Privacy Policy — Thricebound

⚠️ UNREVIEWED DRAFT — DO NOT PUBLISH

This document has not been reviewed by a lawyer. It was drafted as a structured starting point, not as legal advice. It contains unfilled [PLACEHOLDERS]. §13 (Children and age) states the implemented policy, REVISED 2026-08-24 (TB-97): 13+, screened by a neutral birth-year question on the playtest interest form before any address is stored, with the answer discarded and only a "checked" timestamp kept. This replaces the 2026-07-22 "general-audience, no age collected" posture, which is preserved inside §13 for comparison. Residual questions still need legal confirmation. It must be reviewed by qualified counsel in the operating jurisdiction before it is published or relied on.

The data described in §4 was verified against the codebase on 2026-07-21 (and re-verified for the email-verification / password-reset / account-recovery additions on 2026-07-26, for the playtest interest list added on 2026-08-18, and for the age screen added on 2026-08-24). If the Game changes what it collects, this document is wrong until it is updated.

See docs/legal/README.md for the full list of placeholders and open decisions.

Effective date: [EFFECTIVE DATE] Last updated: [LAST UPDATED DATE]

1. Who we are

Thricebound ("the Game") is made and operated by [LEGAL ENTITY NAME], trading as No Crunch Games ("we", "us", "our"). For data protection purposes we are the controller of the personal data described here.

[IF APPLICABLE: EU/UK representative under GDPR Art. 27 / UK GDPR — name and address, or a note that no representative is appointed and why.]

[IF APPLICABLE: Data Protection Officer. A solo indie studio is very unlikely to need one — confirm and then delete this line.]

Note for the drafter: the No Crunch Games legal entity was registered around 2026-07-26 — fill [LEGAL ENTITY NAME] above with its exact registered legal name (including the entity type, e.g. "LLC"). The controller named here must match the legal person that actually operates the service.

2. The short version

We collect what we need to run a multiplayer game and nothing else.

What we use it for — all of it

There are exactly three purposes, and this is the whole list:

To run your account — sign you in, keep your progress, let you get back in if you lose your password.
To keep the Game working and fair — match you with other players, rank matches, run quests and seasons, rate-limit abuse, and handle reports and cheating.
To reply to you — answer your support or privacy email, and send the playtest emails you asked for.

We do not build a profile of you. Nothing you do in the Game is fed into an advertising or resale profile, and there is no analytics or advertising code in the client to build one with. We do not sell your data, we do not share it for advertising, and we do not use it to target ads anywhere.

The one place your activity changes what we send you is the closed playtest interest list, and we would rather name it than let the paragraph above quietly overstate itself: that list records whether you registered and whether you have played, and uses those two facts to decide whether to send you a one-off nudge and a one-off check-in. That is the entire extent of it — no scoring, no segmentation, no third party. It is described in full in §4.8 and §13, and it only exists if you filled in the form yourself. The Reply-To on those emails is a mailbox a person reads: reply and ask to be taken off, and we will remove the record by hand. (There is no automatic unsubscribe link — saying otherwise would describe software that does not exist.)

The age answer is checked and thrown away

Before the playtest interest form on our website will take your email address, it asks what year you were born (and, for one narrow group, which month). Neither answer is stored. The server checks it, decides, and discards the number in the same request. All that is written down is a timestamp meaning "a check was passed at this moment" — never the year, never the month, never a date of birth, and never an age. If the answer is under 13, nothing at all is written down: no record, no address, no log line, no email. See §13.

We do not:

sell your personal data, or share it for cross-context behavioural advertising;
show ads;
use third-party analytics, tracking pixels, or advertising SDKs — there are none in the Game;
use tracking or advertising cookies;
ask for your real name, phone number, postal address, or date of birth;
require an email address. Providing one is optional (see §4.1). If you add and verify one, it becomes your account-recovery route — we can email you a password reset. If you don't add one, that's fine, but it also means we cannot help you recover a lost account, since a verified email is the only way we could.

We do:

store a username and a hashed password so you can log in;
store your game progress so it is there next time;
log matches so ranking, quests, seasons, and balance work;
store a web push subscription if — and only if — you turn on notifications.

3. What this policy covers

This policy covers the Thricebound game client, its servers, and the No Crunch Games website. It does not cover other websites or services we link to, which have their own policies.

4. What we collect

We collect this directly from your use of the Game. We do not buy data about you from anyone.

