This Privacy Policy explains how Xylora Studios ("we", "us", "our"), the developer and publisher of Wickharbour, collects, uses, discloses and protects information when you play Wickharbour on any supported platform (Windows, macOS, Linux and Android), visit wickharbour.xylorastudios.com, or contact our support team (together, the "Services"). By using the Services you acknowledge this Policy.
1. Information We Collect
1.1 Information you provide
- Support correspondence: your email address, name if provided, the content of your message, screenshots, logs and any attachments you choose to send.
- Account or profile data: if the game offers optional online features, a display name and associated settings you choose.
- Feedback and surveys: responses you voluntarily submit.
1.2 Information collected automatically
- Device information: device model, operating system and version, hardware specifications (CPU, GPU, memory), screen resolution, language and region settings.
- Device identifiers: a randomly generated installation identifier created by the game, and on Android, where permitted, the Android Advertising ID or App Set ID. We do not collect IMEI, serial numbers, MAC addresses or phone numbers.
- Gameplay and usage data: session start and end times, progress milestones, settings changes, performance metrics such as frame rate and load times, and feature usage.
- Diagnostics: crash reports, error logs and stack traces needed to fix defects.
- Network data: IP address, used transiently to derive approximate country or region and to protect the Services from abuse. We do not collect precise geolocation.
1.3 Website data
Our website is served through a content delivery network that processes request metadata (IP address, user agent, requested URL and timestamps) for security, performance and abuse prevention. The website does not use advertising cookies. Any analytics we use on the website are privacy focused and do not build cross-site profiles.
2. How We Use Information
- To provide, operate, maintain and update the game and its features.
- To diagnose crashes, fix bugs and improve stability and performance across devices.
- To understand aggregate player behaviour and balance gameplay, using analytics.
- To respond to support requests and problem reports.
- To detect, investigate and prevent fraud, cheating, security incidents and violations of our Terms of Service.
- To comply with legal obligations and enforce our rights.
3. Legal Bases for Processing (EEA, UK and Switzerland)
- Performance of a contract: delivering the game you licensed and its features.
- Legitimate interests: crash diagnostics, security, fraud prevention and product improvement, balanced against your rights.
- Consent: optional analytics or advertising identifiers where required by law. You may withdraw consent at any time.
- Legal obligation: where we must retain or disclose information under applicable law.
4. Analytics and Third Party Services
We may use carefully selected service providers for crash reporting, analytics, cloud hosting, content delivery and email handling. These providers process data only on our instructions and under contractual confidentiality and data protection obligations. Platform storefronts (such as Google Play, Steam or other distributors) process purchase and account data under their own privacy policies, which we encourage you to review.
Where the game offers analytics settings, you can disable optional analytics from the in-game options menu.
5. How We Share Information
We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We share information only:
- With service providers acting on our behalf, as described above.
- When required by law, subpoena or other legal process, or to protect the rights, safety and property of players, the public or Xylora Studios.
- In connection with a merger, acquisition, financing or sale of assets, subject to this Policy's protections.
- In aggregated or de-identified form that cannot reasonably identify you.
6. Data Retention
We keep information only as long as necessary for the purposes above. Crash and diagnostic data is generally retained for up to 24 months. Support correspondence is retained for up to 36 months after the matter is closed. Aggregated analytics may be kept indefinitely because it does not identify you. We delete or anonymise data once it is no longer needed.
7. Data Security
We use administrative, technical and physical safeguards including encryption in transit, access controls and least privilege principles. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
8. International Transfers
Information may be processed in countries other than your own. Where we transfer personal data from the EEA, UK or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or equivalent mechanisms.
9. Your Rights
Depending on where you live, you may have the right to:
- Access the personal information we hold about you and receive a copy.
- Correct inaccurate or incomplete information.
- Delete your personal information.
- Restrict or object to certain processing, including processing based on legitimate interests.
- Data portability in a structured, machine readable format.
- Withdraw consent at any time, without affecting earlier lawful processing.
- Opt out of the sale or sharing of personal information (we do neither) and limit use of sensitive information (we do not collect it).
- Lodge a complaint with your local data protection authority.
California residents: under the CCPA as amended by the CPRA, you have the rights listed above and the right not to be discriminated against for exercising them. You may use an authorised agent. Other US states: residents of states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah and Texas) have comparable rights, including the right to appeal a denial of a request.
To exercise any right, contact us using the support address below. We will verify your request using information reasonably linked to your use of the Services and respond within the time required by law, typically 30 days (45 days under US state laws).
10. Device Identifier Controls
- Android: reset or delete your Advertising ID in Settings, then Google, then Ads.
- Desktop: the installation identifier is stored locally and is removed when you uninstall the game and delete its save data folder.
11. Children's Privacy
The Services are not directed to children under 13 (or the minimum age in your country, up to 16 in parts of the EEA). We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.
12. Do Not Track and Global Privacy Control
We honour Global Privacy Control signals where required by law. Because we do not sell or share personal information, no further action is needed to opt out.
13. Changes to This Policy
We may update this Policy from time to time. Material changes will be posted on this page with a revised date and, where appropriate, notified in game. Continued use after changes take effect means you accept the updated Policy.
14. Controller
Xylora Studios is the data controller for personal information processed under this Policy. Questions and requests can be sent to our support team using the verified contact below.