Privacy Policy

1. Controller and privacy contact

The controller responsible for the processing described in this policy is RooSystems, Schaller 62, 6553 See. The game and service name is AgeOfMe. For privacy questions, requests concerning your personal data, or complaints, email [email protected]. For technical and purchase-related support, email [email protected].

You can contact us without creating a new account or using a particular store. Please identify AgeOfMe in your message so that we can route your enquiry correctly.

2. Scope and differences between the website and game

This policy covers our promotional website, our handling of AgeOfMe game-service data, and communications with us. The data involved depends on whether you only browse the website, play locally, use an available online feature, make a platform purchase, or ask for support. Descriptions of an online feature apply only to versions in which that feature is enabled; they do not mean that every version collects every category listed below.

Steam, Google and Apple operate their own stores, accounts and payment systems. Their independent processing is governed by their own policies. This policy explains our handling of information received from those services; it does not replace their notices.

3. Website access and technical connection data

When you open the website, your browser sends the information necessary to establish a connection and return the requested page or asset. This can include your IP address, the requested address, date and time, response status, browser and operating-system information, and technical error information. The web server necessarily receives a connection IP address even though we do not use visitor analytics.

This information is used to deliver pages and downloads, investigate technical failures, and protect the service against misuse. Access and error logs, where enabled by the host, are operational records rather than advertising profiles. The website host is [To be confirmed before launch], and the configured hosting region is Europe. See the retention section for the information that must be retained and the criteria for deletion.

4. Cookies, tracking and advertising

The AgeOfMe promotional website does not set cookies, create tracking identifiers in browser storage, fingerprint visitors, or use advertising or third-party analytics scripts. Website images, fonts, styles and scripts are served locally. Store links are ordinary links rather than embedded store widgets. There is no advertising-profile or cross-site tracking functionality on this website.

Game storage used to keep progress and settings is different from website tracking and is explained below. Leaving our website for a store or another external service places you under that service’s own cookie and privacy practices. Our no-cookie statement does not describe how Steam, Google, Apple or their websites operate.

5. Local game data and device storage

The browser-based game stores information needed to retain your game on your device. This includes a locally generated account identifier, its creation time, savegame identifiers, game progress and settings. Browser storage such as localStorage, and application caches used for installed or offline operation, may be used for these functions. A local game identifier is not a statement of your real-world identity, but it is still treated as personal data if linked to an identifiable player.

Local storage is used to run and remember the game, rather than to follow you across websites. A locally stored identifier or save is not automatically sent to us merely because you visit the promotional website. You can remove local browser data through your browser’s site-data controls. Removing app data or uninstalling an app may remove local progress depending on the platform. Keep an export or backup if you want to preserve a local save; local deletion may not be reversible.

6. Online game records and platform identifiers

Where an enabled game feature uses online services, relevant records can include an internal account or record identifier, a linked platform identifier such as a Steam ID, account-linking information, and the game or entitlement records needed to provide that feature. An email address may be involved when you supply it for an available account function or contact us for support. We do not obtain your platform password to investigate a support case.

These identifiers allow us to locate the appropriate records, associate a request with the correct player, and resolve service or entitlement issues. A Steam ID, random account ID, hashed ID or other pseudonymous identifier is not automatically anonymous. Information stored only on your device remains separate unless an enabled online function sends it or you provide it in a support request. Contact us if you need clarification about the data associated with a specific game version or feature.

6.1 Google user data accessed through sign-in

AgeOfMe intends to offer Sign in with Google using the OpenID Connect scope openid and the email scope https://www.googleapis.com/auth/userinfo.email (also called userinfo.email or email). When you choose this sign-in method and authorise the requested access, Google provides the account identity information needed for authentication: a Google account identifier (the OpenID subject, or sub), your Google account email address, and the email-verification status where returned. Authentication responses also contain technical information needed to validate the sign-in, such as the token issuer, intended application, issue time and expiry time. We receive this information from Google, rather than asking for your Google password.

The email permission gives access to your account email address; it does not allow AgeOfMe to read, send or delete Gmail messages. The planned sign-in integration does not request the profile scope or permissions for Gmail, Google Drive, Calendar, Contacts, Photos or other Google content. Names and profile pictures are not needed for the sign-in purposes described here. Any future request for additional Google permissions would need its own explanation before access is requested.

