Data controller
The controller is the owner of Silkworm 2047 (XMAS Software), with the identification details in the legal notice. Contact for any privacy matter: info@silkworm.xmassoftware.com.
We process your data under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD). No data protection officer is appointed.
Data we process
- Account: nickname, email address, language, sign-up date, date and version of the terms and policy you accepted, confirmation that you are at least 14, role, verification and sanction status, and failed sign-in attempts. For your password we only store an irreversible hash, never the password.
- Game: statistics (enemies by type, crushed with rocks or avalanches, mountains brought down, magma quenched, money, solo, co-op and public runs, favourite vehicle), achievements and best times with their level, difficulty, mode, vehicles and weather and time-of-day conditions.
- Social: friendships, requests, blocks, rooms, invitations and join requests, online status, chat messages between friends, quick messages and reports with their outcome.
- Co-op runs: so both games can connect directly, while the room is open the server keeps the public IP address and port of the host and hands them to the other player. When you play co-op, the other player can see your IP address.
- Android notifications: the device’s Firebase Cloud Messaging (FCM) token and your notification preferences per type and channel (game or mobile).
- Downloads: each download link you request (platform, version and date), to apply the daily quota.
- Security: sessions (we store fingerprints of the tokens and their expiry, not the tokens) and the administration log.
- IP address: used on each request to limit abuse, sent to Cloudflare Turnstile when validating forms and downloads, and present in the API’s technical logs, which are deleted after 48 hours.
We ask for no sensitive or payment data. Email addresses are stored encrypted in the database.
What others see: anyone, even without an account, can see your nickname, statistics, achievements and best times on your public profile and the leaderboard. Your friends also see your online status.
On your device, the game stores your settings, your encrypted session (never the password), your campaign and its technical logs, deleted after 48 hours. The website stores in your browser the theme you chose and a flag saying you signed in, with no account data (see the cookie policy).
Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Create and manage your account, verify your email and recover your password | Performance of the terms of use, art. 6(1)(b) |
| Online co-op, rooms, friends, chat, leaderboard, profiles, statistics and achievements | Performance of the terms of use, art. 6(1)(b) |
| Game downloads and updates | Performance of the terms of use, art. 6(1)(b) |
| Push notifications on Android | Consent, art. 6(1)(a) (the system notification permission and your preferences, which you can withdraw at any time) |
| Security, abuse prevention (Turnstile, per-IP and per-account limits), moderation and time validation | Legitimate interest, art. 6(1)(f) |
| Aggregated, cookieless visit analytics | Legitimate interest, art. 6(1)(f) |
| Complying with legal requests | Legal obligation, art. 6(1)(c), where applicable |
Email is only used to verify your account and recover your password: we send no newsletters, advertising or social notices by email. There is no commercial profiling and no automated decision-making with legal effects. We do not sell data.
Minimum age
You must be at least 14 to register, the age from which you can consent to the processing of your data under article 7 of Spanish Organic Law 3/2018 (LOPDGDD). Registration asks you to tick a box confirming it; it is your own declaration and we do not verify age with documents. If we learn that an account belongs to someone under 14, we will delete it.
Retention
| Data | Period |
|---|---|
| Account, profile, friendships, blocks, statistics, achievements and best times | While the account exists |
| Unverified accounts | 7 days from registration |
| Chat messages between friends | 12 months from each message, or until either account is deleted |
| Rooms, invitations and join requests (with the host’s IP and port) | Until they close; closed rooms are deleted after 7 days |
| FCM token | Until you sign out on the phone, turn notifications off or FCM invalidates it |
| Requested download links | 8 days |
| Sessions | Up to 1 day after they expire |
| Resolved reports | 180 days after resolution |
| Administration log | 1 year |
| Technical logs of the API and the game (including the IP in the API’s) | 48 hours |
| Database backups | Expire after 8 days at most |
| Rights requests and messages to info@ | Up to 3 months after they are resolved; a record without personal data (date, right and outcome), 3 years |
Deleting your account erases all your personal data. Your times disappear from the leaderboard and, in your partner’s co-op records, you appear as “Deleted player”. If a backup had to be restored, accounts deleted after it was made are deleted again.
Data processors
We do not share your data with third parties unless legally required. These providers process it on our behalf:
| Provider | Service | Location |
|---|---|---|
| Contabo GmbH | Server hosting for the API, the co-op meeting point, the database and local backups | European Union |
| Cloudflare, Inc. | Website and API hosting and network (CDN, DNS, firewall), R2 storage for downloads and backups, anti-abuse protection (Turnstile), cookieless analytics (Web Analytics) and contact email forwarding (Email Routing) | Global network; US company |
| Resend | Sending the verification and password recovery emails (receives your email, nickname and the link) | United States |
| Google (Firebase Cloud Messaging) | Delivering push notifications on Android (receives the device token and the notification text) | United States |
Messages you write to info@silkworm.xmassoftware.com go through Cloudflare’s forwarding and reach the owner’s mailbox, hosted with another email provider that processes them as part of its service.
International transfers
Cloudflare, Resend and Google may process data in the United States. These transfers rely on the EU-US Data Privacy Framework where the provider participates and, in any case, on the European Commission’s standard contractual clauses, with measures such as encryption in transit.
Your rights
Under the GDPR (articles 15 to 22) and Spanish Organic Law 3/2018 on Personal Data Protection and Digital Rights (LOPDGDD), you can exercise at any time and free of charge your rights of access, rectification, erasure, objection, restriction of processing and portability, and the right not to be subject to automated decisions (we make none). You can withdraw consent to push notifications whenever you want, without affecting earlier processing.
- From My account → My data: export all your data as a JSON file (access and portability), correct your nickname (rectification) or close your account by deleting it (erasure). Deletion is immediate and irreversible.
- From My account → Notifications or the game settings: turn push notifications off per type, or withdraw the notification permission on Android.
- By email, for any right (also without an account or if you cannot sign in): write to info@silkworm.xmassoftware.com with the subject “Data protection”, stating the right you exercise, your nickname and, if you can, writing from the account’s address. We reply within one month, free of charge; if the request is complex we may extend it by two months and will tell you within the first.
If you believe we have not handled your rights properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es, C/ Jorge Juan 6, 28001 Madrid).
How we handle your requests
- Identification: we check the message comes from the account’s email. If you cannot write from it, we will ask for something only you would know (for example, your nickname and approximate sign-up date). We never ask for identity documents.
- Access and portability: we send you the same JSON file you get from My data.
- Rectification: we correct your nickname or email and confirm it at the new address.
- Erasure: we delete the account with the same scope as the delete button.
- Objection and restriction: we suspend the account, keeping the data without using it, or delete it if you prefer.
- If we cannot do what you ask, we explain why and remind you that you can complain to the AEPD.
Security
We use encrypted (HTTPS) connections with the website and the API, strongly hashed passwords, emails encrypted in the database, the session in an HttpOnly cookie the website’s JavaScript cannot read, game sessions stored encrypted on your device, private backups with an expiry and role-based access control for administration.
Changes to this policy
If we change this policy we will show it here with a new date and, for relevant changes, on the website or in the game.
Contact: info@silkworm.xmassoftware.com