Legal
Games and services privacy policy
Draft — pending legal review
Last updated: [pending — set once this policy is finalized]
Controller: [Controller entity — pending registration]. Leandril Studios' operating company has not yet completed formal registration; this policy will name it here as soon as that's settled.
Contact: business-inquiries@leandril-studios.com
Status: a draft, published early for transparency. It has not been reviewed by counsel and it isn't final. Items marked TBD are open questions we're not going to guess at.
This policy explains what our games and online services collect about you, why, who else sees it, and what you can do about it. It covers our games — not this website.
What we're committing to
- We collect what a game needs to run, and we'd rather design around data than collect it.
- We don't sell your data, rent it, or hand it to advertisers or data brokers.
- We say what we actually do today, including where that's less than we'd like it to be.
- We tell you before this changes in a way that matters.
These are principles, not a summary of your legal rights — those are in section 8.
Contents
- Who we are and what this covers
- Children and age limits
- What we collect
- Where it comes from
- How and why we use it
- Who we share it with
- Where it's stored, and transfers
- Your rights and how to use them
- How long we keep it
- Security
- Automated decisions and anti-cheat
- Changes to this policy
- Contact
- Schedule A — our in-development titles
- Schedule B — BattleBot
1. Who we are and what this covers
Leandril Studios ("we," "us," "our") makes games and the online services that run them. For the data described here, we're the controller — the party that decides why and how it's handled. Our operating company hasn't finished registering, so the entity behind that name is the placeholder at the top of this page. That's also why this policy is marked draft.
This is not the website notice
Visiting leandril-studios.com is covered by our separate visitor privacy notice, which deals with analytics, server logs, and emailing us. This policy deals with our games and services. Neither document covers the other's ground, and where they seem to disagree it's because they're describing two genuinely different things.
Products that need to say something extra get a schedule at the end of this page. Where a schedule says something different from the main body, the schedule governs for that product only. A product with no schedule is covered by the main body alone. Steam and Discord also handle your data for their own purposes as controllers in their own right — that part is governed by their policies, not this one.
2. Children and age limits
Our games and services are for people who are at least 13 years old and old enough under the law of their own country. They are general-audience products, not directed at children under 13: we don't design them for children, market them to children, or build features aimed at them.
We don't knowingly collect personal information from anyone under 13. If we find out we have, we delete that account's data and remove its access. If you're a parent or guardian and you think your child has been using one of our products, write to business-inquiries@leandril-studios.com and we'll handle it.
In the EU and the UK, the age at which someone can consent for themselves to an online service is 16 in most countries and as low as 13 where a country has lowered it. Below that age, a parent or guardian has to give permission where we rely on consent.
We don't run behavioural advertising, so no one is profiled for ads here — minor or otherwise.
Playing and paying are two different age questions. 13 is the floor for using our services; buying a randomized item carries a higher limit, set out in our terms of service.
3. What we collect
This is the full set of categories our games and services can involve. Not all of it is live — a Discord bot and a dedicated-server PvP game touch very different things, and one of those two products hasn't shipped. The schedules say what's actually happening in each product today.
| Category | What that means | Why we'd have it |
|---|---|---|
| Platform identifier | Your Steam ID or your Discord user ID, and the display name the platform shows for you. | To know which account is yours and keep your progress attached to it. |
| Entitlement and ban status | Whether your platform account owns the game, and any platform-level cheating ban the platform reports to us. | To let you in, and to keep known cheaters out. |
| Game state | Progression, unlocks, in-game items and currency, settings, and timers. | It is the game. Without it there's nothing to come back to. |
| Match and session records | Who played whom, when, where, the result, and what happened during the match. | To run matches, show results and history, and investigate cheating or abuse reports. |
| Connection data | Your IP address and connection metadata when your game client reaches our servers. | Unavoidable for online play, and used for routing, abuse prevention and ban evasion. |
| Communications | In-game text chat and voice, where a product has them, and moderation reports about them. | To deliver them, and to act on harassment reports. |
| Purchase records | Order id, amount, order status, and the platform account it's linked to. Not your card details, and not the email you bought with. | To give you what you paid for and answer questions about it. |
| Anti-cheat signals | What an anti-cheat system reports about a session, once we have one. | To detect and act on cheating. |
| Technical and crash data | Crash reports, error logs, performance and hardware data. | To find out why the game broke and fix it. |
| Support correspondence | What you write to us, and our replies. | To answer you and to handle appeals. |
What we don't collect. We don't take your real name, your postal address, or your date of birth. Steam and Discord don't give developers your email address, your payment details, or your password, and we don't ask for them. We don't collect health, financial, biometric, or other sensitive categories of data, and we don't try to work out who you are behind your platform account.