Visiting the promotional website alone does not start Google sign-in or collect Google account identity information. Choosing Sign in with Google involves Google’s authentication service, whose own privacy policy and account controls also apply. Google sign-in permissions are separate from Google Play purchase processing.

6.2 How AgeOfMe uses Google user data

We use Google sign-in information to authenticate you, create or identify the corresponding AgeOfMe account, maintain the Google-to-AgeOfMe account association, and allow you to return to that account. The Google subject identifier is used to recognise the same Google account even if its email address changes. The email address and verification status help identify the account and handle account-related support or security enquiries. They are not permission to access your inbox.

Our use is limited to the sign-in, account and related security or support functions described here. We do not sell Google user data or use it for advertising, targeted marketing, cross-service profiling, gameplay analytics, credit decisions, or training general-purpose AI models. The separate possibility of analysing anonymous gameplay statistics does not authorise using Google account identifiers or email addresses for that purpose. We do not subscribe you to a newsletter because you sign in with Google.

Choosing to authorise Google sign-in allows Google to supply the requested identity information. Under the GDPR, processing necessary to provide the sign-in and account service you request relies on Article 6(1)(b); necessary and proportionate security handling relies on Article 6(1)(f). Where a separate optional use requires consent, it must be requested separately. Authorising the sign-in scopes is not blanket consent to unrelated processing. If you decline access, we cannot complete that Google sign-in, but you can still browse the website and contact support.

6.3 Sharing, storage and protection of Google user data

The recipients of Google sign-in data are RooSystems and Supabase, our backend service provider, together with the infrastructure subprocessors needed to operate the relevant authentication and account-storage services. Google operates the authentication service and supplies the authorised identity information. Where Supabase handles the authentication exchange, it processes that information on our behalf and associates the Google identity with the AgeOfMe account. The resulting account association and email address are stored in the AgeOfMe backend operated using Supabase. Its primary project region is Europe; the international-processing section also applies to Google user data.

We do not routinely send Google account identifiers or Google-supplied email addresses to Steam or Apple, advertisers, data brokers, or other players. If you contact support using that email address or provide Google account details in a support request, the relevant correspondence is also processed by our support email provider. Necessary disclosures may be made to comply with law or address a security incident or legal claim, subject to applicable law and Google’s data-use rules. We do not disclose Google user data for unrelated third-party purposes.

The planned Google sign-in flow uses HTTPS/TLS to protect information in transit and validates the authentication response before accepting a sign-in. Identity records and authentication material are to be restricted to the backend services and authorised personnel that need them for account operation, a relevant support case, security, or legal duties. They must not be published, put in URLs or public downloads, or included in routine support messages. We do not receive or store your Google password. This policy does not assert a security certification or a completed technical audit of the planned integration.

We comply with the Google API Services User Data Policy, including the Limited Use requirements where applicable. Google user data is used and transferred only for the disclosed purposes and permitted exceptions, with any required authorisation. Additional data-use restrictions applicable to Google-sourced information also apply to derived information; describing a result as aggregated or anonymous does not remove those restrictions.

• Google API Services User Data Policy
• Supabase subprocessors

6.4 Google data retention, revocation and deletion

We retain the Google account association, subject identifier, email address and related verification information while they are needed to provide your linked AgeOfMe account, or until an applicable deletion request requires their removal. Authentication tokens are needed only for the relevant verification or authentication-session purpose and their valid lifetime; this policy does not describe indefinite storage of raw Google tokens or background access to other Google services. Restricted security or legal records may remain where a specific retention obligation or justified exception applies, as explained in the general retention section.

You can review and revoke AgeOfMe’s Google access in your Google Account’s third-party connections settings. Revocation prevents further use of that authorisation and may stop future Google sign-ins; it does not itself erase information already lawfully stored in an AgeOfMe account or delete the Google account. Existing application sessions may require separate sign-out or termination. To request deletion of the stored Google account association, email address, and other associated AgeOfMe personal data, email [email protected] with the subject “AgeOfMe data deletion” and identify the affected account without sending a password or token.

