Privacy Policy

Last updated: September 29, 2026

1. Overview

This Privacy Policy explains how Panavia Interactive ("we," "us," "our") collects, uses, and protects information when you visit panaviainteractive.com (the "Site") and when you play Curse of the Hamlet (the "Game"). The Game's store listing carries its own short privacy summary, as the app stores require; this page is the full version.

By using the Site or the Game, you agree to the practices described here. If you don't agree, please don't use them.

2. Information We Collect

Information you give us

If you use the contact form, we collect the name, email address, reason for contact, and message you submit. We also store the IP address your submission came from, which helps us detect spam and abuse.

We don't require an account to use the Site, and the Site doesn't collect card or other payment details.

Information the Game collects

• Account and Player ID. The first time you open the Game it creates an anonymous account (a "guest") and gives it a Player ID. You don't have to give us anything to start playing. Your progress, purchases and settings are stored against that Player ID.
• Sign-in methods you link. You can link Google, Google Play Games, or an email address and password to your account, so you can get back into it on another device. If you link Google, we receive your Google account identifier and email address. If you link an email, we store that address; the password is handled by Google's Firebase Authentication and we never see it. If you link Google Play Games, we receive an identifier for your Play Games profile. We use these only to sign you in and to tell whether your account is linked.
• Game data. Your player name and tag, progress, heroes, items, currencies and settings, your friends list, your PvP results, the time you last played, and the profile picture, frame and title you choose. Other players can see your name, tag and profile choices, for example in friends lists and PvP.
• Purchases. Payments for in-game items are handled entirely by Google Play. We never see your card or payment details. For each purchase we receive and store the product, Google's order ID, the purchase token and the time, so we can deliver the item once, and handle refunds.
• Support requests. If you ask us to recover or delete an account, we collect the Player ID, your contact email, and whatever you tell us to show the account is yours (such as an order ID or your player name).
• Ads. The Game shows optional rewarded ads through Google AdMob. AdMob may collect device identifiers such as your advertising ID and IP address, and use them to deliver and measure ads, under Google's own privacy policy. On Android you can reset or delete your advertising ID in your device's settings.
• Technical data. Our servers process your IP address and basic device information as part of normal requests. Other than AdMob, the Game doesn't use analytics or crash-reporting services. Reminder notifications, if you allow them, are created on your device and send nothing to us.

Information collected automatically

Like most web servers, ours logs basic technical information for every request — IP address, browser type, the page requested, and timestamp. This is standard server-log data used for security and troubleshooting, not for tracking individuals across visits.

Cookies

The Site sets one cookie: a PHP session cookie, created only when you submit the contact form, used solely to prevent rapid repeat submissions (spam protection). It contains no personal data and expires when your browser session ends. We don't use tracking, advertising, or analytics cookies.

3. Third-Party Services

• Google Firebase. The Game's accounts and data are hosted on Google Firebase (Authentication, Cloud Firestore and Cloud Functions), which processes them for us. Google may process this data in the United States and other countries where it operates.
• Google Play and Google Sign-In. Purchases go through Google Play Billing. If you choose to link them, Google Sign-In and Google Play Games Services sign you in. Their use is governed by Google's Privacy Policy.
• Google AdMob. Shows the Game's rewarded ads (see above).
• Google Fonts. Page text is rendered using fonts loaded from Google's font CDN (fonts.googleapis.com / fonts.gstatic.com). Loading these fonts causes your browser to connect directly to Google's servers, which may log your IP address per Google's own privacy policy. We don't control this exchange beyond choosing to use the fonts.
• Discord. The Community page displays live member and online counts for our Discord server. These are fetched by our own server from Discord's public invite API — your browser doesn't contact Discord directly to show this data. If you click through to join our Discord, your use of Discord itself is governed by Discord's own Privacy Policy and Terms of Service, not this one.

We don't run analytics, advertising, or social-media tracking scripts on the Site itself.

4. How We Use Your Information

We use contact form submissions only to:

• Respond to your message
• Keep a record of correspondence
• Detect and block spam or abusive submissions

We use Game information only to:

• Run the Game: save your progress, sync it between devices, and power friends and PvP
• Sign you in, keep your account secure, and help you recover it
• Deliver purchases and handle refunds
• Prevent cheating, fraud and abuse
• Answer support and account requests

We don't sell your information, and we don't use it for advertising or share it with third parties for marketing purposes.

5. How We Store It

Contact form submissions are stored in a database on our own server. Game accounts and data are stored on Google Firebase behind access rules that stop other players from reading or changing them. Access to both is limited to the studio. We don't have a dedicated security team, but we take reasonable steps to keep this data restricted from public access.

6. Data Retention

We keep contact form submissions for as long as reasonably necessary to respond to your inquiry and maintain a record of it, or until you ask us to delete it — whichever comes first.

We keep a Game account until you delete it. To delete it, use Settings → Account → Delete account in the Game, or the Delete your account page. Deletion starts a 30-day grace period during which you can sign in and cancel; after that your profile, progress, friends, sign-in links and support requests are removed. We keep two things: purchase records (product, order ID and time), with your Player ID replaced by a one-way code that can't be traced back to you, because payment and tax rules require records of sales; and one-way hashes of the sign-in identities you linked, used only to stop the one-time reward for linking an account from being claimed twice.

7. Your Rights

Regardless of where you're located, you can ask us at any time to:

• See what information we hold about you
• Correct inaccurate information
• Delete your information

To do any of this, email hello@panaviainteractive.com and include your Player ID (shown in the Game under Settings → Account). We'll respond within a reasonable time. To delete a Curse of the Hamlet account and its data, see Delete your account.

Panavia Interactive is based in Victoria, Australia. As a small business, we likely fall under the small business exemption in the Privacy Act 1988 (Cth) and aren't strictly bound by the Australian Privacy Principles — but we handle your information in line with those principles anyway. If you're in the EU/UK, this also covers your rights under the GDPR. If you're a California resident, this also covers your rights under the CCPA/CPRA. We extend the same rights to everyone who contacts us, regardless of location.

8. Children's Privacy

The Site and the Game are not directed at children under 13, and we don't knowingly collect personal information from children under 13. If you believe a child has given us information, contact us and we'll delete it.

9. Changes to This Policy

We may update this policy as the Site, the Game or the studio changes. The "Last updated" date at the top reflects the most recent revision. We'll reflect material changes here before they take effect.

10. Contact Us

Questions about this policy or your data? Email hello@panaviainteractive.com or use the contact form.