4. Where it comes from
- From you. What you type into a game or a command, and what you write to us.
- From playing. Everything your game client and our servers generate as you play — match results, progression, connection data, crash reports.
- From the platform. Steam and Discord pass us the identifiers and status described above when your client connects or you use a command. They are their own controllers for what they collect about you, under their own policies — we only receive the slice a developer is given.
5. How and why we use it
If you're in the EU or the UK, the law asks us to name a legal basis for each purpose. Here they are together, so you can see the reason and the basis in the same place.
| What we use it for | Legal basis (EU/UK) |
|---|---|
| Running the game: your account and progress, matches, items and entitlements. | Performance of our agreement with you — you can't play the game without it. |
| Keeping the game fair and safe: anti-cheat, abuse and harassment moderation, ban enforcement, fraud and attack prevention. | Our legitimate interest in a game that's worth playing, and other players' interest in not being cheated or abused. |
| Keeping it working: crash reports, error logs, diagnosing performance problems. | Our legitimate interest in a game that runs. |
| Understanding how the game is played, so we can improve it — in aggregate, not per person. | Our legitimate interest in improving our products. |
| Answering you, and handling appeals. | Performance of our agreement, and our legitimate interest in supporting players. |
| Meeting legal obligations: tax and business records, responding to lawful requests. | Compliance with a legal obligation. |
Where we rely on a legitimate interest, you can object — see section 8. We don't currently run any marketing that uses game data, and we don't send promotional messages to players through the game or the bot. If we ever want to, we'll ask first.
We do not train AI models on your data. In particular, we don't use anything obtained through Discord's APIs — including message content — to train machine-learning or large language models.
6. Who we share it with
We share your data in three situations and no others: with providers who run part of the service for us, when the law requires it, and when you ask us to.
- Platforms. Valve, for anything running on Steam, and Discord, for the bot. Both are their own controllers for what they collect about you directly.
- Hosting and infrastructure. Whoever runs the servers a product lives on. Each schedule names what's actually in use for that product.
- Anti-cheat. A provider once we choose one — currently none. If cheating reports or ban history are ever shared with a platform or with other server operators, we'll say so here before it starts.
- Payments. Nothing we make sells anything for real money today. When that changes, purchases outside a storefront like Steam will be handled by a third-party merchant of record — currently Lemon Squeezy — who is the seller of record. They take the payment under their own terms and privacy policy, which you should read for how they handle it; we're not going to summarise someone else's processing for them. On Steam, Valve is the seller.
- Legal requests and safety. Where we're legally required to, or where it's genuinely necessary to protect someone from harm.
- A future reorganisation. If the studio is restructured, sold, or transferred — including to our operating company once its registration completes — data moves with it, under this policy.
What a purchase tells us about you
We never receive or store your card details. When a purchase completes, our payment processor gives us the order details — and those details include the email address you bought with. We keep only what we need to deliver the thing you paid for and answer questions about it: the order id, the amount, the order status, and the platform user id the purchase is linked to. The email address is not kept. Nothing of ours takes real-money payments yet, so this describes how the payment handling is being built rather than something already running — and it's written here first so it's a commitment the code has to meet, not a description written afterwards to match whatever got built.
We do not sell, rent, license, or otherwise commercialize your data. We don't share it with data brokers, advertising networks, or any service that monetizes it. We don't use it to profile you or your relationships, and we don't use it to make decisions about you outside the game — nothing here feeds an employment, housing, insurance, or credit decision.
