Privacy policy

Who is responsible

Severed Signal Studios Ab is the controller of the personal data described here. The studio is based in Åland, Finland.

• Controller: Severed Signal Studios Ab
• Business ID: 3668560-3
• Email: privacy@severedsignal.com

We follow the EU General Data Protection Regulation (GDPR) and the Finnish Data Protection Act (1050/2018). To report a security vulnerability, use the contacts in our security.txt instead.

When you visit the site

Cloudflare hosts severedsignal.com and delivers every page. It processes your IP address, the page you ask for, the time, and technical details your browser sends, such as its name and version. It uses them to send you the page and to block attacks.

• When Cloudflare’s firewall blocks a request, our Cloudflare dashboard shows that request, with its IP address, for a short time.
• The dashboard also shows us combined traffic figures, such as visits per country, which don’t identify anyone. We haven’t turned on Cloudflare Web Analytics or any request logging.

We rely on our legitimate interest in delivering the site and keeping it secure (GDPR article 6(1)(f)).

Everything the page needs, including its fonts, comes from severedsignal.com. Your browser contacts no other site until you follow a link.

Cookies and storage

The site sets no cookies and keeps nothing in your browser’s storage, such as its local storage. Your browser keeps cached copies of the site’s files, which it checks with the site before reusing them, and two connection settings: for a year, a rule to always use HTTPS for the site, as the security page describes, and for a day, a note that the site supports HTTP/3, a faster kind of connection.

The EU ePrivacy Directive (2002/58/EC) requires consent before a site stores or reads information on your device, unless that is needed to carry the pages to you or strictly necessary for a service you ask for. The HTTPS rule keeps your connection secure, and the cached files and the HTTP/3 note only help carry the pages to you. All three are the same for every visitor and hold nothing about you. The site stores and reads nothing else, so it asks for no consent and shows no cookie banner.

Each page also tells your browser to delete any cookies for severedsignal.com, such as ones a browser extension might add.

When you contact us

• Email. We receive your address, any name you give, your message and any files you attach, such as logs and saves. Our email is stored with Apple’s iCloud Mail.
• GitHub. When you open an issue or comment on one, what you post and attach is public. When you report a vulnerability through GitHub’s private reporting, only you and we can see it. Either way, GitHub processes your account details under its own privacy statement.
• Social media and Discord. When you message us or post on Bluesky, Discord, Facebook, Reddit or X, that platform processes your data under its own policy. We see what you send or post there, and use it to reply and to moderate our spaces.

We use your messages only to answer you and handle your request, relying on our legitimate interest in doing so. When you report a bug by email or on Discord, handling it includes describing the problem in our public issue tracker on GitHub, without your name or other personal details. When you use one of your rights below, we handle the request because the law requires us to (GDPR article 6(1)(c)).

Please don’t send us sensitive information, such as identity numbers or payment details.

Who else receives data

We share personal data only with the services that do work for us, and only so they can do it:

• Cloudflare hosts, delivers and protects the site.
• Apple stores our email.

When you choose to contact us through GitHub, Bluesky, Discord, Facebook, Reddit or X, that platform’s policy applies.

We may also disclose data when the law requires it. We don’t sell personal data, and we don’t share it for advertising.

Transfers outside the EU

Cloudflare and Apple are US-based groups, so your data may be processed outside the EU and the EEA. These transfers are covered by the EU–US Data Privacy Framework or by the EU’s Standard Contractual Clauses.

How long we keep data

• Cloudflare deletes the request data in our dashboard automatically, after a short period it sets. We don’t export or keep it.
• We keep emails and messages until your matter is closed, then delete them. We keep a security report until the issue is fixed and disclosed.

Your rights

You can ask us to:

• tell you whether we hold personal data about you, and give you a copy
• correct data that is wrong or incomplete
• delete your data
• limit how we use it while a question about it is settled
• stop using it, when we rely on our legitimate interest

Email privacy@severedsignal.com. We answer within one month, free of charge. We may ask for details to confirm that a request is yours.

If you think we handle your data wrongly, you can complain to the Office of the Data Protection Ombudsman in Finland, which supervises private organizations in Åland. You can also complain to the data protection authority where you live or work. We’d welcome the chance to put things right first.

If you live outside the EU

The rights and limits in this policy apply to everyone. We don’t sell personal information, share it for cross-context behavioral advertising, or use it to profile you. Nothing on this site tracks you, so Global Privacy Control and Do Not Track signals have nothing to turn off.

Children

This site isn’t directed at children. We don’t knowingly collect personal data from anyone under 13. If you think a child has sent us personal data, email us and we’ll delete it.

Security

The site uses HTTPS on every page and a strict Content Security Policy, and loads nothing from other sites. The security page describes the protections in full. If a breach puts your data at risk, we report it to the Data Protection Ombudsman within 72 hours, and tell you directly when the risk to you is high.

Games and stores

We publish our games through stores run by other companies:

• Steam, run by Valve
• itch.io, run by Itch Corp
• Epic Games Store, run by Epic Games
• GOG, run by GOG sp. z o.o.
• Microsoft Store, for Windows
• App Store, for macOS and iOS
• Google Play, for Android

When you buy, download or play a game through a store, that store collects your account, payment and usage data under its own privacy policy. Each store decides what it collects and how it uses it, and we have no control over that. The links above lead to each store’s policy.

Stores usually give us only combined figures, such as sales by country. If a store passes personal data to us, such as an email address you chose to share, this policy covers how we use it.

Unaccounted isn’t released yet. Before it is, we’ll add what the game itself processes.

Changes

When we change how we handle personal data, we update this page and the date at the top.