What's collected, and what isn't.

01Who is responsible

HOLLOWMAST is made and run by one person in the United Kingdom. For data protection purposes that person is the data controller. There is no company, no team and no third party operating any part of this on their behalf, other than the service providers named in section 7.

There is no published contact address yet. Until there is, the form on the support page reaches us, and the footer of this page says so rather than printing an address that does not work.

02The game itself

The game is a single file that runs entirely in your browser. It does not have accounts, logins, profiles or friend lists, because it has no server to keep them on.

• Saves are written to your browser's local storage on your own device. They are never uploaded. Clearing your browser data deletes them, and nobody — including me — can recover them.
• Settings are stored the same way and stay on your device.
• No cookies are set by the game, and it makes no request to any third party.

03Anonymous reports from the game

To find out where a game is too hard, too confusing, or simply broken, the game can send small reports back. These carry information about the run and the machine it ran on — which build, how far you got, what killed you, the browser and graphics card, and the details of any crash. The complete list, and the matching list of what is never included, is on the support page.

As the game ships today this is on unless you turn it off, so if you would rather send nothing, that is one switch and no hard feelings.

They are anonymous in a specific sense worth stating precisely rather than grandly: the session identifier is generated fresh every time the page loads and is never stored, no identifier is kept and no attempt is made to link one visit to another, and there is nothing in a report that names a person. What a report does carry is your browser version, your graphics card and the country the request came from — which, taken together, are more distinctive than most people expect. We do not use them to recognise you; we are telling you they are there.

There is a switch in the game's Settings that stops the sends outright — press Escape during a run, then Send anonymous reports, which reads ON or OFF. It is only reachable once a run is under way: there is no route to it from the title screen, and this page is not going to claim there is one.

04The form on the support page

If you send a bug report or an idea using the form, it transmits exactly the text you typed, which of the two kinds you picked, and the build number the page is describing. It does not attach your name, your email, an identifier or a cookie, because it does not have any of those.

That is a deliberate trade and it cuts both ways: there is no way to reply to you, and no way to find your message again later to delete it, unless you put something in the text that identifies it. If you want a reply, include a way to reach you — and know that if you do, you have chosen to put it in there.

05Website logs

This site is served by Cloudflare Pages. Like every web host, it processes the requests it receives in order to serve the page and to keep the service working and secure. That processing involves your IP address at the moment of the request.

No analytics product is installed on this site and no visit is profiled. The one thing deliberately recorded alongside a report is the country the request came from, which the host supplies with every request. The address itself is not stored.

06Cookies and advertising

Today, this website sets no cookies at all and loads no third-party script. Nothing on it tracks you, and there is no consent banner because there is nothing to consent to.

When that happens, three things happen with it, and none of them quietly:

• You will be asked first. Advertising and any other non-essential cookie will not be set until you agree, and declining will keep the site fully usable.
• This section will be rewritten to name the actual advertising provider and link to what it does, rather than describing a plan.
• It applies to this website only. The game is a single self-contained file with no third-party code in it, and no advertising will be put inside it.

07Who else can see any of this

• Cloudflare — hosts the site and the endpoint that receives reports, and stores those reports on my behalf.
• An advertising provider — none today; when one is added it will be named here in section 6 before it goes live.

Nothing is sold, and nothing is shared for anyone else's marketing. Reports are read by one person, to fix and balance the game.

08How long things are kept

Reports and form submissions are stored with a 90-day expiry set at the moment they are written, after which they are deleted automatically rather than by anyone remembering to do it. Saved games last exactly as long as you keep them, because they are on your own device.

09Your rights, and the one that is hard here

Under UK data protection law you have rights over personal data held about you, including access, correction, erasure and objection. To exercise any of them, use the form on the support page — a dedicated privacy address is not published yet, and this page will say so until it is.

There is a real limit worth being upfront about. Because reports carry nothing that identifies anyone, there is normally no way to find "your" data in order to show it to you or delete it — the same design decision that protects you also makes those requests impossible to fulfil precisely. If you sent something identifiable in the text of a message, say what it was and it can be found and removed.

You can also complain to the Information Commissioner's Office, the UK regulator, at ico.org.uk.

10Changes to this policy

The date at the top changes whenever this does. Anything material — advertising arriving being the obvious one — gets a visible note on the site rather than a silent edit, because a policy nobody is told about has changed is not really a policy.