4.1 Account

Data	Why we have it
Username (chosen by you)	Identifies your account and is shown to other players
Password, stored only as a bcrypt hash	Logging you in. We never store or see your plaintext password
Account ID (a random UUID)	Internal identifier that links your data together
Whether the account is provisional (a "Play Now" guest)	So guest accounts behave correctly and can be cleaned up
Account creation date	Account management and abuse handling
Email address — OPTIONAL, only if you choose to add one	Account recovery (email verification + password reset), and tying a future purchase/receipt to your account. You can verify it to enable recovery; it is never used to log in, and you can leave it blank.
Email verification & password-reset tokens (only if you use email verification or a password reset)	Single-use, time-limited codes we email you. Stored only as a hash, never in plaintext, and deleted as soon as they are used or expire.

We do not collect a real name, date of birth, phone number, or postal address. Email is optional — there is a blank-able "Email (optional)" field when you save/claim an account, and you can add or change it later in Settings. If you provide one you can verify it, which enables account recovery: you can then reset a forgotten password by email. A verified email is also where a future purchase receipt would be sent. If you email us for support, we of course then have your email address and whatever you tell us in that email.

4.2 Gameplay and progress

Match history: which matches you played, which board, which role (Heroes, Monsters, Gods), the other seats' names, whether a seat was computer-controlled, the game mode, the winner, start and end times, and the sequence of moves made in the match.
Wins, losses, and skill ratings (separate ranked, casual, and computer-opponent ratings).
TP (in-game currency) balance, earned-TP totals, and season totals.
Owned characters, character upgrades, character shards, cosmetics and which are equipped, boosters and other consumables.
Quest, milestone, and training-track progress, campaign boards completed, and unclaimed rewards.
Whether you have unlocked the custom-board feature.

4.3 Social

Your friends list and pending friend requests.
Your clan membership, clan role, and pending clan join requests.

4.4 Things you type

Custom boards you create, including their name and layout. Published boards are visible to other players. Custom boards are text and layout data only — the Game does not accept image, audio, or file uploads.
Bug reports you submit in the Game (free text, capped in length).
Abuse reports you submit about a custom board (free text, capped in length).

Please do not put personal information about yourself or anyone else into these free-text fields.

4.5 Push notifications (only if you opt in)

If you turn on notifications, your browser gives us a web push subscription: a push endpoint URL issued by your browser vendor's push service, plus the encryption keys needed to send you a notification. We also store your notification preferences. If you turn notifications off, or your browser tells us the subscription is dead, we delete it.

4.6 Technical data

Authentication token (JWT). When you log in we issue a signed token which your browser stores and sends back with each request to prove who you are.
IP address. Our servers see your IP address, as every internet service does. We use it in memory only, to rate-limit login attempts and report submissions so the Game cannot be spammed or brute-forced. It is not written to our database and not linked to your account. [VERIFY BEFORE PUBLISHING: the hosting provider chosen in TB-9 will keep its own access and request logs containing IP addresses. Name the provider and its log retention period here once it is chosen.]
Server error logs. Ordinary operational logs. [Confirm log retention with the hosting provider and state it here.]

4.7 Payments

NO PAYMENTS ARE CURRENTLY TAKEN. The Game is free during the playtest. This section applies from the point real-money purchases go live.

DECISION PENDING — payment processor. When purchases go live, payment will be handled by a third party and we will never receive or store your card number. The two options have different privacy consequences and this section must be rewritten to match whichever is chosen:

Option A — Paddle (merchant of record). Paddle is the seller of record and an independent controller of your billing data. It collects your payment details, billing address, and tax location, and applies its own privacy policy. We would receive only a confirmation that a specific purchase succeeded, so it can be credited to your account.
Option B — Stripe (payment processor). We are the seller and Stripe processes payments for us. We would receive and hold more of the transaction record ourselves, including purchase history and whatever billing details are needed for tax and accounting.

In either case we will keep a record of what you bought and when, because we have to — see §9.

4.8 Playtest interest list (marketing site)

The marketing site's "Want to playtest Thricebound?" form creates a standalone record that starts out separate from account data — it exists before you have an account, and the address you give it is never required to match the one (if any) you later add to an account. If you go on to register through the invite link, that record becomes linked to your account (see below), so it is no longer fully separate at that point.

