Privacy & Cookies

1. Who is responsible for your data?

Bashful Wolf Studio is operated by Bashful Wolf Studio Pte. Ltd., Singapore, the controller responsible for the personal data described in this notice.

Contact address

195 PEARL'S HILL TERRACE
#03-41
SINGAPORE (168976)

Privacy contact

privacy@bashfulwolf.com

2. What we collect and why

Steam sign-in and playtest keys

When you choose to sign in through Steam, Steam confirms your account's Steam ID to us. We associate that ID with your assigned playtest key, the time of your claim and an internal claim reference. This lets us issue one key per account and show you the same key when you return.

We do not receive your Steam password. Our sign-in integration does not request your email address, display name, friends list or game library.

You can browse without signing in. Providing a verified Steam ID is necessary to claim or retrieve a key; without it, we cannot allocate a key to your account.

Where the GDPR applies, we rely on our legitimate interests in administering the playtest, distributing keys fairly and preventing duplicate claims (Article 6(1)(f)). We limit this processing to the account identifier and claim details needed for those purposes.

Website operation and enquiries

Delivering a web page involves processing connection information such as your IP address. We use IP addresses and, on signed-in key pages, Steam IDs to limit excessive requests. Our hosting services may retain technical request and error information for operation, security and troubleshooting. If you contact us, we use your contact details and the information you provide to respond.

Where the GDPR applies, our legal basis for these activities is our legitimate interests in operating a secure, reliable service and answering requests (Article 6(1)(f)). We may also process information to meet applicable legal obligations (Article 6(1)(c)).

Optional website analytics

If you allow analytics, we use Google Analytics to understand visits to our public pages and improve the website. Google processes browser and device information, cookie identifiers, pages visited, interactions and approximate location. An IP address is used when receiving a request; Google states that Google Analytics 4 does not log or store individual IP addresses.

We use your consent for optional analytics (Article 6(1)(a) where the GDPR applies). Our site does not load Google Analytics before you agree. We do not run it on signed-in pages, pages with query parameters or error pages. We do not send Steam IDs, playtest keys or claim request IDs to Analytics. Page URLs exclude query strings and fragments, and referral information is limited to the referring site's origin.

Advertising consent remains off. Our website tag disables Google signals and advertising personalisation. We do not use this integration to target advertisements or combine analytics with your Steam account.

Automated processing

Key allocation is automatic: a verified account receives its existing key or an available key, if one remains. We do not use this flow to profile you or make decisions with legal or similarly significant effects.

3. Cookies and analytics

Cookies are small pieces of information stored by your browser. Essential cookies support the service you request and do not require optional analytics consent.

Essential cookies and saved choices

BashfulWolf.Auth

Keeps you signed in. It is a session cookie, removed on sign-out. The sign-in ticket is valid for eight hours and can renew while you use the site. Your browser's session-restore settings may preserve session cookies.

.AspNetCore.Antiforgery.*

Protects the sign-in and sign-out forms against forged requests. This is a browser-session cookie.

.AspNetCore.Correlation.*

Temporarily links a Steam sign-in response to the browser that started it. It is removed when the response is handled or expires after the sign-in timeout.

.AspNetCore.Mvc.CookieTempDataProvider

Temporarily carries a sign-in failure message to the next page. It is cleared after the message is read and otherwise lasts for the browser session.

bashfulwolf.consent (local storage)

Records your analytics choice, the notice version, and the time and expiry of that choice in this browser. Acceptance and rejection are both valid for 180 days. After expiry or a material change, we ask again. Local storage has no automatic browser expiry; our site stops relying on an expired record and replaces it when you make a new choice. You can delete it through your browser settings.

These cookies serve authentication, form security and sign-in status. We do not use them for advertising or visitor analytics. You can block or delete cookies in your browser, but doing so may prevent sign-in and key claims.

Our hosting platform may also use essential routing cookies to deliver requests to the appropriate server.

Optional Google Analytics cookies

_ga and _ga_HJL0TMBJ5Z

Help distinguish browsers and maintain session information for website statistics. Our tag limits their lifetime to the remaining part of your 180-day consent period and does not renew that period on visits. Browser restrictions can shorten their lifetime.