The account and data-deletion process below applies equally to Google-sourced personal data and relevant copies processed by Supabase on our behalf. We will explain any legally required retention exception. Backup copies may persist until their applicable restricted backup cycle expires. Deleting or unlinking the Google association may prevent future access to the same AgeOfMe account through Google; it does not delete your Google account or request a store refund.

• Manage Google Account third-party connections
• Request deletion of AgeOfMe and Google sign-in data

7. Supabase backend services

We use Supabase to provide backend infrastructure for AgeOfMe online services. The records involved depend on the features enabled in the game and can include the identifiers and service records described above. Supabase processes application data on our behalf in its role as a service provider. Its infrastructure can also process connection, operational and security information necessary to run those services.

The configured primary Supabase project region is Europe. A primary database region is not a guarantee that all provider support, infrastructure, logging or subprocessor operations take place in that region. The promotional website does not make browser calls to the Supabase game database. See the sections on recipients and international processing for the distinction between regional storage and other processing operations.

8. Support communications and diagnostic information

When you contact [email protected], we receive your sender email address, the contents of your message, correspondence history, and any attachments or information you choose to provide. This may include a Steam ID or another platform identifier, an internal game ID, purchase reference, screenshots, an exported save, or diagnostic details such as your platform, game version and the error you encountered.

We use these records to understand the issue, verify that we are dealing with the right account holder where necessary, investigate relevant game or purchase records, respond to you, and document the resolution. Support access is intended to be limited to the people and records necessary for the case. Please share only information relevant to your request, redact unrelated information from screenshots, and never send passwords, full payment-card details or unrelated sensitive personal information.

9. Purchases, entitlements and payment data

Purchases are handled by Steam, Google Play or Apple, depending on the platform and distribution channel. The relevant store handles the checkout, payment method and payment authorisation under its own terms and privacy policy. The AgeOfMe website does not operate a checkout or collect payment-card or bank-account details.

To deliver purchased content or resolve an issue, we may receive or inspect information such as the product purchased, entitlement status, purchase or transaction reference, purchase time, and the associated platform account identifier. This is different from receiving your full payment details. Store purchase history and billing records held by the platform are controlled by that platform. A request to delete data held by RooSystems does not automatically delete those platform records or initiate a refund.

10. Anonymous statistics and game improvement

We may analyse genuinely anonymous, aggregated game statistics to understand broad patterns and improve balance, reliability and usability. Anonymous results must not allow a person to be reasonably identified, including by combining them with other available information. Such results are not used to build advertising profiles or follow an individual across services.

Google sign-in identifiers and email addresses are not used for gameplay analytics. The purpose limitations and applicable Google API data-use restrictions described in the Google sign-in sections remain in effect.

Removing a name, hashing a Steam ID, or attaching activity to a random persistent account ID does not itself anonymise the underlying data. Where personal data is involved in producing aggregate results, that underlying processing remains subject to this policy and an appropriate legal basis. This statement does not authorise undisclosed player-linked telemetry. There is no visitor-analytics implementation on the promotional website. If an optional analysis feature requires consent or an additional in-app disclosure, that choice or disclosure must be provided before the relevant collection begins.

11. Sources of information and required information

Information can originate from you directly, from the browser or device establishing a service connection, from game functions you use, or from a platform supplying the identifiers or purchase information needed for the relevant service. Information you submit in a message or attachment is provided by you, even if the attachment contains an exported game record.

You do not have to send us a support message, diagnostic attachment or purchase reference to browse the website. Some technical connection information is necessary to return a page or operate an online feature. If you do not provide the information needed to identify an affected account or purchase, we may be unable to investigate that particular issue. We will explain the information needed for a request rather than asking for unrelated personal data.

12. Purposes and lawful bases

Where the GDPR applies, we rely on Article 6(1)(b) for processing objectively necessary to perform an agreement with you or take steps you request before an agreement. This can include providing an agreed online game function, locating the relevant entitlement, and dealing with contractual support enquiries. A feature being convenient does not by itself make all associated data collection contractually necessary.

We rely on Article 6(1)(f) for necessary and proportionate operational security, fault investigation, general correspondence and the establishment or defence of legal claims, after balancing our interests against your rights. The interests concerned are running a reliable service, preventing misuse and addressing the requests we receive. You may object to processing based on legitimate interests as described below.