Data	Why we have it
Email address	Sending you the confirmation, playtest code and invite link you asked for, and the follow-up messages below
Confirmation token	A single unguessable link, so only whoever controls that inbox can confirm the address or redeem the invite
Which account (if any) you registered with the invite link	Recognising your account, so we know whether it has played (for the check-in below) and so this record can be found and deleted on request
Submission, confirmation, registration and first-play timestamps	Running the double opt-in described in §13, timing the follow-up messages below, and the retention schedule in §9
When we last sent you a confirmation email	Collapsing repeated form submissions so we do not resend the confirmation faster than roughly once every 15 minutes, and counting as a sign of life for the 30-day retention rule in §9
Which of the follow-up messages (a 3-day nudge, a 7-day check-in) have been sent to you	Not sending the same message twice
When you told us you'd given feedback (if you replied and we noted it)	Stopping the automatic follow-ups once we know you're already in touch, and counting as a sign of life for the retention rules in §9
When you passed the age check — the fact and the moment, never the birth year or month you gave	Recording that the 13+ screen in §13 was actually run for this record. The year and month are checked and discarded; they are not written down anywhere

Purpose: running the closed playtest and asking people who signed up for it for feedback. See §13 for how the messaging itself works, and §9 for how long these records are kept.

5. What we do not collect

To be explicit, because a lot of games do collect these and we do not:

No advertising identifiers, no device fingerprinting, no cross-app or cross-site tracking.
No contacts, location, camera, microphone, or photo access.
No voice or text chat logs — the Game has no free-form chat. Communication between players in a match is limited to preset quick-chat intents.
No biometric data. No data about your health, beliefs, politics, or any other special category.
No date of birth, and no age. The playtest interest form asks a birth year (and, for one cohort, a month) purely to run the 13+ check in §13 — the answer is evaluated and thrown away the same instant. All that survives is a note that the check was passed. See §4.8 and §13.

6. Why we use your data, and our legal basis

For players in the EU, UK, and other places with similar law, these are our lawful bases under GDPR Art. 6:

What we do	Why	Legal basis
Create and run your account; save your progress; match you with other players; run ranking, quests, and seasons	We cannot provide the Game without it	Performance of a contract (Art. 6(1)(b))
Verify your email, reset your password, recover your account (only if you add an email)	Keeping your account accessible and secure	Performance of a contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f))
Log matches and moves	Ranking and rewards must be verifiable; also used in aggregate to balance the game	Contract; legitimate interests (Art. 6(1)(f))
Rate limiting, abuse and cheat handling, moderating reported content, keeping the service secure	Protecting players and the service	Legitimate interests (Art. 6(1)(f))
Send push notifications	You asked us to	Consent (Art. 6(1)(a)) — withdraw any time by turning notifications off
Process purchases; keep tax and accounting records	Completing your purchase; complying with tax law	Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c))
Respond to your support email	Answering you	Legitimate interests (Art. 6(1)(f))

We do not use your data for automated decision-making that produces legal or similarly significant effects. Matchmaking and skill rating are automated, but they only decide who you play against.

7. Storage on your device

The Game does not use tracking or advertising cookies. It uses your browser's local storage for:

your login token and basic account details, so you stay logged in;
your settings (such as sound, theme, and accessibility options);
local caches of game state so the interface loads quickly.

These are necessary for the Game to function. Clearing your browser storage logs you out.

[VERIFY BEFORE PUBLISHING: if the marketing website at nocrunchgames.com ever adds analytics, a cookie banner and a cookie section become necessary. As of this draft, the site is a single static page with no scripts, no cookies, and no external requests.]

8. Who we share data with

We do not sell your data and we do not share it for advertising. We share it only with the service providers we need to run the Game, and only for that purpose:

Who	What they get	Why
`[HOSTING PROVIDER]` (application hosting and database)	Everything stored by the Game, because they host it	Running the servers and database
Your browser vendor's push service (for example Google, Mozilla, or Apple, depending on your browser)	The push endpoint and the encrypted notification payload	Delivering a notification you asked for
`[TRANSACTIONAL EMAIL PROVIDER — Resend, once email sending is enabled]`	Your email address and the account-verification, password-reset, or playtest confirmation/code/follow-up email we send you	Delivering verification, password-reset, and playtest interest-list emails. Not active until email sending is turned on.
`[PAYMENT PROCESSOR — Paddle or Stripe, undecided]`	Your payment details, which go to them and not to us	Taking payment
Other players	Your username, in-match actions, ranking, clan, and any custom board you publish	It is a multiplayer game

We may also disclose data if we are legally required to, or where it is necessary to establish or defend legal claims, or to protect someone's safety.