Choose Allow analytics or Reject optional cookies in the banner. Neither choice affects Steam sign-in or key claims. Ignoring the banner leaves analytics off. Without JavaScript, our optional analytics does not run.

You can change your choice using Cookie settings in the footer. Withdrawing consent stops future analytics collection and removes this site's Analytics cookies; the page may reload. It does not automatically erase data already received by Google or affect the lawfulness of earlier processing. Contact us about deletion requests.

Read how Google uses information from sites and apps that use its services and Google's privacy policy.

4. Who receives information

We use Microsoft Azure to host the website and store key-claim records, and Google to provide optional website analytics. These providers process information for the services they supply, subject to their applicable terms. Studio personnel may access information as needed to administer the playtest, answer requests and protect the service.

When you use Steam sign-in or redeem a key, you interact with Valve's Steam service, which processes information under its own privacy policy. Discord links take you to a separate service; this website does not embed Discord tracking widgets.

We may disclose information where required by law or where necessary to establish, exercise or defend legal claims. We do not sell your Steam ID or playtest claim records.

International transfers

Our studio operates in Singapore. Information may be processed in Singapore and in other countries where our service providers operate, including the United States. Those countries may have different data protection laws from your country.

Where applicable law requires safeguards for an international transfer, the relevant provider's data protection terms provide the contractual framework, including standard contractual clauses where applicable. Google also describes its participation in applicable Data Privacy Framework arrangements. See Google's data processing terms, Google's transfer safeguards and Microsoft's data protection addendum. Contact us for information about the safeguards relevant to your data or to request a copy.

5. How long we keep information

Steam ID and key-claim record

We keep your Steam ID and associated key-claim record during the playtest and for up to 30 days after the playtest ends, then delete the personal data in that record.

Request and error logs

We keep technical records for the period needed to diagnose faults, investigate abuse and protect the service. Retention depends on the incident or operational need and the hosting service's log rotation settings; records needed for an unresolved incident may be kept until that investigation or related claim is resolved.

Optional analytics

Browser cookies and consent choices have the lifetimes described above. Data already sent to Google is subject to the Analytics property's retention settings and deletion cycles. We use analytics to compare reporting periods and evaluate website changes; standard aggregated reports can remain available after individual event records expire. Contact us for the current retention settings or a deletion request. See Google's explanation of data retention.

Enquiries and privacy requests

We keep correspondence while handling the request and afterwards only as needed to record our response, resolve related disputes or meet legal obligations. The nature of the request and any applicable legal record-keeping period determine how long it is needed.

Backups

Deletion from active systems may precede expiry of backup copies. Backup retention follows the hosting provider's recovery and rotation settings. Copies retained for recovery are not used for ordinary operations; if restored, applicable deletion requests must be reapplied.

Signing out removes your sign-in cookie; it does not delete the key-claim record stored by the studio. We may retain information for longer where a specific legal obligation or legal claim requires it.

6. Your data protection rights

Where the GDPR applies, you can request access to your personal data, correction of inaccuracies, deletion or restriction of processing. Depending on the legal basis and circumstances, you may also have the right to receive your data in a portable format.

You can object to processing based on legitimate interests for reasons relating to your situation. We must stop unless we establish overriding compelling grounds or need the information for legal claims. Where processing relies on consent, you can withdraw it without affecting the lawfulness of earlier processing.

Use privacy@bashfulwolf.com to make a request. We may need proportionate information to verify your identity; do not send your Steam password. For GDPR requests we normally respond within one month. If a permitted extension is needed, we will explain why within that month. Requests are normally free.

You may complain to a supervisory authority, particularly in the EEA country where you live, work or believe an infringement occurred. The European Data Protection Board maintains a directory of supervisory authorities.

Depending on applicable law, visitors elsewhere may also have rights to access or correct their data and withdraw consent. In Singapore, you may contact the Personal Data Protection Commission; in the United Kingdom, the Information Commissioner's Office. Contact us first if you would like help with a concern.

7. Changes to this notice

We will update this notice when our practices change and show the revised date here. Where a new use requires consent, we will ask for it before that use begins.