Article 6(1)(c) applies where a legal obligation requires particular records or disclosures. Where consent is required for an optional activity, Article 6(1)(a) applies and the choice must be obtained separately. You can withdraw consent for future processing without affecting the lawfulness of processing before withdrawal. Merely reading this policy is not consent to optional processing.

13. Recipients and disclosures

Information is accessible to RooSystems personnel who need it for the relevant task and to service providers needed to operate the service. Depending on the activity, recipients include the website host for web delivery and operational records; Supabase and its relevant subprocessors for game backend infrastructure; our email provider for support correspondence; and the relevant store when a purchase or platform-related request requires its involvement. Providers should receive only the information needed for their role and applicable processing instructions.

Steam, Google and Apple also act independently for their own platform accounts, payment processing and store operations. Information may be disclosed to competent authorities when legally required, or to professional advisers where necessary to address a legal obligation or claim. This policy does not describe a public player directory, publication of support messages, or an advertising-data marketplace. You can ask [email protected] about recipients relevant to your particular data.

14. International processing and safeguards

Service providers and their subprocessors may operate in more than one country. Even where the main website or database is hosted in Europe, remote support, infrastructure management or other provider operations can involve access from outside the European Economic Area. We therefore distinguish the configured hosting and database regions from the locations of every recipient and processing operation.

Where personal data is transferred outside the EEA, the transfer must be covered by an applicable adequacy decision or other lawful safeguards, such as the European Commission’s Standard Contractual Clauses, together with additional measures where required. The applicable mechanism depends on the recipient and transfer. Contact [email protected] to request information about the relevant safeguards and how to obtain a copy, subject to necessary redactions protecting confidential or third-party information.

15. Security and handling procedures

Our approach is to minimise the information needed for a task, restrict support access to relevant records, and avoid requesting platform passwords or full payment credentials. The website application does not contain a public database interface or a payment form. Website connection information is handled separately from game-service records and support correspondence. Providers’ own infrastructure security measures apply to the systems they operate.

Internet services and devices cannot be guaranteed completely secure. Use an encrypted HTTPS connection, protect your device and store account, and check attachments before sending them. If you suspect unauthorised access to your AgeOfMe-related data, contact [email protected] without sending credentials. Where a personal-data breach triggers a legal notification obligation, the applicable authority and affected individuals must be notified as required by law. No security certification, particular encryption-at-rest configuration or absolute security guarantee is claimed by this policy.

16. Retention periods and criteria

We determine retention separately for each purpose rather than keeping every category indefinitely. Local progress and settings remain on your device until you remove them or the browser or operating system clears them. Website access and error records are needed only for the relevant operational, fault-investigation or security purpose, subject to the host’s actual logging and backup configuration.

Online game records are retained while needed to provide the relevant feature or maintain an entitlement, unless a valid deletion request or another reason requires earlier removal. Support records are retained while the case is open and, where necessary, afterwards to handle follow-up questions, substantiate the resolution or address a specific dispute. Purchase references and legally required records may need to be retained for the applicable statutory period or the establishment or defence of a claim. These exceptions do not justify retaining unrelated data.

The configured retention details for the service are: [To be confirmed before launch]

When a purpose ends, the relevant personal data should be deleted or irreversibly anonymised unless a specific legal or legitimate retention ground remains. Truly anonymous aggregate results can be retained without an account association. A database region or deletion from an active record does not by itself establish when every provider backup expires.

17. Request deletion of an AgeOfMe account or data

To request deletion of personal data or an online AgeOfMe account held by RooSystems, email [email protected] with the subject “AgeOfMe data deletion”. You do not need to create a new account to make the request. Tell us which platform you use and provide an account or game identifier if you know it. If possible, write from an address already used for the affected account or support conversation. Do not send a password, payment credentials or an identity document unless a proportionate verification method has first been agreed.

You may request deletion of the account and associated personal data, or identify a particular support record or other category. We may ask only for the information reasonably needed to locate the records and verify that the request is authorised. The request covers data held by RooSystems and, where applicable, deletion instructions to its processors. An account being deactivated or frozen is not a substitute for deleting the associated data when deletion is required.

