Privacy Policy

ClubSquareOne ("we", "us", "our") is a browser-based multiplayer life-simulation game. This policy explains what personal data we collect, why, how we handle it, and your rights. We are the data controller: Important Small Things Limited, registered in England & Wales (company no. 16431951; registered office 71–75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ), trading as "ClubSquareOne".

1. What we collect

• Account: your email address, and your password — stored only as a salted PBKDF2 hash. We never store or see your plaintext password.
• Date of birth (month and year only — never the day): collected at sign-up (and, for accounts created before we collected it, at your next login). Used solely to verify you meet the minimum age and, where under-18 accounts are permitted, to apply age-appropriate protections (such as disabling in-game chat) until you turn 18.
• Profile: a display name you choose, which is visible to other players.
• Gameplay: your character appearance, inventory, position, survival stats, and in-game balance.
• Security & technical: your IP address and browser user-agent, tied to your login sessions and a security audit log of key account events.
• Consent records: which document versions you accepted, your age confirmation, and any marketing opt-in, with timestamps.
• Waitlist / invites: if you join the waitlist or are sent an invite, your email address.
• In-game chat: chat messages are kept for up to 30 days so moderators can review reported behaviour in context, then automatically deleted.
• Player reports & blocks: if you report another player we record the report (who reported whom, the reason, when and where); your blocked-players list is stored with your account.

What we do not do: we use no analytics, advertising, or third-party trackers; we don't sell your data; we don't collect sensitive data; and we take no payments, so we hold no card data.

2. How we use it, and our lawful bases (UK GDPR)

• Contract: to create/run your account, provide the game, and send essential service emails (verification, password reset, email-change, security notices).
• Legitimate interests: to keep the service secure, prevent and investigate abuse/fraud/cheating, enforce our Terms, and rate-limit.
• Consent: to hold your email on the waitlist and send your invite (given when you join the waitlist), and to send occasional product-update emails (only if you opt in). You can withdraw consent anytime. We otherwise send only transactional email. Our emails contain no tracking pixels or tracked links — we don't use our email provider's open- or click-tracking features.
• Legal obligation & contract: to verify you meet the minimum age and to apply under-18 protections (your date of birth) — our online-safety and data-protection duties.

3. Cookies

We use only strictly-necessary cookies (so no consent banner is needed): a session cookie (keeps you signed in) and a CSRF cookie (form security). Both are HttpOnly. We use no analytics or advertising cookies.

4. Who we share it with

We don't sell your data. We use processors that handle data on our behalf: Cloudflare (hosting, database, network) and Resend (transactional email). We may disclose data where required by law or to protect our rights, users, or the public.

5. International transfers

Our processors may process data outside the UK under appropriate safeguards (e.g. the UK International Data Transfer Agreement / Standard Contractual Clauses).

6. How long we keep it

We keep account and gameplay data while your account is active, and delete inactive accounts after around 24 months. Sessions and email links expire and are purged automatically. If you delete your account, your audit records are pseudonymised (personal data stripped). Deletion is permanent and frees your email for reuse.

7. Your rights

You can access, export, rectify, erase, restrict, or object to processing of your data, and withdraw consent. Export your data (Account → Export my data) or delete your account (Account → Delete my account) anytime; change your email/password on your account page; or contact us at support@clubsquareone.com. Parents/guardians may exercise these rights on a child's behalf. If you joined the waitlist but never created an account, email us to be removed. You may also complain to the UK Information Commissioner's Office (ico.org.uk).

8. How we protect your data

Traffic is encrypted in transit and data is encrypted at rest by our host. Passwords are salted PBKDF2 hashes; session and email tokens are stored hashed; we apply rate limiting and lockout, parameterise all queries, and follow least privilege. No system is 100% secure, but we'll notify you and the ICO of a qualifying breach as required.

9. Children

The minimum age to use ClubSquareOne is shown at sign-up — currently 18, and never lower than 13. We check age against the date of birth (month and year) you give at sign-up, and we don't knowingly allow accounts below the minimum age: if we learn of one, we delete it. Parents or guardians can contact support@clubsquareone.com about a child's account at any time, including to have it removed.

Where the minimum age permits accounts for users under 18, extra protections apply by default and cannot be switched off: in-game chat is disabled entirely (under-18 accounts neither send nor see other players' chat) until the account holder turns 18; we never send marketing email to under-18 accounts; and we collect the same minimal data as for adults — nothing beyond the date of birth above. We design these accounts in line with the ICO's Age Appropriate Design Code.

In plain words, for younger players: we only ask for your email address, a made-up player name, and the month and year you were born. We use your birthday to keep chat switched off until you're 18. We don't ask for your real name, we don't track you around the internet, and we never sell your information. If anything in the game worries you, email support@clubsquareone.com — or ask a grown-up you trust to email us for you.

10. Changes

We may update this policy; the date above shows the latest version, and we'll notify you of material changes.