to the contact mailbox, separately from application email. Proton stores mailbox data in Switzerland, Germany or Norway. Switzerland has an EU adequacy decision. For relevant transfers handled under the Laravel and Resend agreements, Standard Contractual Clauses provide contractual safeguards. You can contact us for information about the applicable safeguards or a copy, subject to protection of confidential information.

How long information is kept

Accounts and saved games are kept while the requested playtest access continues, unless the account is closed earlier. Inactive accounts are reviewed at the end of the test phase. We give advance notice before planned removal of accounts or saves. There is no automatic time-based deletion of completed or abandoned runs.

Support correspondence is kept while the request is being handled and for no longer than six months after resolution. If a specific legal obligation or dispute requires longer retention, only the necessary evidence is kept for that purpose and for as long as justified.

A password-reset token is valid for 60 minutes; expiry does not itself delete its database record. Session expiry and physical cleanup are also separate events. Account deletion and the limits of that action are described below.

Resend Free retains email and delivery-log data for 30 days, with seven-day backup retention, according to the provider’s published rules. Proton’s offline backups can remain for up to 30 days after a message is deleted from the mailbox. Hetzner server backups use seven rotating slots, with the oldest replaced when a new backup is made; this is a rolling backup cycle rather than a guarantee of deletion at an exact age.

Application logs normally rotate weekly, retaining two archived files. Web-server logs normally rotate daily, retaining 52 archived files; PHP server-runtime logs rotate weekly, retaining 12. A file exceeding 100 MB can rotate earlier. These limits count archived files rather than set an exact maximum age for every entry: empty or inactive logs can remain until a later rotation. Server backup copies follow the separate backup cycle described above.

Closing an account

You can use account deletion in your profile or contact info@noshelterlasts.com. Application deletion removes the account, associated game records and passkeys, and ends the current session. Other session records and password-reset records are not all removed by that same action. Logs, correspondence, provider systems and backups need separate handling; immediate erasure of every copy is not promised.

If a backup is restored, previously approved deletions must be reapplied before the restored service is reopened. Backup copies expire through their rotation cycle; they are not individually edited each time an account is deleted. Requests concerning remaining session, reset-token, log or correspondence records are handled separately according to the purpose and applicable legal requirements.

Cookies and browser storage

A fresh anonymous visitor can read the homepage and legal information without the application setting cookies or writing localStorage or sessionStorage. The public-page language comes from the URL. The navigation library may read a sessionStorage key to resume navigation; this does not itself create a saved entry.

Authentication and account functions use session and request-forgery protection cookies. Remember-me is used when selected at login. Account/authentication language preferences use a locale cookie; visiting a public language URL does not change the saved account language. An existing session may be renewed when you visit a public page.

The game also remembers a sidebar choice and a selected fast-dice preference, and uses per-tab storage to avoid replaying a dice animation already shown. These are interface functions, not authoritative saved games. Fixed dark appearance is no longer persisted; old appearance records are ignored.

Session and request-forgery protection cookies normally expire after 120 minutes, with renewal during use. The optional remember-me cookie lasts up to 400 days, the account-language cookie up to one year and the sidebar cookie up to seven days. The fast-dice choice remains in localStorage until you remove it; per-tab animation storage lasts for the browser tab’s session. You can remove browser storage through your browser settings; removing authentication cookies can end your sign-in. Server-side saved games are separate from browser storage.

Your rights and requests

You may ask for access, correction, erasure, restriction or portability where the legal conditions apply. Where processing relies on legitimate interests, you may object on grounds relating to your situation. Contact info@noshelterlasts.com and describe your request. Only proportionate information needed to verify the request should be requested; do not send passwords or recovery codes.

Requests must normally be answered within one month. If the law permits an extension because of complexity or the number of requests, you must be informed within that first month. You can complain to the Croatian Personal Data Protection Agency (AZOP), including without first contacting the operator.

Required information and changes

Account credentials and an email address are needed to provide account access and recovery. Without the necessary account data, the account service cannot be provided. You can still read the public information without an account.

Material changes to the controller, purposes or handling of existing accounts require appropriate notice. Publication of this notice does not retrospectively establish consent or acceptance of new terms.