Privacy Policy

Privacy update 16 October 2026 · Cookie consent revision 2026-09-23-ga4-attribution-2 · Policy clarification 2026-09-23-growth-1 · Account email consent revision 2026-09-23-account-email-3.

Current beta: Google Analytics starts only after you accept Analytics. Where offered, account registration has a separate optional choice for occasional Ardesia product emails. This choice does not enable browser tracking or advertising audience uploads.

Who is responsible

Tommaso Galli, Via Giano della Bella 22/1, 50124 Firenze, Italy, is the controller for Ardesia. Contact him at tommy@ardesia.world about your information or this notice.

What we use and why

• Android closed-test invitations: if you request an Android test invitation, we use the Google Play account email you provide to send a confirmation link, add your confirmed address to a private tester list in Google Play Console, and send test access instructions plus a personal, one-use Full Campaign code. Google receives the address to determine eligibility for the closed test. This operational email is separate from marketing and does not turn on advertising or analytics consent. We store confirmation, admission and code-redemption records to administer the test and prevent duplicate claims. Tester records have no automatic expiry while the closed test is active; contact tommy@ardesia.world to request removal or deletion.
• Account and access: your name, surname, email, chosen display name, language, password hash, email verification status and session information let us create and secure your account, send setup or recovery emails and provide access. These details are required for the account service; a public tutorial can be played before registration.
• Your game: saved progress, preferences, unlocks, maps and completion records let you continue playing and use requested online/offline features.
• Leaderboard: qualifying completed runs can add your display name, completion time and hits received to a ranking visible to signed-in players. Your first name is initially your display name; choose a nickname that you are comfortable sharing. Email and surname are not shown in this ranking.
• Service security: network requests expose your IP address and technical request information to the web server. Account request limits use keyed hashes of identifiers. Technical diagnostics describe loading stages, errors and resource/performance counters. The local diagnostic buffer is bounded; server submission is enabled only through a diagnostic link and requires authentication.
• Support: contacting the controller sends your address and message to his email mailbox. Include only information needed to handle your request.
• Terms and consent records: new registrations record the accepted Terms version and time. If you separately allow account emails, we retain the selected purpose, policy version and time so we can honour and demonstrate that choice. Earlier marketing choices remain recorded under their original version and are not expanded.
• Optional account marketing: with your separate consent, we may email occasional product news, releases and play invitations. Current registration does not request permission to upload your email to advertising audiences. Before enabling any such matching, we will identify the recipient and purpose and obtain an appropriate separate choice. These messages are distinct from operational account emails. No audience upload is active in this beta release.

Payments

For the paid Web unlock, Stripe Checkout receives your account email and payment or billing details needed to process your order. Ardesia sends an internal account reference and product reference so confirmed payment can unlock the right account. Ardesia retains payment-provider references, payment event records and the account entitlement; it does not store full card details. Payment processing and delivery of purchased access are necessary to perform the purchase contract. Applicable accounting or tax records are processed to meet legal obligations. These operations do not depend on optional tracking consent. Stripe also processes information for fraud prevention and its own legal obligations under its Privacy Policy, which describes its international processing and transfer safeguards. Payment and entitlement records currently have no automatic expiry; deletion requests are assessed alongside any applicable legal retention requirements.

Legal bases

Providing the requested account, saved game and related operational emails is based on performing the service you request (GDPR Article 6(1)(b)). Security and abuse prevention are based on the controller's legitimate interest in maintaining a reliable service (Article 6(1)(f)). Support about your account is part of the requested service. Other enquiries and the limited record of accepted terms are handled in the legitimate interest of responding to requests and documenting the service relationship. The leaderboard is part of the game service: qualifying completions publish your nickname, completion time, hits received, broad device category (Phone, Tablet or Desktop), the keepsakes used and whether the True Ending was completed to signed-in players. We do not publish a device model or full browser user-agent string. You may change your nickname or contact the controller about a ranking entry. Optional Google Analytics, Meta advertising measurement and account marketing use consent for their respective purposes (Article 6(1)(a)); refusing either does not affect account access or play.

Website typography

Six Hands Chalk is delivered by Adobe Fonts (use.typekit.net and p.typekit.net). Your browser contacts Adobe to display the website lettering, independently of optional Google Analytics. Adobe receives technical font requests, including the site hostname and IP address. Adobe states that its web-font delivery does not set or use cookies and does not store the IP address; it processes font-use information for delivery, licensing and foundry payments. See the Adobe Fonts privacy notice. If the font service is unavailable, local fallback lettering keeps the site usable.