If the Game or the business is ever sold or transferred, your data may transfer with it. We would tell you before that happened, and the new operator would be bound by a policy at least as protective as this one.

9. How long we keep data — retention policy

This section exists partly because it is required. The 2025 amendments to the US COPPA Rule require operators to publicly post a written data retention policy and prohibit retaining personal data indefinitely. It is also required by GDPR Art. 5(1)(e) (storage limitation).

We do not keep personal data indefinitely. The table below is the retention schedule.

Data	How long we keep it	Then
Account and progress (active account)	For as long as the account is active	—
Account and progress (inactive account)	`[INACTIVE ACCOUNT PERIOD — recommend 24 months]` from your last login	Deleted
Guest ("Play Now") accounts that are never converted	`[GUEST ACCOUNT PERIOD — recommend 90 days]` from creation	Deleted
Match logs and per-move records	`[MATCH LOG PERIOD — recommend 12 months]`	Deleted or irreversibly aggregated into anonymous balance statistics
Bug reports and abuse reports	`[REPORT PERIOD — recommend 12 months, or until resolved plus 90 days]`	Deleted
Moderation and ban records	`[BAN RECORD PERIOD — recommend 24 months]`	Deleted
Push subscriptions	Until you turn notifications off, the subscription expires, or the account is deleted	Deleted immediately
Email verification & password-reset tokens	Single-use; expire automatically (verification ~24 hours, reset ~30 minutes)	Deleted on use or expiry
Purchase and tax records	The period required by tax law in `[COUNTRY]` — typically `[6–7 YEARS, CONFIRM]`	Deleted
Playtest interest record, never confirmed	30 days from the last sign of life on the record — submission, a resent confirmation email, or a logged reply, whichever is most recent	Deleted automatically
Playtest interest record, no activity	12 months from the most recent of: submission, confirmation, registration, first play, or feedback	Deleted automatically
Backups	`[BACKUP RETENTION — set by the hosting provider, e.g. 30 days]`	Overwritten on the normal backup cycle
Server and hosting access logs	`[LOG RETENTION — set by the hosting provider]`	Deleted

When you delete your account using Start Fresh in Settings, your account and its associated data are deleted from our live database. Two exceptions, which we are being explicit about:

Data we must keep by law — principally purchase and tax records — is retained for the period above and is not deleted on request.
Backups are not edited. Deleted data disappears from backups when those backups expire on the normal cycle above.

⚠️ IMPLEMENTATION GAP — MUST BE FIXED BEFORE PUBLISHING. As of 2026-07-21 the Game deletes accounts on request, but most of the automatic time-based deletions in this table are not yet implemented in code. The two playtest-interest-list rows above are the exception (added 2026-08-18): an hourly sweep purges records still unconfirmed 30 days after their last sign of life, and inactive records after 12 months, and an operator can delete an individual record on request from the admin dashboard. Every other automatic row in this table (inactive accounts, guest accounts, match logs, reports, ban records) is still aspirational. Publishing this table before those jobs exist would be a false statement. Either build the remaining retention jobs first, or publish a table that describes what the system actually does today. Do not publish an aspirational retention policy.

10. Your rights

Depending on where you live, you have some or all of these rights:

Access — get a copy of what we hold about you.
Portability — get it in a machine-readable format.
Correction — have inaccurate data fixed.
Deletion — have your data erased.
Restriction and objection — ask us to limit or stop certain processing, including processing based on legitimate interests.
Withdraw consent — for anything based on consent (push notifications), at any time, without affecting what happened before.
Complain — to your local data protection authority. In the EU that is your national DPA; in the UK it is the Information Commissioner's Office. We would appreciate the chance to fix things first at [email protected].

How to use them:

Access and portability: the Game has a built-in data export. It returns everything we hold for your account as a single JSON file, on request, immediately, for free. [Describe where the export button is in the UI — it is served by the authenticated /api/auth/export endpoint.]
Deletion: use Start Fresh in Settings. This deletes your account and its data, subject to the two exceptions in §9.
Anything else: email [email protected]. We aim to respond within 30 days.

California residents (CCPA/CPRA). You have the rights to know, delete, correct, and to non-discrimination for exercising them. We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is no "Do Not Sell or Share My Personal Information" mechanism to offer. We do not use or disclose sensitive personal information beyond what is needed to provide the Game. The categories we collect, and why, are set out in §4 and §6; the sources are you and your use of the Game.

