Privacy Policy
1. Who is responsible
Alpha Code Studio (“we”) runs Coven and is the controller of the personal data described here. Contact: see alphacodestudio.com.
2. What we collect and why
| Data | Why |
|---|---|
| Account: username, first and last name, email, password (stored only as a salted hash) | To create and secure your account and sign you in |
| Game progress: witches, levels, powers, coins, inventory, coven membership | To save your game and let you play on any device |
| Purchases: what you bought, amount, date, payment reference (not your card details) | To deliver what you bought, for accounting and support |
| Usage data: pages and screens visited, sessions and play time, in-game events (kills, purchases, events), browser and device type, screen size, language, time zone, referrer, an anonymous browser id | To run the Game, fix problems, prevent abuse and improve it |
| Multiplayer: your username, chosen witch, position and actions while you play online, which server you are in | To let players play together |
Our legal bases are performance of our contract with you (running your account and delivering purchases), our legitimate interests (security, fixing and improving the Game) and, where required, your consent.
3. Payments
Payments are handled by Paddle (Merchant of Record). Paddle collects your payment details, email and billing country under its own privacy policy. We never see or store your card number.
4. Who we share data with
Only service providers that help us run the Game: Supabase (database), Railway (game server), Netlify (website hosting) and Paddle (payments). They process data on our behalf. Other players see your username, witch, coven and in-game actions. We do not sell your data and we do not use advertising trackers.
5. Storage on your device
The Game stores a sign-in token, an anonymous browser id and your settings (graphics, sound) in your browser's local storage. These are needed for the Game to work; there are no advertising cookies.
6. How long we keep it
Account and progress data: while your account exists. Purchase records: as long as the law requires for accounting. Usage events: up to 24 months. When you ask us to delete your account we remove your personal data, keeping only what the law requires.
7. Your rights
You can ask us to access, correct, export or delete your data, to restrict or object to its use, and, if we rely on consent, to withdraw it. You may complain to your data-protection authority. To use your rights, contact us through alphacodestudio.com; we answer within 30 days.
8. Children
The Game is not for children under 13 (16 in the EU). If you think a child has given us data, tell us and we will delete it.
9. Security and transfers
Data is sent over HTTPS, passwords are hashed, and access to our database is limited to our server. Our providers may process data outside your country (including the EU and the United States) under appropriate safeguards.
10. Changes
We will update this page when our practices change and change the date above.