プライバシーポリシー

Bloodstonk ("Bloodstonk", "we", "us") is a free fantasy-bloodstock game. This policy explains what personal data we collect when you use bloodstonk.com, why we collect it, who processes it on our behalf, and the rights you have over it. We collect only what we need to run your account and your stable, and we never sell your personal data.

Who can use Bloodstonk

Bloodstonk is intended for adults. You must be at least 18 years old to create an account or use the service. We do not knowingly collect personal data from anyone under 18; if you believe a minor has given us their data, contact us and we will delete it.

What we collect

We collect only the data needed to run your account and the game:

• Email address — used as your sign-in identifier and to contact you about your account (for example, verification and password-reset codes).
• Display username — shown in the game and on leaderboards.
• Password — created and stored only in hashed form by our authentication provider. We never see or store your plaintext password.
• Preferences — your preferred language and currency.
• Gameplay data — the horses and lots you draft and the stable you build.
• Approximate location— a country derived from your IP address, used only to suggest a default display currency and to determine which cookie-consent rules apply where you are (see "Cookies and local storage" below). We look this up against an offline database (DB-IP) held within our own infrastructure; we do not store your IP address for these purposes or share it with any geolocation provider.

Where you have allowed the Analytics cookie category (see "Cookies and local storage" below), we also collect usage data via Google Analytics — the pages you visit, how you arrived, and your device and browser type — to understand how the site is used and improve it. We do not use advertising networks or behavioral tracking, we do not build advertising profiles about you, and we will not set any analytics or marketing cookies without your prior consent where consent is required, or against your expressed choice anywhere.

How we use your data

• To create and secure your account and sign you in.
• To operate the game — recording your picks, scoring your stable, and showing leaderboards.
• To send transactional email such as sign-up verification and password-reset codes.
• To show the interface in your chosen language and currency, and to suggest a sensible default currency from your approximate country.
• To keep the service secure, prevent abuse, and comply with our legal obligations.

Our legal bases (under the UK/EU GDPR) are: performance of our contract with you (running your account and the game), our legitimate interests (keeping the service secure and functional), your consent where it applies, and compliance with legal obligations.

Who processes your data

The data controller is responsible for the personal data described in this policy.

We rely on a third-party cloud infrastructure provider to run Bloodstonk. Acting only on our instructions and under a data-processing agreement, it provides:

• authentication and password storage;
• the application database;
• transactional email (such as verification and password-reset codes);
• application hosting and compute.

Its infrastructure for Bloodstonk is located in the United States.

If you have allowed the Analytics cookie category, Google LLC processes usage data on our behalf as our analytics provider (Google Analytics), under Google's data-processing terms. You can withdraw that consent at any time via "Your Privacy Choices" in the page footer, after which no further usage data is sent to Google.

We do not sell or rent your personal data. We may disclose it if required to comply with the law, enforce our terms, or protect the rights and safety of our users or others.

Cookies and local storage

Today we use only strictly necessary (functional) cookies and browser storage: an authentication session token that keeps you signed in, a preference flag that remembers your chosen language, and a first-party cookie (bs-cookie-consent) that records your cookie choices themselves. These are required for the site to work and need no consent. If you allow the Analytics category, we additionally set Google Analytics cookies (_ga and _ga_…), which distinguish visitors so we can measure how the site is used; they are never set without your consent where consent is required, and we remove them if you withdraw it. We set no advertising or marketing cookies.

Whether we ask for your consent up front follows where you are, in line with established practice. If you visit from the EU/EEA, the UK, or Switzerland — judged from your approximate country, and assumed whenever we cannot determine it — a cookie banner on your first visit lets you accept all cookies, reject everything non-essential, or customize your choice per category (Necessary, Analytics, Marketing), and no analytics or marketing cookie will ever be set unless you have opted in. Everywhere else we follow the opt-out model: no banner is shown, the non-essential categories are allowed by default, and you can switch any of them off at any time. Wherever you are, a choice you save is kept in the bs-cookie-consentcookie for up to 12 months, after which we ask again; we also ask again if our cookie practices materially change. If you save a choice while signed in, we additionally keep a dated record of it with your account so we can demonstrate your consent; that record is included in your data download. You can review or change your choice at any time via the "Your Privacy Choices" link in the page footer or from your profile — withdrawing consent is as easy as giving it.

We honor the Global Privacy Control(GPC) browser signal: we treat it as an objection to the sale or sharing of your personal data, so the Marketing category stays off unless you explicitly enable it. The "Your Privacy Choices" footer link is also our CCPA/CPRA opt-out surface for California residents. (We do not sell or share your personal data in any case.)

International data transfers

Your data is stored and processed in the United States. If you access Bloodstonk from the EU/EEA or the UK, your data is transferred to the United States. For those transfers we rely on Standard Contractual Clauses and, where applicable, our providers' certifications under the EU-US Data Privacy Framework (and its UK extension) as the transfer safeguards.

How long we keep your data

We keep your account data for as long as your account exists. If you delete your account, we delete the associated personal data. We may also remove accounts that are created but never confirmed.

Your rights

If you are in the EU/EEA or the UK, you have the following rights over your personal data:

• Access — obtain a copy of the personal data we hold about you.
• Rectification — correct inaccurate data. You can update your profile details in the app.
• Erasure — delete your account and associated data. Account deletion is available in your profile, or you can email us to request it.
• Portability — download a copy of your data in a portable format (JSON) from your profile.
• Restriction and objection — restrict or object to certain processing.
• Withdraw consent— where we rely on your consent, you can withdraw it at any time. For cookies, use "Your Privacy Choices" in the page footer.
• Complain — lodge a complaint with your local data protection supervisory authority.

You can delete your account and download your data yourself from your profile. For any other request, email support@bloodstonk.com and we will action it.

Changes to this policy

We may update this policy from time to time. When we do, we will revise the "last updated" date above and, for material changes, ask you to review and re-accept the updated policy the next time you use Bloodstonk.

Contact us

Bloodstonk
Email: support@bloodstonk.com