[REVIEW: other US state privacy laws — Virginia, Colorado, Connecticut, Texas, and others — have similar requirements and their own thresholds. Confirm with counsel which apply at your scale.]

11. Where your data is held

Our servers and database are hosted by [HOSTING PROVIDER] in [REGION].

If you are in the EU or UK and your data is processed outside it, that transfer relies on [TRANSFER MECHANISM — e.g. Standard Contractual Clauses, or the EU-US Data Privacy Framework where the provider is certified]. [CONFIRM WITH COUNSEL once the host and region are chosen — this is a real obligation, not boilerplate.]

12. Security

Passwords are stored only as bcrypt hashes, never in plaintext, and are never included in a data export.
Logins use signed tokens; important actions are validated on the server rather than trusted from the game client.
Login attempts and report submissions are rate-limited.
Administrative endpoints require a separate admin credential.
[BEFORE PUBLISHING: state that all traffic is served over HTTPS. This is true only once the Game is deployed to a real host with TLS — it is not true of the current LAN playtest build.]

No system is perfectly secure. If you find a security problem, please tell us at [email protected] before disclosing it publicly.

13. Children and age

⚠️ Policy REVISED 2026-08-24, fully implemented 2026-08-29 (TB-97) — still needs legal review before launch.

2026-08-29: the screen described below now runs at account creation as well as on the interest form, and every account that predates it is asked once, in the Game, before it can carry on. Until that date the interest form was the only screen, and it covered account creation only indirectly — by being the sole route to an invite. It was never the only route (an operator can invite somebody directly, and that path deliberately screens nobody), and it would have stopped covering anything at all the moment the playtest opened up.

This section reverses the posture recorded here on 2026-07-22. That posture was "general-audience, collect no age": the reasoning was that COPPA's consent obligation for a general-audience service is triggered by actual knowledge that a user is under 13, so by never asking, we never acquire that knowledge. It is preserved at the end of this section, because the trade-off it describes is real and a lawyer will want to see both sides.

What changed the call: the marketing site's playtest interest form collects an email address, and an email address is personal information. The old posture meant a 12-year-old could hand us one and we would store it, mail it, and keep it, having never asked. The exposure was the ordering, not the messages sent afterwards. The screen described below fixes the ordering.

The cost of the change is acknowledged rather than hidden: an age screen means we now do learn, for refused submissions, that somebody said they were under 13. We hold nothing about them (no record, no address, no log line — see the policy and the verified list below) but the knowledge posture is genuinely different, and that is the thing counsel should look at.

Our policy, in plain language:

Thricebound is for players 13 and over.

You are asked what year you were born at two points, and only these two: before the marketing site's playtest interest form will accept your email address, and when you create an account. If your birth year cannot settle the question on its own — because you turn 13 at some point this year — you are asked which month, and nothing more. You are never asked for a day.

If you already had an account before this check existed, the Game asks you the same question once, the next time you open it, and does not let you carry on until you answer.

We do not store your birth year or month, at any of these points. They are checked and discarded. All that is kept is a note that a check was passed, and when. There is no date of birth here to be lost in a breach, handed to anyone, or deleted on request, because we never wrote one down.

If the answer is under 13, nothing at all is kept. On the interest form, no record is created, your email address is not stored, nothing is written to a log, and no email is sent — the submission simply does not happen. At account creation, no account is created. For an existing account, nothing is written down about the answer and the account cannot go on playing.

Notifications are entirely opt-in: they stay off until you choose to turn them on, and you can turn them off again at any time in Settings. If you never turn them on, we never send you any.

Email is a separate channel from push notifications, used only if you submit the playtest interest form yourself. It is double opt-in: submitting the form sends you a confirmation email (resubmitting the same still-unconfirmed address again shortly after does not send a second one, but resubmitting well after that does), and nothing else is ever sent unless you click the link in that confirmation. After that, you get the playtest code. If you go on to register with the invite link, you may later get a one-time nudge asking whether you've had a chance to play; if you also go on to play, you may later still get a one-time check-in asking how it's going. Neither follow-up is sent if you never register, and only the nudge is possible if you never play — and either is skipped once you've told us you gave feedback. The Reply-To on every playtest email is a real inbox we read, not an automated system — reply to ask to be removed (see below) or to give feedback, and a person will act on it.

If you are a parent or guardian and want your child's account and data deleted, write to [email protected] and we will delete it. The same goes for the playtest interest list: reply to any playtest email, or write to [email protected], and we will remove the address.