7. Where it's stored, and transfers
We're a United States studio, based in Florida, and your data is processed in the United States. If you play from outside the US, that means your data goes to a country whose privacy laws are different from your own — that's a real consequence and not a formality, so we'd rather state it plainly than bury it.
Where we pass data to a provider, we put written data-protection terms in place with them.
TBD — counsel
Two questions here need a lawyer rather than a guess: which transfer mechanism is the right one for our situation, and whether we need to appoint a representative in the EU and the UK. We have not appointed one, and we're not going to list a placeholder address to look compliant. Both get answered before this policy comes out of draft.
8. Your rights and how to use them
We extend these to every player, wherever you live. Some of them are legal rights in the EU, the UK, and a number of US states; we're not currently large enough for most US state privacy laws to apply to us, and we're not going to claim otherwise. Offering the same thing to everyone is simpler than sorting players by jurisdiction, so that's what we do.
- Access — ask what we hold about you and get a copy.
- Correction — have something inaccurate fixed.
- Deletion — ask us to delete your data.
- Restriction and objection — ask us to stop or pause a particular use, including anything we do on a legitimate-interest basis.
- Portability — get what you gave us in a machine-readable form.
- Withdraw consent — where we relied on consent, take it back; that doesn't undo what we did while it applied.
How. One address for all of it: business-inquiries@leandril-studios.com. Tell us which product and which platform account, so we can find you — we identify players by platform ID, so without it we may genuinely not be able to. We'll confirm we got the request and come back to you as quickly as we can. We aren't printing a guaranteed turnaround yet because we don't have a support process that could reliably hold to one; where the law gives you a deadline, that deadline applies to us regardless of what this page says.
The honest caveats on deletion. If you ask us to delete your data we will, but a few things survive: records we need to keep for tax or legal reasons, and the minimum needed to keep a ban enforced — otherwise "delete my data" becomes a way to wipe a cheating record and come back. We'll tell you what was kept and why. Deleting your data with us doesn't touch anything Steam or Discord holds about you; those are their systems, and you'd go to them.
If you're in the EU or the UK and you think we've handled your data badly, you can complain to your national data protection authority. We'd rather you told us first so we can fix it, but that route is yours either way and you don't need our permission to use it.
9. How long we keep it
The principle we're working to: keep game data while the account is active and for a reasonable period after, keep enforcement records for as long as the enforcement needs to hold, keep crash and technical logs for a short operational window, and keep financial records for as long as tax law requires.
Where we are today
We don't yet run automatic deletion schedules on our prototype products — data stays until someone removes it, and a deletion request is handled by hand. That's the true position and we would rather write it here than print a retention table we don't actually enforce. Concrete periods per category go in the schedules as each product gets the tooling to hold to them.
10. Security
We take reasonable administrative and technical measures to protect what we hold: access limited to the people who need it, encrypted connections between the game and our servers, and platform authentication rather than passwords we store ourselves.
We're not going to tell you your data is completely safe, because nobody can honestly say that. Our prototype products in particular run on modest infrastructure, and each schedule says what's genuinely in place for that product rather than describing a security posture in the abstract.
If something goes wrong. If your data is exposed in a breach, we'll tell you and the relevant regulators as the law requires, and we'll say what happened rather than issuing something evasive. Where a platform's data is involved, we'll notify that platform too.
11. Automated decisions and anti-cheat
Anti-cheat systems work automatically — that's the only way they can work at the speed a match runs. When we have one, it will analyse what happens in a session and can flag an account, and some enforcement may follow without a person having looked at it first.
You can always get a human. If an automated decision affects your access, you can contest it and ask for a person to review it, at business-inquiries@leandril-studios.com. A human can and will reverse a bad call. We won't treat an automated detection as the final word on a permanent ban.
We don't use automated decision-making for anything else — no automated profiling, scoring, or decisions about you outside keeping the game fair. No anti-cheat provider has been selected yet, so the specifics of what one inspects and reports are TBD; our terms of service carry the same commitment to describe it fully before it ships.
12. Changes to this policy
This policy will change — most obviously once counsel has reviewed it and once our operating company is registered. When we make a material change, we'll give notice before it takes effect through the game or bot itself and our public channels, and we'll update the date at the top.
