Privacy notice

Accounts and access

We process your email, account identifier, chosen username, authentication-related records and access status to create and administer your account and deliver requested access. Authentication is handled through Supabase. A username may be visible to other players; your login email is not intended as a public multiplayer name. Contractual administration relies on Article 6(1)(b) GDPR where necessary for a valid contract; fraud prevention and service protection rely on legitimate interests under Article 6(1)(f), subject to your rights.

Game operation and support

The service processes installation and authorization records, session activity, reported playtime and multiplayer connection information to deliver and secure the game and diagnose faults. Feedback includes text, attachments and conversations you submit. We use this information to answer requests, investigate problems and improve reliability, on the basis of contract necessity where applicable and legitimate interests in support and improvement. Do not include unrelated sensitive information in reports.

Payments

When subscriptions become available, Paddle will process checkout and billing under its own privacy notice. We receive identifiers, selected price, payment/refund status and paid-period information to manage access, support and accounting. We do not receive your complete card details through our checkout integration. Contract administration and applicable accounting obligations provide the relevant legal bases. Test payments are kept separate from real contributions.

Hosting and recipients

Supabase supplies authentication and account storage; Cloudflare delivers the account website; Dropbox supplies downloads. The current playtest API, feedback service and relay run on the developer’s computer through ngrok. Transactional mail uses the dedicated SteamDream mailbox and its mail hosting service. Authorized administrators can access records needed for support and service operation. Providers may process network and technical information to deliver their services. These services operate internationally; processing is not represented as EU-only. Provider processing and international-transfer terms are described in their published data-processing documentation. Contact us for information about the safeguards applicable to your data.

Optional game-view sharing (ScreenView)

With your permission, ScreenView lets the developer see periodically updated images of your SteamDream game window to help investigate an issue.

For player accounts, sharing requires accepting an in-game request and can be stopped using the in-game sharing control. Declining a request does not itself remove game access. The images come from the rendered game view, rather than your desktop or other applications, and may include names, chat or other information visible within the game. No microphone or desktop-audio capture is part of this feature.

Images are reduced in size and sent repeatedly while sharing is active, potentially several times per second. They are available to the developer through the private control centre. The service holds the latest image in memory, replacing it as a new one arrives; this feature does not create a stored video or image archive. The current image is discarded when sharing is stopped or the viewer session is cleared. A disconnected viewer expires through a short inactivity timeout. An image becomes unavailable for viewing after ten seconds without a fresh image; this is not a promise that every memory copy is erased at exactly ten seconds.

Optional player sharing relies on consent under Article 6(1)(a) GDPR. You can decline or withdraw by stopping sharing, without affecting earlier lawful processing. Accepting the general Terms does not grant ScreenView consent. Developer-owned test clients have a separate testing configuration; ordinary players must not be treated as developer-owned clients to bypass their permission.

Future paid offline access

Offline paid-access support is not active in the current playtest. If enabled with a future paid offer, the launcher sends a one-way hash derived from the device identifier to bind a signed access pass to that device. The pass also contains a hashed access identifier, platform, build and validity dates, and is cached locally with a last-seen time to check expiry and obvious clock rollback. It contains no email, name, address or card data. Signup, invitations and sandbox payments do not grant such a pass. The processing supports delivery and protection of the purchased access, relying on contract necessity and legitimate interests where applicable.

Browser storage

The account portal stores authentication session information in browser storage to keep you signed in. Sign out on shared devices. This storage is used for account functionality, not as consent to marketing. Downloads and the launcher have separate installation settings and may remember an access code when you choose that option. The portal does not load advertising or analytics scripts as part of its account page.

How long data is kept

Account/access records are retained while the account and access relationship are active and as needed for unresolved support, security incidents or legal claims. Session, diagnostic and feedback records are retained for access administration, issue investigation and service support. Retention is assessed by reference to those purposes and any outstanding incident or claim, rather than by the number of days displayed in the control centre. Deletion requests can be sent to support; there is no promise of automatic deletion after a fixed number of days. Legally required accounting records are generally kept for seven years under Austrian rules, longer where required for proceedings or another applicable obligation. Private backups may retain copies until rotation and must not be used to reintroduce data deleted from normal use. Backup copies are handled separately from normal account use and may require separate deletion or expiry. A retained backup is not permission to reuse deleted personal data for another purpose.

Your rights

Contact account@steamdream.space to request access, correction, deletion, restriction or portability where applicable. You may object to processing based on legitimate interests. Where processing relies on consent, it may be withdrawn without affecting prior lawful processing. We may verify identity before disclosing or changing records. Deletion may be limited by legal obligations or established claims. You may complain to the Austrian Datenschutzbehörde at https://www.dsb.gv.at or another competent supervisory authority.

Younger players

An adult must purchase and manage subscriptions. This does not by itself settle a child’s account eligibility or all privacy-consent requirements. Where parental authorization is required, it must be obtained through the supported process; no assumption is made that payment alone proves that authorization. Contact support before arranging an account for a child, so the applicable authorization can be assessed. The service does not treat a purchase as automatic parental authorization for optional ScreenView sharing.

Provider privacy information

Supabase · Cloudflare · Dropbox · ngrok · Paddle. Links describe those providers’ processing and do not replace this notice.

Updates

Material changes to processing will be reflected in an updated notice, with additional information or consent where legally required. Optional marketing requires a separate lawful basis; registering an account does not subscribe you to marketing.

Controller and contact

The controller is the individual provider named in the Legal notice. Contact account@steamdream.space for privacy requests.

Optional supporter credits

For the planned paid membership, verified payment and refund totals determine eligibility for the optional supporter credit. Choosing to appear in credits is voluntary and based on your consent. Only the public credit name you choose is published; your account email is not automatically included. You may withdraw consent and ask us to remove your name by contacting support. We retain the minimum payment and consent records needed to administer the credit and handle applicable recordkeeping obligations. Paid memberships and this credit feature are not available yet.