Privacy Policy

1. Who is responsible for your data

The data controller is Fathom Reef Interactive Ltd, registration number C 104772, Level 2, Tritoni Court, 18 Marina Promenade, Gzira GZR 1673, Malta. For any privacy matter, write to [email protected]. We handle personal data in line with the EU General Data Protection Regulation and the data protection law of Malta.

2. What we collect

If you only browse

• A strictly necessary preference stored in your own browser recording that you confirmed you are 18 or over. This never reaches our servers.
• Standard web server log entries generated automatically when a page is served: IP address, timestamp, requested URL, HTTP status, referrer and user-agent string.

If you create an account

• Your email address — used to identify the account and to contact you about it.
• A display name of your choosing. It does not have to be your real name.
• A cryptographic hash of your password, produced with the scrypt algorithm and a per-account random salt. We never store, and cannot recover, the password itself.
• Your virtual coin balance, the date you registered, the date you last claimed a bonus, and a short log of coin awards.
• A signed session cookie so your browser stays logged in. It contains your account number and an expiry, authenticated with a secret key held only on our server.

3. What we deliberately do not collect

• No payment data of any kind. There is nothing to buy here, so there is no card number, no bank detail and no billing address anywhere in our systems.
• No identity documents, date of birth or address.
• No advertising identifiers, no behavioural profiling, no cross-site tracking.
• No third-party analytics, pixels, tag managers or social plug-ins.

4. Why we process it, and on what legal basis

• To provide the account you asked for — storing your balance, authenticating you, awarding daily coins. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• To keep the site secure and working — server logs, abuse and fraud prevention, diagnosing faults. Legal basis: legitimate interests (Art. 6(1)(f)).
• To meet the 18+ restriction — recording your age confirmation and acting on reports about minors. Legal basis: legitimate interests and compliance with legal obligations (Art. 6(1)(f) and (c)).
• To answer your emails — correspondence you send us. Legal basis: legitimate interests, or contract where it concerns your account.

We do not send marketing email and therefore do not process your data for that purpose. We carry out no automated decision-making or profiling that has any legal or significant effect on you.

5. Who else sees it

We do not sell, rent or trade personal data. It is shared only with:

• our hosting provider, which operates the server on which the site and its database run, acting as our processor;
• a network security and content delivery provider that sits in front of the site and necessarily processes IP addresses and request metadata to do so;
• public authorities, where we are legally obliged to disclose something.

Separately, when you open a game, your browser connects directly to the game developer's servers to load the demonstration build and its cover art. That connection is between you and them; it reveals your IP address and browser details to that developer, who acts as an independent controller under their own privacy notice. We pass them no personal data about you and receive none back. Because the embedded content is a free demo, no account or payment information is involved on either side.

6. Transfers outside the EEA

Our own infrastructure is located within the European Economic Area. Where a service provider or an embedded game developer processes data outside the EEA, that transfer relies on an adequacy decision of the European Commission or on Standard Contractual Clauses, together with appropriate technical safeguards.

7. How long we keep it

• Account data — for as long as the account exists, and deleted within 30 days of you asking us to close it.
• Dormant accounts — we may delete accounts that have not been used for 24 months.
• Server logs — retained for up to 90 days, then discarded.
• Email correspondence — up to 24 months after a matter is closed.
• Session cookie — expires 30 days after issue, sooner if you log out.

8. Your rights

Under the GDPR you may ask us to:

• confirm what we hold about you and provide a copy (access);
• correct anything inaccurate (rectification);
• delete your data (erasure);
• restrict how we use it, or object to processing based on legitimate interests;
• provide your data in a portable, machine-readable format;
• withdraw any consent you have given, at any time.

Email [email protected] from the address on your account and we will respond within one month, free of charge. If you are unhappy with how we have handled things you may complain to the data protection authority in Malta or in your own country of residence.

9. Security

The site is served exclusively over HTTPS. Passwords are stored only as salted scrypt hashes. Session cookies are HTTP-only, marked Secure and SameSite=Lax, and are signed with an HMAC so a tampered cookie is rejected. The database file sits outside the web root and is not reachable from the internet. Access to the server is restricted to a small number of administrators using key-based authentication. No system is perfect, but the amount of data we hold is deliberately small — the best protection available.

10. Children

This site is not intended for anyone under 18 and we do not knowingly collect data from minors. If we discover that we have, we delete it and close the account. See section 3 of our Terms of Use.

11. Changes to this policy

Updates are published on this page with a revised date at the top. If a change materially affects how we use your data, we will draw attention to it on the site before it takes effect.