Services and recipients

The controller administers account and support data. Hetzner provides the hosting; the game VPS is in Helsinki, Finland. Spacemail, a service of Spaceship, Inc., delivers account emails. Support messages are handled through the contact email address. Signed-in players see leaderboard nicknames and the result details described above, not email addresses, surnames, precise device models or full browser user-agent strings. Service providers may use personnel and subprocessors needed to deliver their services; information may also be disclosed where legally required.

Email and support processing can take place outside the European Economic Area, including the United States. The game server location does not mean that every provider processes data only in the EU. Spaceship publishes a data-processing addendum covering its hosted services and international transfers, including standard contractual clauses where applicable. Google describes adequacy mechanisms, the EU-US Data Privacy Framework and standard contractual clauses in its transfer information. You can contact the controller for information about recipients or copies of applicable safeguards. See also Spaceship privacy and Google privacy.

Google Analytics 4 is provided by Google under its applicable service agreement and Data Processing Terms, accepted for this account on 14 September 2026. It loads only after you choose Analytics. Meta advertising measurement loads separately only after Marketing consent. Purchases use Stripe Checkout. Adobe Fonts is described above and loads independently of Analytics consent.

Optional Analytics

If you choose Analytics, Google receives page visits, selected account events (form opened, submitted, succeeded or failed) and limited technical session/error events. Google also processes analytics cookie identifiers and browser, device and network information, including information used to estimate location. Our event adapter excludes account names, emails, passwords, account IDs, full URL query strings/fragments and full incoming referrer URLs. After Analytics consent, it sends page visits, selected account and purchase steps, game progression, boss outcomes and memory cards. To show broad traffic sources, it sends only validated, short UTM source/medium/campaign labels and the referring site origin; advertising click identifiers are excluded. This is not anonymous processing.

We use Analytics to understand visits, account journeys and technical problems. Google Signals and user-provided data collection are off; the tag denies advertising storage, advertising user data and personalisation. Enhanced measurement of interactions is off. No advertising audiences are configured by the Google Analytics integration. The Analytics account also contributes aggregated, de-identified measurement data for Google's modeling and business insights; Google products/services sharing, support access and business recommendations are off.

No Analytics request is made before your choice or after Deny. Continuing to use the page is not consent. You can withdraw or change your choice through Cookie Policy or Cookie settings in the home, pause and account menus. Withdrawal stops future collection and removes this property's analytics cookies; it cannot recall data already sent or a request already in flight. Events observed before acceptance are not replayed.

The configured event-data retention is 2 months. User-data retention is 14 months, renewed by new user activity. These controls do not govern most standard reports based on aggregated data. The browser analytics cookies have a separate expiry described below. See Google's retention explanation. Google processing can involve countries outside the EEA under the transfer mechanisms linked above; contact the controller for information about applicable safeguards.

Optional Meta advertising measurement

Only after you accept Marketing, Meta Pixel and Conversions API send page visits, demo starts, completed registrations, checkout starts and confirmed purchases to Meta to measure and improve Facebook and Instagram advertising. Data includes the page path, event time and type, an opaque event ID, browser user agent, Meta browser/click identifiers, and purchase value and currency. The Pixel also exposes the browser IP address to Meta as part of the connection. Our server integration does not upload your email, name, phone number, account ID or game saves. It does not transmit purchases made before the consented checkout.

This choice is separate from Analytics and account email/audience consent. Refusing does not prevent play or purchase. Use Cookie settings to withdraw: future events stop, browser marketing cookies are removed and pending server events are cancelled. Already sent data and requests in flight cannot be recalled by the banner. The server erases identifying event payloads after successful delivery or final failure, and stops retrying after two days; delivery receipts remain for seven days. Checkout attribution is removed after two days. Meta processes received data under its Privacy Policy, including processing outside the EEA; contact the controller for information about applicable safeguards and your rights.

How long data stays

• Login sessions expire after seven days. Setup/verification/email-change links expire after24 hours; reset links after30 minutes. Scheduled cleanup removes expired tokens, their queued emails, expired request-limit counters and sessions.
• Server diagnostic reports older than24 hours are removed on new report writes and by the cleanup command, with bounded per-account/global storage. A daily cleanup timer also runs; delayed or failed execution may postpone removal. Browser diagnostics are limited to32 records in session storage.
• Web access logs rotate daily with14 rotated archives retained. A verified local server database backup exists; external backups have not been confirmed.
• Account records and cloud saves have no automatic inactivity expiry in the current implementation. Account deletion removes linked account records, saves and leaderboard entries from the live account database.
• Device storage follows the periods described in the Cookie Policy. Clearing browser site data can remove offline progress and downloaded maps.

