Privacy policy

Who runs this site

This site is run by Zachary Parker (Zach), who publishes software and games as Obby Studio. Obby Studio is not a company. When this page says "I", that's me.

Questions or requests about your data: [email protected].

Cloudflare

The site reaches you through Cloudflare, a network and security service, using a Cloudflare Tunnel to my server. To deliver pages and protect the site from attacks, Cloudflare processes each request, including your IP address, the page you asked for and your browser's request headers. Cloudflare handles that data under its own privacy policy.

I haven't turned on Cloudflare's analytics or bot-tracking features.

What the server records

Like almost every web server, the one hosting this site writes a line to a log file each time something is requested. Each line has:

• an IP address. Since requests come through Cloudflare, it's usually Cloudflare's connection rather than yours
• the date and time of the request
• the page or file requested, and whether it worked
• how much data was sent back
• the page that linked you here, if your browser sends it
• your browser's user agent string (browser and operating system)

I use these logs to keep the site running, fix problems and spot abuse, like someone hammering the server. Under the GDPR and UK GDPR, the legal basis for that is my legitimate interest in running and securing the site.

The logs rotate daily and are deleted after 14 days. I don't combine them with anything else, try to work out who you are, sell them, or share them. The exceptions are Cloudflare delivering the site as described above, and being legally required to hand them over.

Cookies and tracking

This site sets no cookies of its own and uses no local storage. It has no analytics, no ads, no tracking pixels and no embedded social media. The only form is the playtest application, covered below. The one exception: if Cloudflare decides a request looks suspicious, it may set a strictly necessary security cookie (such as cf_clearance) after a challenge. That cookie isn't used for tracking or advertising.

Every file the site loads, including the font and the one small script (a countdown on the Firstlight page), comes from this site. Apart from Cloudflare, which delivers the site, your browser doesn't contact any other service just by visiting. The one addition is the playtest page, which loads Cloudflare Turnstile (see below).

Playtest applications

If you apply to playtest Firstlight on the playtest page, I collect what you type into the form:

• your name or handle, email address, and Discord username if you give one
• your PC's operating system, CPU, GPU and RAM, if you give them
• the games you play and why you want to test, if you give them
• the date and time you applied

I use this only to pick playtesters and to contact the people I pick about the playtest. The legal basis is your consent, which you give with the checkbox on the form, and you can withdraw it any time. I won't add you to a mailing list or use it for marketing.

Applications are stored in a Cloudflare D1 database that only I can open, behind a login. When one comes in, I get a Discord notification that says an application arrived, with no details from it. I don't sell or share applications with anyone.

Each application is deleted automatically 365 days after it comes in, or sooner if you ask. To see, fix or delete yours, email [email protected] from the address you applied with.

The form uses Cloudflare Turnstile to keep bots out. Turnstile runs a check in your browser and sends the result to Cloudflare, under Cloudflare's privacy policy. It only loads on the playtest page.

Applications are for people 18 and older. If I find out someone younger applied, I delete it.

Do Not Track and Global Privacy Control

Nothing on this site tracks you, so there's nothing for a Do Not Track or Global Privacy Control signal to switch off. Every visitor gets the same treatment either way, and nothing tracks you across other sites.

Links to other sites

Some links go to other services, like GitHub and Discord. Once you follow one, you're on their site and their privacy policy applies, not this one.

Children

This site isn't aimed at children under 13, and I don't knowingly collect personal information from children. The playtest application is for adults only (18+).

Your rights

Depending on where you live (for example under the GDPR, UK GDPR or California's CCPA), you may have the right to ask what data I hold about you, to have it corrected or deleted, or to object to how it's used. I don't sell or share personal information, including for anyone's direct marketing, so there's nothing to opt out of.

To make a request, contact me at [email protected]. For a playtest application, email me from the address you applied with. The server logs aren't tied to names, so for those I'll need your IP address and roughly when you visited, and they're deleted within 14 days anyway. You also have the right to complain to your local data protection authority.

Changes

If how the site handles data changes, for example because it moves to a different host or turns on a new service, I'll update this page and the date at the top.