Privacy Policy

01 The short version

We collect the least amount of data the game actually needs to run, we never sell it, and we don’t watch how you play in order to build an advertising profile of you. Play as a guest and none of this applies to you at all — nothing personal ever leaves your device. Make an account and what we hold is: your email, your save, an optional region code, and — once you buy Nauts — a record of that purchase.

02Who’s responsible for your data

Bathysia is operated by S3P4 CODE S.R.L., a company registered in Romania — the controller responsible for the personal data described on this page. For anything about this policy or your data specifically, write to s3p4tech@gmail.com.

03 What we collect, and why

• Email address — sign-in only, so a one-time magic link can reach you. Never shown to other players.
• Region code (optional) — guessed once from your browser’s own locale setting, editable any time, used only to show sensible number and currency formats. Never derived from your IP address or GPS.
• Save data — your drone, your Ledger, your currencies, your progress. The game itself.
• Purchase records — once you buy Nauts, which pack, when, and the amount — kept for receipts and to help if something goes wrong. Your card number never reaches us; Stripe processes that directly.
• Anonymous visit counts — when you browse bathysia.com, we log that a visit happened and, where our hosting provider can tell, a coarse two-letter country code. No IP address is stored, and nothing here identifies a person.

That is the complete list. No behavioural tracking, no device fingerprinting, and no location data beyond the one-time locale guess above.

04 Guest play needs none of this

You can play the entire game today with no account and without giving us anything. A guest save lives only in your own browser’s storage (IndexedDB) — we never see it, never receive a copy of it, and can’t recover it for you if you clear your browser data yourself. If you sign up later, that local save is folded into your new account; it is merged, never discarded.

05 Who processes it

• Supabase — accounts, sign-in, and your cloud save. This is where your email, region code, and save row actually live.
• Vercel — hosts this website and serves the game, and is the source of the coarse country code behind our anonymous visit counts. Standard web hosting, nothing more.
• Stripe — payments. We never see or store your card number ourselves; Stripe handles that end entirely, and keeps its own transaction records under its own legal and financial obligations, on a retention schedule we don’t control.

We run no other data processor today, we do not sell your data to anyone, and we do not run our own ad SDKs or analytics trackers.

06What we don’t do

• We do not sell your data, to anyone, ever.
• We do not build a behavioural profile of how you play in order to target ads.
• We do not run ad SDKs today. If that ever changes — a rewarded-video partner for portal builds, for instance — we will ask first, plainly, before any such SDK loads on your device, not bury it in an update note.
• We do not use IP-based geolocation. The region field above is a one-time guess from your own browser locale, and you can change or clear it whenever you like.

07Age & children

You need to be 16 or older to create a Bathysia account — the digital-consent age for online services under GDPR in Romania, where we’re based. If you’re younger than that, you can still play as a guest with no account and no personal data collected at all, or have a parent or guardian create and manage an account on your behalf. If we learn an account was created by someone under 16 without that consent, contact us below and we’ll remove it.

08 Security

Row-level security means your save can only ever be read or written by you — not by other players, and not by us browsing a database by hand. We never hold your password: sign-in is handled entirely by Supabase through a one-time magic link, so there is no password of yours for us to lose in the first place.

09Your rights: delete & export

Both of these are real, working controls inside the game — not a request you have to email in for and wait on.

Deletion is irreversible, and the control says so before you confirm — export a copy first if you want one. We keep your account data only for as long as your account exists; our own record of a Nauts purchase is deleted the same way, since it’s tied to your account. Stripe, as the processor that actually handled the payment, separately keeps the transaction record it’s legally required to, on its own schedule that we don’t control. You can also complain to your local data protection authority at any time if you think we’ve got this wrong.

10Cookies & local storage

A cookie banner greets you the first time you visit, with three equally-sized choices: Accept all, Essential only, or Configure — no option is styled to nudge you toward another. Here is exactly what each category is:

• Essential — always on, because the site and game don’t run without it: a guest save’s use of your browser’s own storage (IndexedDB and localStorage), and the consent choice itself, saved to localStorage as your picked categories, the date, and a version number. Nothing here is a tracker, and it can’t be switched off, the way a shopping cart can’t be.
• Analytics and Marketing — both off by default, and both honestly unused today: nothing loads under either category right now. They exist as a placeholder for later — a rewarded-video partner for portal builds, for instance — and if that ever changes, the new script has to check your saved choice before it loads a single line, not after.

Change your mind any time: a Cookie preferences link lives in the footer of every page and reopens this same panel with your current choices. Until you pick something, or if you never do, the site treats you exactly as if you’d chosen Essential only — nothing non-essential ever loads by default, and the game works fully either way. The one exception on the whole site is a technical, session-only cookie used for our own staff login on the internal admin dashboard; it is never set for a player or visitor.

11 Changes to this policy

If this policy changes in a way that matters, we’ll post the update here with a new date and flag it in the news log. We won’t quietly loosen anything promised above.

12 Contact

Questions about this policy, or about your data specifically, go to s3p4tech@gmail.com. Bug reports and gameplay questions belong at bathysiagame@yahoo.com. You also have the right to complain to the data protection authority in your own country, or in Romania, at any time.