We won't start using data we already hold for a materially different purpose without telling you first. These pages live in the same version control as the rest of our website, so the record of what changed and when is real rather than asserted.
13. Contact
business-inquiries@leandril-studios.com, also listed on our Contact page. Use it for access and deletion requests, appeals, and anything else on this page. A named postal address and a named controller go here once our operating company is registered.
Schedule A — our in-development titles
Draft — pending legal review. Controller: [Controller entity — pending registration]. This schedule adds to the main policy above; where it differs, this schedule governs for these products only.
What this covers. Our unannounced in-development game titles and any pre-release, playtest or beta build of them, together with the dedicated servers that run them.
Status: nothing is collected yet
No title has been released and no public build is running, so as of this draft we are not collecting player data under this schedule at all. Everything below describes what will apply when a build reaches players — it isn't a description of something happening now.
What these titles will collect
A premium PvP game on Steam with dedicated servers necessarily involves most of the main table in section 3: your Steam ID and display name, whether your account owns the game, any platform cheating-ban status, your progression and items, match and session records, your IP address when you connect to our servers, in-game communications where the game has them, anti-cheat signals once we have anti-cheat, and crash and performance data.
Steam does not give us your real name, your email address, your payment details, or your password, and we don't ask Valve for them. Valve handles your Steam account and your purchase as its own controller under its own privacy policy.
Playtests
Playtest and beta builds are throwaway by nature and their data is treated that way: we intend to delete playtest data at the end of the test that produced it, and progression from a pre-release build should be assumed not to survive. Playtests through a store's own playtest system are not confidential — you're free to talk about what you played.
Third parties for these titles
Valve as platform and seller of record for anything sold on Steam; a server hosting provider, not yet contracted; and an anti-cheat provider, not yet selected. We will name each of them here before a build using them reaches players. There is no analytics, advertising, or attribution software in these builds.
Purchases
Nothing is on sale in these titles, so no purchase data exists. When they ship on Steam, Valve is the seller and holds the payment relationship with you; section 6 describes what we would receive from a purchase.
Requests and support
business-inquiries@leandril-studios.com.
Schedule B — BattleBot
Draft — pending legal review, and incomplete. Controller: [Controller entity — pending registration]. This schedule adds to the main policy above; where it differs, this schedule governs for BattleBot only.
This schedule is not finished yet
BattleBot is live and being played, so we're publishing what we can state accurately today rather than waiting. The full account — every field, every retention period, and the self-serve deletion route — is being finalized and will replace this stub.
What BattleBot is. A Discord bot game, currently an early prototype running in a single private server. Players fight each other in short one-on-one matches and gear up from boxes earned in play.
In one line, what it stores about you: your Discord user ID, the display name Discord shows for you, your game state (coins, items, timers), and a record of the fights you were in — including the server each fight happened in. It stores no message text.
It cannot read your messages. BattleBot works entirely through slash commands and holds none of Discord's privileged intents — it does not have the message content intent, the members intent, or the presence intent. It sees the commands sent to it and nothing else, it never sends direct messages, and every reply it makes is in the channel where you used the command. It collects no free text: its commands take a player and a number.
Where it runs. A single database file on a development machine the studio controls. It is not replicated and not backed up, and the data is not encrypted at rest today. That's a prototype's honest posture, not a target one, and it's part of what has to change before BattleBot is anything more than a private test.
How long it's kept. Indefinitely, at the moment. Nothing expires automatically, and your record persists if you leave a server or the bot is removed from one, because the account is global rather than per-server. A retention schedule is part of the finished version of this schedule.
How to have it deleted. There is no in-bot deletion command yet. Email business-inquiries@leandril-studios.com with your Discord user ID and we will delete your record by hand, and confirm when it's done. That's a manual process, which is exactly why a self-serve command is on the list of things the finished schedule has to be able to promise.
Who else sees it. Nobody. BattleBot uses no analytics, no error tracking, and no third-party services beyond Discord itself, which is its own controller for your Discord account under Discord's privacy policy. If a payment processor is added for anything paid, it will be named here before it goes live.