Privacy Policy

The short version. The GORGED website sets no cookies, runs no analytics, and loads nothing from anyone else — the only record of your visit is a standard web-server log kept for 14 days. The game is playable here now, and you can play it without giving us anything at all: a run needs no account, no email and no name. Start a campaign and it keeps an email as your login, a public display name, and your progress. No ads, no tracking, no crash reports, no device profile. You can ask us to delete everything we hold about you at any time — here is how.

1. Who we are

GORGED is developed and operated by Beacon Light Investments ("we", "us"), which is the controller of the personal information described in this policy.

Contact: kyled@beaconlightinvestments.com, or the postal address on our contact page.

2. What this policy covers

This policy applies to:

the website at gorged.io, including the in-browser build; and
the GORGED game — the build playable at gorged.io/play/ today, and the mobile application for other platforms once released.

It does not cover anything a third party does on its own account — for example, the Apple App Store or Google Play, whose own privacy policies govern your relationship with them.

3. What the website collects today

This section describes the site as it is actually running right now, not as it might run later.

Server logs. Our web server records the IP address, the page or file requested, the time of the request, the HTTP status, the referring page and the browser user-agent string. These are used to operate the site and to investigate abuse and faults. They are rotated daily and deleted after 14 days.
Nothing else. The site sets no cookies. It runs no analytics, advertising, tracking pixels, session recording, or fingerprinting. It loads no fonts, scripts, or images from any other domain, so no third party learns that you visited. There is no contact form, so nothing you type on this site is transmitted anywhere.
The in-browser build runs the game locally, and a run on its own sends us nothing. The simulation runs in your browser; playing needs no account, no email and no name. It does store things once you start a campaign or play online — see section 4, which describes them and is the section this bullet used to contradict by claiming the build "stores nothing about you".
If you email us, we obviously hold that email — your address, your message, and our reply — so that we can answer you.

4. What the game collects

The game is live and playable in your browser. This section describes what it actually collects today — not what it may one day be capable of. Where something is not collected yet, it says so rather than describing it in the present tense.

You can play without giving us anything. Starting a run needs no account, no email and no name. Everything in the first list below happens only if you choose to start a campaign, which is the part of the game that keeps a career and a place on the board across devices.

Information you give us

An email address, if you start a campaign. It is your login — the thing that lets a career follow you to another browser or another device. It is never shown to other players.
A display name, if you set one. This is public: it is what the board shows. We store a four-digit tag alongside it so two players can choose the same name without becoming the same player.
Support correspondence. Anything you send us when you contact support.

Information collected automatically

A device token. A random identifier the game generates on your device the first time it runs, and sends when it connects. It is not derived from anything about you or your hardware, and it is what an account hangs on before you have given us an email.
Gameplay data tied to that account. Which cells of each country you have explored, and a record per finished run: whether you won, how long it lasted, and the length you reached.
Connection data. IP address and connection timestamps, used to run the service and to detect abuse. An IP address is approximate location data; we do not collect GPS or precise device location, and the game does not ask your device for either.

Not collected today, and previously described here as though it were. An earlier version of this policy listed device model, operating system version, performance figures, crash reports, purchase records and advertising identifiers as things the app would collect on release. None of them are collected: the game sends no crash reports and no device or diagnostic profile, there is nothing to buy, and there is no advertising of any kind. If that changes, this policy changes first — see section 14.

We do not collect your contacts, your photos, your calendar, your precise location, your microphone or camera, or your activity in other apps.

5. Why we use it, and on what legal basis

To run it Providing the game, matchmaking, saving your progress, and delivering purchases. Basis: performance of our contract with you.

To fix it Diagnosing crashes, measuring performance, and improving balance and design. Basis: legitimate interests in a working product.

To protect it Detecting cheating, abuse, fraud and attacks, and enforcing our Terms. Basis: legitimate interests in a fair and secure service.

To support you Answering your emails. Basis: legitimate interests, or performance of our contract.

Advertising Showing ads and measuring them, where enabled. Basis: your consent.

Legal Keeping tax and transaction records, and responding to lawful requests. Basis: compliance with a legal obligation.

6. Advertising and tracking

The website carries no advertising and no tracking of any kind, and neither does the game as it stands today — there is no ad code in it and no advertising identifier is read. The mobile app is planned to include advertising as part of how it is funded, and the rest of this section describes how that will work if and when it does.

On iOS and iPadOS, we will ask for your permission through Apple's App Tracking Transparency prompt before any tracking across apps or websites owned by other companies. If you decline, we will not track you, and the game will still work — you may simply see less relevant ads. You can change your answer at any time in Settings → Privacy & Security → Tracking.
On Android, you can reset or delete your advertising ID in Settings → Google → Ads.
We do not sell your personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined under California law. If that ever changes, this policy will say so plainly and you will be given a way to opt out before it takes effect.

7. Children

GORGED is intended for players aged 13 and over. It is not directed at children under 13, and it is not distributed in the Apple Kids Category or the Google Play Designed for Families programme.

We do not knowingly collect personal information from anyone under 13. If we learn that we have, we will delete the account and the associated data promptly. If you are a parent or guardian and believe your child has given us information, email kyled@beaconlightinvestments.com and we will act on it.

8. Who we share it with

We do not sell your personal information and we do not trade it. We share it only in these situations:

Service providers who run parts of the service on our behalf under contract — hosting, crash reporting, and (when enabled) the advertising network. They may use it only to provide that service to us.
App stores. Apple and Google process purchases and provide subscription and receipt data. Their handling of your information is governed by their own policies.
Other players see only your display name and your in-game performance. Nothing else about you is visible to them.
Legal requests — where we are required by law, or where it is necessary to protect our rights, our players, or someone's safety.
A business transfer. If the game or the company changes hands, data may transfer with it. You will be told before that happens and this policy will continue to apply until you are given notice of a new one.

