Privacy policy
Draft of 2026-10-26 · Applies to the game Fur & Fortune and to furandfortune.io.
1. Who we are
Fur & Fortune is made by [legal name and address of the owner — to be completed] ("we"). For anything about your data, write to [email protected].
2. What the game sends
After each heist the game sends a small play-stat record so we can balance the game and publish community stats. Records are filed under your Steam ID. They contain:
- the heist, map type, difficulty (paw level), crew size and each crew member's species (and whether it was a bot);
- your crew, level, mutation, the skill nodes of your active preset, your equipped items by type, and your outfit id;
- how the heist ended (completed, failed or left), how long it took, and the payout;
- the game version, build channel (demo, beta, early access, release), operating system, and whether you hosted;
- if you turn on "Show my builds and stats on the website": your build for each crew you changed.
The game never sends your display name, preset names, chat, what you typed, your position in the map, or hardware details. We do not store your IP address with any record.
3. Your choice in the game
- EU, EEA and UK players: nothing is recorded or sent unless you press Accept on the first-launch notice or turn on "Share play stats" in Options > Privacy.
- Everywhere else: sharing is on after a first-launch notice, and you can turn it off at once or any time in Options > Privacy.
- Turning sharing off deletes anything the game has not sent yet and stops all sending.
4. The website
You can sign in with Steam to see your own runs, builds and achievements. Signing in tells us only your Steam ID (Steam keeps your password). We set one cookie, ff_session, which is needed to keep you signed in; it lasts at most 30 days and is removed when you sign out. A short-lived cookie (10 minutes) protects the sign-in step. We use no advertising or analytics cookies.
If the site shows your Steam name, picture or achievements, it reads them from Steam when you sign in or open the page.
5. Why we use it, and on what basis
| Purpose | Legal basis (to be confirmed by counsel) |
|---|---|
| Balancing the game; publishing community stats that are added up across many runs | EU/EEA/UK: your consent (Art. 6(1)(a) GDPR). Elsewhere: our legitimate interest in improving the game (Art. 6(1)(f)), with an off switch. |
| Showing you your own stats and builds after you sign in | Providing the service you asked for (Art. 6(1)(b)). |
| Stopping abuse (fake records, flooding) | Legitimate interest (Art. 6(1)(f)). |
Public numbers are always totals across at least 50 runs. We never publish anything about a single player: no leaderboards and no per-player times.
6. How long we keep it
Raw records are deleted 395 days (about 13 months) after we receive them. After that only totals remain, which do not identify anyone. Website builds are deleted 395 days after their last update. Sign-in sessions end after 30 days at most.
7. Where it is stored and who processes it
The data is stored with Cloudflare, Inc. (Workers, D1 database, Pages), which acts as our processor. The database is placed in Western Europe. Cloudflare may process connection data elsewhere to deliver the service; [transfer safeguards and the Cloudflare data processing addendum — to be confirmed by counsel]. Steam sign-in and achievements are provided by Valve Corporation under Steam's own privacy policy.
8. Your rights
- See and download your data: sign in and use My stats > My data > Download my data.
- Delete your data: in the game (Options > Privacy > Delete my stats) or on the website (My data > Delete all my stats). Turning off "Show my builds" in the game deletes your website builds.
- Withdraw consent or object: turn off "Share play stats" in the game at any time. This does not affect what was done before.
- If you no longer have the game, write to [email protected] from an address we can verify against your Steam account, and we will handle the request within one month.
- You can complain to your data protection authority. [EU representative under Art. 27 GDPR and UK representative, if required — to be confirmed by counsel]
9. Children
The game is not directed at children under 13 (or the age required in your country). [Age rating and any additional rules — to be confirmed by counsel]
10. Changes
If this policy changes in a way that matters, we will say so in the game and on this page before the change takes effect.