What the Game actually does (verified against the code 2026-08-24):

The marketing site's playtest interest form asks for a birth year before it will accept an address, and for a birth month only from the one cohort a year cannot resolve (people whose 13th birthday falls in the current year). No day is ever asked for.
The screen is neutral. It is labelled "What year were you born?" and nothing near it states the cutoff, hints at it, or offers a box to tick. The eligibility line that used to sit above that field was removed on 2026-08-24 for exactly this reason: a screen that shows you the right answer is not a screen. The 13+ requirement is stated here and in the Terms (§4) instead.
The check runs before anything is stored or sent. It is the first thing the route does, ahead of every path that touches the interest list.
Neither the year nor the month is stored. The record carries one field, ageCheckedAt — a timestamp meaning "a check was passed at this moment". There is no birth-year, birth-month or date-of-birth field in the store, and adding one is explicitly ruled out in the code.
A refusal persists nothing: no record, no address, no log line, no email.
It fails closed. A missing, malformed or implausible year is refused rather than waved through — including a submission from an old cached copy of the page that does not send a year at all.
It is decided on the server, from the server's own clock. A submitted "now", "age", or "ageOk" is ignored; the browser-side behaviour is convenience only, never the gate.
The operator's manual invite (an admin-only route) has no age screen and does not claim one — those records keep ageCheckedAt: null. It is the operator vouching for someone they know, and there is nobody at a keyboard to answer a prompt.
No age is asked anywhere else — not at account sign-up, not on first load, not in Settings. The Game holds no user's age.
Notifications, including re-engagement reminders, are strictly opt-in. The master notifications switch defaults to off; nothing is sent until the player turns it on (which also requires the browser's own notification permission), and each category (matches, invites, social, season reminders) has its own toggle. Enforced server-side.
A one-time, dismissible prompt offers to turn notifications on. "Not now" is the low-friction default and does nothing — it does not even trigger the browser's permission request.

The known imprecision, stated plainly: asking for a year and (at the boundary) a month, but not a day, leaves a window of at most about one month. Someone whose 13th birthday falls later in the current month is admitted a few days early. Collecting a full date of birth would close that window and is deliberately not done — it is more personal information about a child, permanently, to resolve a few days. If day precision is ever required, one function changes.

The superseded reasoning, kept for review: the posture until 2026-08-24 was that COPPA's consent obligation for a general-audience service (one not directed to children) is triggered by actual knowledge that a specific user is under 13, so by never asking, the Game never gained that knowledge and the obligation was never triggered. That reasoning is sound as far as it goes, and the trade-off it makes is real: an age screen means we do now learn that a particular submission claimed to be under 13. What it did not address is that the interest form was already collecting an email address from that person before anyone had asked anything — which is the collection COPPA is about.

Residual questions for counsel (do not remove until reviewed):

Confirm the Game is genuinely not "directed to children" under COPPA's multi-factor test (subject matter, visuals, audience, marketing). It is a mythology board-battler for a general audience with no child-targeted marketing. This classification decides how much the screen has to carry and should be lawyer-confirmed either way.
Confirm the screen's design is adequate: neutral presentation, year-plus-boundary-month rather than a full date of birth, no retry offered after a refusal, and nothing about the answer retained. Confirm in particular that discarding the year (rather than retaining it to enforce the refusal on a second attempt) is acceptable — a refused submitter can simply reload and answer differently, and we hold nothing that would stop them.
GDPR Art. 8 sets the age of consent for information-society services at 13–16 by member state. Confirm a flat 13 is acceptable across the EU, or whether any member state requires a higher line here.
Confirm the parental-deletion contact route and response process meet the amended Rule's parental access/deletion requirements.
Known gap: the screen stands on the playtest interest form, which is the only way into the closed playtest today. Account registration itself does not ask for an age. If registration ever opens without an invite, that route needs the same screen or the same analysis.

The Terms of Service (§4) and this section are consistent with each other and with the code as implemented. What remains is legal confirmation.

14. Changes to this policy

We may update this policy. If a change is material we will give notice in the Game before it takes effect, and we will always update the "Last updated" date above. Where the law requires your consent for a change, we will ask for it.

15. Contact

[LEGAL ENTITY NAME] (No Crunch Games) [BUSINESS ADDRESS] Privacy: [email protected] Security: [email protected]

Document version fd9c4dace095

Accepted-terms version 96cf6ec1ccc0

The version above identifies this exact text. It changes whenever the wording changes.