Retention is also determined by the purpose: account data and saved progress remain while the account is maintained, with no automatic inactivity expiry. Support correspondence and delivery-failure records are kept while needed to resolve the request, investigate delivery or handle a related dispute; they do not currently have an automatic expiry. Terms acceptance remains linked to the account. Backup copies are used for recovery and are separate from the live database; the scheduled local database backup keeps the latest 14 successful backup generations and removes older scheduled generations after a successful backup. Daily execution is scheduled, but failures can extend the calendar retention. Older backups made for releases are separate and are reviewed manually rather than automatically expiring. Account deletion does not instantly remove every backup or separate diagnostic record. A deletion request is reviewed for those copies too, including any information that must be retained for a specific legal obligation or claim. Ask the controller for the handling of your particular request. No fixed deletion deadline for these separate copies is promised here.

Your choices and rights

You may request access, correction, deletion, restriction or portability where applicable, and object to processing based on legitimate interests. Contact the controller; reasonable identity checks may be needed. You may complain to the Italian Garante or your competent supervisory authority. You may withdraw Analytics or browser Marketing consent at any time through Cookie settings, and withdraw account-marketing consent by contacting tommy@ardesia.world. You may withdraw email marketing and audience matching separately; browser Cookie settings does not change these account choices. Withdrawal does not affect earlier processing and does not affect account access. You can object to processing based on legitimate interests through the contact address.

Authentication, rate limiting and game scoring use automated rules. Ardesia does not make solely automated decisions producing legal or similarly significant effects. Optional Meta advertising measurement and its purposes are described above.

Beta access and changes

Accounts in this beta are available to people aged 13 or over. Registration requires a declaration that you meet this minimum age and acceptance of the Terms. If you are under 18, ask your parent or guardian for permission. Optional account email marketing is available only to adults aged 18 or over and is off by default. The minimum age for an account is not permission for optional tracking or marketing. Where processing requires consent, a child below the applicable age of digital consent needs authorization from a parent or guardian; in Italy that threshold is 14. Ardesia does not currently provide a verified parental-consent flow, so children below that threshold must leave optional tracking and marketing off. We do not collect a birth date or identity document through this form; the declaration is not an age-verification service. If you believe a child has created an account, contact the controller.

The effective date is shown above. Material changes and any new optional services will be explained before they begin.

Cookie settings

Contact: tommy@ardesia.world

TikTok and gameplay measurement

With Marketing consent, TikTok Pixel and Events API receive visits, demo starts, selected gameplay events, account registration, checkout and confirmed purchases to measure and improve advertising. Meta receives equivalent selected events. Gameplay data can include world, room number and type, enemy or hazard category, boss attempts, active-play milestones and exploration counts. These are game categories, not free-text messages. Engagement points are not money or purchase value.

Google Analytics receives usage events only with Analytics consent. Marketing and Analytics are separate choices in Settings; Accept all enables both and Deny all keeps both off. Adding TikTok requires a fresh choice. You can withdraw through Privacy choices or cookie settings. We do not send account passwords, emails, names, saved-game contents or checkout session URLs through these events.

TikTok may use _ttp, _tt_enable_cookie, ttclid and ttcsid-prefixed cookies after consent. Its advertising cookies can last up to 13 months from their last use. Ardesia stores a valid TikTok click identifier as ardesia_ttclid for up to 90 days and an essential, browser-scoped __Host-ardesia_tiktok permission receipt for up to six months. Withdrawing consent removes these first-party cookies on ardesia.world. Cookies on TikTok or Pangle domains are controlled by those services and can be managed in browser settings. Server attribution is retained up to two days; delivery receipts up to seven days. Revocation prevents new sends and clears pending payloads; it cannot recall events already delivered. TikTok may process data internationally under its applicable safeguards. See TikTok's privacy policy.

Verified purchase measurement

With Analytics consent, Google Analytics can receive confirmation of a paid web purchase, its currency and actual checkout total. A derived transaction reference prevents duplicate reporting; your Stripe checkout session, email and payment credentials are not sent to Google Analytics. Marketing consent separately controls equivalent Meta and TikTok purchase measurement.