Information that must be kept to comply with a legal obligation or address a specific security matter or legal claim may be retained for that limited reason. Where an exception applies, we will explain the relevant categories and reason, subject to lawful restrictions. Data retained under an exception must not simply be reused for an unrelated purpose.

• Email an AgeOfMe data deletion request

18. What deletion does and does not remove

Deleting server-side information does not automatically erase a save or cached data that remains only on your own device. For local data, use your browser’s site-data controls or the device’s app-storage controls as appropriate. If you reinstall or reopen a game that creates a new local identifier, it may create a new local record; that does not restore a deleted online account by itself.

RooSystems cannot delete your Steam, Google or Apple account, the store’s own transaction history, or information independently retained by those platforms. Contact the platform for those requests. Removal of an app alone does not necessarily delete online data or cancel a platform subscription if one exists. A privacy deletion request is separate from a purchase refund request.

Deleted information may remain in restricted backup copies until the applicable backup cycle expires or the copy is overwritten, subject to legal requirements and provider capabilities. Where retained, backup information is for recovery or required retention rather than ordinary ongoing use. Information that has already been irreversibly anonymised cannot be linked back to your account in order to locate an individual contribution.

19. Access, correction, objection and other rights

Subject to the conditions and exceptions in applicable law, you can request confirmation of whether we process your personal data and access to that data; correction of inaccurate data; deletion; restriction of processing; and a portable copy of data where the right to portability applies. Portability generally concerns data you provided that is processed automatically on the basis of consent or a contract.

You can object, on grounds relating to your particular situation, to processing based on legitimate interests. Where we rely on consent, you can withdraw it for future processing. These rights are not all unconditional, and they do not require us to disclose another person’s data or retain extra identifying information solely to make anonymous statistics identifiable. We will explain any applicable limitation when responding.

Send requests to [email protected]. We will respond within the period required by applicable law. Under the GDPR this is normally within one month of receiving the request; where a permitted extension is needed because of complexity or the number of requests, we will inform you within that first month and explain why. Requests are generally free, subject to the legal rules concerning manifestly unfounded or excessive requests.

20. Children and young players

The age rating and account requirements displayed by your store apply to the relevant game version. An age rating is not itself consent to the processing of a child’s data. Where a feature relies on consent and local law requires authorisation from a parent or guardian, that authorisation must be obtained before the relevant processing begins.

Please do not send children’s personal information in a support message unless it is necessary to address the request. A parent or guardian who believes that a child has supplied personal data in circumstances that do not satisfy applicable requirements can contact [email protected] to ask us to investigate and, where required, delete it. We do not introduce a universal age threshold in this policy because applicable legal requirements and store rules can differ.

21. External platforms and privacy information

Following a link to a store, contacting a platform, or using its account and purchasing functions involves that platform’s services. The platform may collect information independently of RooSystems, including information not shared with us. Review its policy and account controls for details of its processing, privacy choices and deletion procedures. Provider notices explain their own roles; they do not replace our responsibility to explain AgeOfMe processing.

The links below provide further information about the principal services named in this policy. External providers may update their pages and policies over time.

• Supabase Privacy Policy
• Supabase Data Processing Addendum
• Supabase subprocessors
• Steam Privacy Policy
• Google Privacy Policy
• Apple Privacy Policy

22. Complaints and supervisory authorities

If you are concerned about the handling of your information, you can contact [email protected] so that we can investigate. You also have the right to lodge a complaint with a competent data-protection supervisory authority; you are not required to contact us first.

For the Austrian operator, the relevant authority includes the Austrian Data Protection Authority (dsb.gv.at). You may also complain to an authority in the EEA country of your habitual residence or place of work, or where you believe an infringement occurred. The authority’s website provides current contact details and instructions for submitting a complaint.

• Austrian Data Protection Authority

23. Changes to this policy

We update this policy when the service, its providers or the relevant processing changes. The date at the top identifies the latest revision. Material changes affecting an existing service will be communicated through an appropriate channel where required by law. A policy update does not by itself supply consent for a new optional purpose.

For questions about a particular version of this policy or the processing associated with a particular AgeOfMe feature, contact [email protected]. This policy should be read together with any relevant feature-specific notice and the Terms of Use, while recognising that a privacy notice is information about processing rather than a waiver of your rights.