← Back to game
Privacy Policy
Last updated: 2026-09-21
This policy covers the web edition at roguescog.com, the Steam edition, and the iOS edition of Rogue's Cog. Sections 1–10 apply to all editions unless noted; section 11 describes what is different on Steam and section 12 what is different on iOS.
1. Controller
Nestwell Studio, LLC, operating roguescog.com ("we", "us", "our"). For data protection inquiries, contact privacy@roguescog.com.
2. Data We Collect
| Data | Purpose | Retention |
|---|
| Anonymous user ID (UUID) | Identify sessions, save progress | Until account deletion |
| Game scores | Leaderboards, progression | Indefinite |
| IP prefix (first 3 octets) | Rate limiting, abuse prevention | 30 days |
| Age bracket (13-15, 16-17, 18+) | Age-gate compliance | Until account deletion |
| Session tokens | Authentication | 30 minutes |
| Gameplay events | Analytics, debugging | 30 days |
| Run replays (seed and move inputs of a submitted run) | Score verification, debugging | Retained with the score |
| Crash reports (error trace, game version, and the replay of the affected run) | Debugging | 90 days |
| Subscriber session data | Subscription management | 90 days |
| Email (optional) | Account recovery, notifications | Until unsubscribe or deletion |
3. Legal Basis for Processing
- Legitimate interests — gameplay functionality, score tracking, rate limiting, security.
- Consent — analytics, marketing emails, and crash reports in the Steam edition. You may withdraw consent at any time.
- Contract — processing purchases and subscriptions you initiate.
4. Data Processors
| Processor | Purpose | Location |
|---|
| Supabase | Database, authentication | US |
| Stripe | Payment processing | US |
| Vercel | Hosting, edge functions | US |
| Sentry | Error tracking, crash reports | US |
| Resend | Transactional email | US |
For transfers of personal data from the EEA/UK to the US, we rely on Standard Contractual Clauses (SCCs) as approved by the European Commission, supplemented by additional technical and organisational measures where appropriate.
5. Retention
- Scores: retained indefinitely for leaderboard integrity.
- Session tokens: 30 minutes, then automatically purged.
- Gameplay events: 30 days.
- Run replays: retained as long as the associated score. Replays contain the run seed and your in-game moves only; they carry no name, email, IP address, or device identifier.
- Crash reports: 90 days.
- Subscriber sessions: 90 days.
6. Your Rights
Under the GDPR and applicable data protection laws, you have the right to:
- Access — obtain a copy of your personal data.
- Rectification — correct inaccurate data.
- Erasure — request deletion of your data ("right to be forgotten").
- Portability — receive your data in a structured, machine-readable format.
- Restriction — limit how we process your data.
- Objection — object to processing based on legitimate interests.
- Complaint — lodge a complaint with your local supervisory authority.
7. Data Subject Access Requests (DSAR)
To exercise any of these rights, email privacy@roguescog.com. We will respond within 30 days. We may request verification of your identity before processing your request.
8. Children
- Web edition, under 13: Access is blocked in compliance with COPPA (Children's Online Privacy Protection Act). We do not knowingly collect data from children under 13.
- Web edition, under 16 in the EU: Access is blocked in compliance with GDPR Article 8. Parental consent is required for data processing of children under 16 in EU member states.
- Steam edition: There is no age gate. The Steam edition creates no account with us and collects no personal data; the only data it can send is the opt-in crash report described in section 11, which contains no identifiers. Steam accounts are subject to Valve's own age requirements.
- iOS edition: There is no age gate. The iOS edition creates no account with us and sends no data to our servers; see section 12. Apple ID and Game Center accounts are subject to Apple's own age requirements.
If we learn that we have collected personal data from a child below the applicable age threshold, we will delete it promptly.
9. Cookies & Local Storage
| Name | Type | Purpose | Duration |
|---|
rc_session | Cookie (functional) | Session authentication | 90 days |
| localStorage keys | Web Storage | User preferences, game settings | Persistent until cleared |
We do not use third-party tracking cookies. The rc_session cookie is strictly functional and exempt from consent requirements under the ePrivacy Directive.
10. Changes to This Policy
We may update this policy from time to time. Material changes will be announced in-game. Continued use after changes constitutes acceptance.
11. Steam Edition
The Steam edition of Rogue's Cog is a desktop application distributed by Valve. It differs from the web edition in the following ways.
- No account, cookies, email, or payments. Purchase and licensing are handled by Steam under Valve's own privacy policy. We do not receive your Steam ID, display name, or payment details.
- Scores go to Steam Leaderboards, not to our servers. The Steam edition does not upload run replays to us.
- Crash reports are opt-in. On first launch the game asks: "Help us fix bugs — send anonymous crash reports?" with the explanation below. Until you choose, nothing is sent and the crash-reporting SDK is not initialised. You can change your choice at any time in Settings → Privacy, and disabling it does not affect your ability to play. When enabled, crash reports are sent to Sentry (US) and retained for 90 days.
- Diagnostics stay on your device. The game keeps a small rolling log file in its logs folder, and "Report a problem" in Settings writes a report bundle (your note, the run's seed and moves, build info, and a tail of that log) to the game's data folder. Neither leaves your computer unless crash reporting is enabled or you send a file to us yourself.
We collect crash traces, OS/GPU info, and the anonymous inputs of the run that crashed (seed and moves, so we can replay the bug). No username, no IP, no save data, no Steam ID. You can change this in Settings → Privacy anytime. Disabling does not affect your ability to play.
12. iOS Edition
The iOS edition of Rogue's Cog is distributed by Apple through the App Store. It differs from the web edition in the following ways.
- No account, cookies, email, or payments. Purchase and licensing are handled by Apple under Apple's own privacy policy. We do not receive your Apple ID, Game Center name, or payment details. The iOS edition never contacts our servers.
- Scores and achievements go to Game Center, not to our servers, and only if you are signed in to Game Center. Play is fully available without it. The iOS edition does not upload run replays to us.
- Game progress stays on your device. Saves and settings are stored in the app's own data and are included in your iCloud or computer backups under Apple's terms.
- No crash-reporting or analytics SDK. The iOS edition contains none. Apple may share anonymised crash logs with us if you have enabled "Share With App Developers" in iOS Settings; that choice is yours and is managed by Apple.
- Diagnostics stay on your device. "Report a problem" in Settings writes a report file (your note, the run's seed and moves, and build info) to the app's own data folder. It does not leave your device unless you send it to us yourself.