9. How long we keep it

Web logs 14 days, then deleted automatically.

Account data For as long as your account exists. Accounts inactive for 24 months may be deleted, after an email warning.

Support email Up to 24 months after the conversation ends.

Crash reports None are collected, so none are kept. If that changes, up to 12 months.

Purchase records There is nothing to buy, so there are none. If that changes: as long as tax and accounting law requires, typically 7 years, and it would survive account deletion — see below.

10. Delete my data

You can have your GORGED data deleted at any time, for any reason, without giving one. It is free and we will not try to talk you out of it.

Option A — in the game

Open the settings wheel and choose DELETE MY ACCOUNT AND DATA. It opens a screen that says exactly what goes and what stays; pressing the button there erases your account and everything attached to it, on our server and on your device, without emailing anyone.

What it erases: your account, your email address, your display name, your campaign career, and your exploration for every country. What it leaves: your theme, language, text size and sound preferences. Those say nothing about who you are, they are not on any server, and resetting them as a side effect of a privacy choice would be a surprise rather than a service.

If the server cannot be reached at that moment, the game erases everything on your device and tells you it could not confirm the server half, rather than claiming a deletion it cannot vouch for. Use Option B if that happens and we will finish it.

Option B — by email

Email kyled@beaconlightinvestments.com with the subject line "Delete my GORGED data" and include:

the email address or display name on the account, and
enough for us to be confident it is yours — sending the request from the account's own email address is normally sufficient.

We ask for verification for your protection: without it, anyone could delete anyone's account by knowing their display name.

What happens then

We acknowledge your request, normally within two business days.
We verify that the request is yours. If we cannot, we will tell you what else we need rather than silently dropping it.
We delete the data and confirm it in writing. This is completed within 30 days of verification, and usually within a few days.

What gets deleted

Your account, email address and display name.
All gameplay progress, statistics and exploration data tied to it.
Your entries on any leaderboards.
Diagnostic and crash data linked to your account or device.
Your support correspondence, on request.

What we cannot delete, and why

We would rather say this here than surprise you with it after the fact.

Purchase and tax records. Where you have bought something, financial law requires us to keep a record of the transaction. We keep the minimum — that a purchase happened, of what, when, for how much — and unlink it from your deleted account.
Records of serious abuse. Where an account was banned for cheating, fraud, or harming other players, we retain a minimal record so the ban cannot be evaded by deleting and re-registering.
Backups. Deleted data may persist in encrypted backups for up to 90 days before those backups age out. It is not restored to the live service, and it is not used for anything in the meantime.
Anonymous aggregates. Statistics that can no longer be connected to you or any individual — for example "the average run lasts four minutes" — are not personal information and are not deleted.
Anything held by Apple or Google. Your purchase history with the App Store or Google Play belongs to your relationship with them, not with us. We cannot delete it, and you should contact them directly.

Deleting data on your own device

The app: deleting the app removes everything it stored locally on that device. It does not, by itself, delete anything on our servers — use Option A or B for that.
The browser build: it stores what section 4 describes — the device token, and your email, display name and progress once a campaign creates them — in your browser's own storage for this site. Option A erases that along with the server side. Clearing site data for gorged.io in your browser settings also clears it, along with the downloaded game files, but it does not reach our server: use Option A or B for that.

11. Your rights

Depending on where you live, you may have some or all of the following rights. We apply them to everyone who asks, wherever they are, rather than checking your jurisdiction first.

Access — a copy of the personal information we hold about you.
Correction — fixing anything inaccurate.
Deletion — see section 10.
Portability — your data in a machine-readable format.
Objection and restriction — to processing based on legitimate interests.
Withdrawing consent — at any time, where processing relies on consent, without affecting what was done before you withdrew it.
Opt out of sale or sharing — which is already the case, because we do neither.
Non-discrimination — exercising any of these will never degrade your game, your purchases, or your access.

To exercise any of them, email kyled@beaconlightinvestments.com. You may use an authorised agent. If we refuse a request we will tell you why and how to appeal it.

If you are in the EU, the UK, or another region with a data protection authority, you also have the right to complain to that authority. We would appreciate the chance to resolve it first.

12. Where your data goes

We operate from the United States, and information we hold is processed there. If you are outside the United States, using GORGED involves transferring your information across borders. Where we transfer personal information out of the EEA or the UK, we rely on the European Commission's Standard Contractual Clauses or another lawful transfer mechanism.

13. Security

Traffic to this site and to the game service is encrypted in transit with TLS. Access to production data is limited to people who need it. We never receive or store payment card numbers.

No system is perfectly secure, and we will not claim otherwise. If a breach affects your personal information, we will notify you and the relevant authorities as the law requires.

14. Changes to this policy

When this policy changes, the effective date at the top changes with it. If a change materially affects what we collect or what we do with it — in particular if the mobile app ever begins collecting anything section 4 currently says it does not, such as crash reports or an advertising identifier — we will give notice in the app or by email before the change takes effect, not after.

31 August 2026. Section 4 was rewritten from what the game would collect to what it does. In doing so it got narrower, not wider: crash reports, device and diagnostic profiles, purchase records and advertising identifiers were all described as forthcoming and are none of them collected. Section 10's in-app deletion route was corrected — it was written as arriving with accounts, accounts arrived, and it did not.

15. Contact

kyled@beaconlightinvestments.com · Beacon Light Investments · see the contact page for postal details.