Privacy Policy
Draft · effective date to be set
This is a working draft for review by counsel before launch. It is not legal advice. Sections that need your specific details are gathered at the bottom.
This Privacy Policy explains what information Places I Never Heard Of LLC ("we," "us") collects when you use placesineverheardof.com and the game and community offered there (the "Service"), how we use it, and the choices you have.
1. Who this applies to
The Service is intended only for adults 18 years of age or older. We do not knowingly collect information from anyone under 18. If you believe a minor has provided us information, contact us and we will delete it.
2. What we collect
- Account information — the email address and password you provide at sign‑up, and any display name you choose. Passwords are stored only as salted bcrypt hashes; we never store them in plain text.
- Membership & billing — if you subscribe, our payment processor (Stripe) handles your card details. We do not see or store full card numbers. We retain your subscription status, a Stripe customer/subscription identifier, and renewal dates.
- Your activity in the Service — the worlds and builds you create and save, properties you interact with, group membership and messages, and similar usage needed to run the game.
- Technical data — basic log data such as IP address, browser/user‑agent, and timestamps, used for security, abuse prevention, and reliability.
- Communications — messages you send us (e.g., to admin@placesineverheardof.com) and your newsletter preferences.
3. Cookies
We use a small number of strictly functional cookies: a session cookie (np_session) to keep you logged in, and a CSRF cookie (np_csrf) to protect form submissions. We do not use third‑party advertising or cross‑site tracking cookies.
4. How we use it
- To create and operate your account and the game features you use.
- To process membership payments and manage renewals (via Stripe).
- To send transactional email — password resets, receipts, and, if you opt in, the field journal and Property of the Week (via Amazon SES).
- To keep the Service secure, prevent abuse, and comply with law.
5. Who we share it with
We do not sell your personal information. We share it only with service providers who help us run the Service, under contract and only as needed: Stripe (payments), Amazon Web Services (hosting and email/SES). We may disclose information if required by law or to protect the Service and its users.
6. What others can see
Your private groups and unpublished work are visible only to you and those you invite. If you choose to publish a build to a property's public canvas, that build and the display name you choose become visible to other users. Interest signals are shown to others only as anonymized counts, never as your identity, unless you opt in to display profile details.
7. Retention
We keep account and content data for as long as your account is active and as needed to provide the Service, then for a reasonable period afterward as described in the section to be completed below.
8. Your choices & rights
You can update your account details, unsubscribe from non‑essential email at any time, and request access to or deletion of your personal information by writing to admin@placesineverheardof.com. Depending on where you live, you may have additional rights (see the section to be completed below).
9. Security
We use industry‑standard measures — encryption in transit (HTTPS), hashed passwords, access controls, and session protections — but no method of transmission or storage is perfectly secure.
10. Changes
We may update this policy; material changes will be noted on this page with a new effective date.
Info to complete before publishing
- Legal entity & registered address — full LLC name and mailing address of the data controller.
- Effective date of this policy.
- Retention periods — how long account, billing, and content data are kept after account closure.
- Sub‑processor confirmation — confirm the full list (Stripe, AWS/SES) and add any others (analytics, error monitoring, etc.) if used.
- State/region privacy rights — language for CCPA/CPRA (California), and any GDPR/UK obligations if you accept EU/UK users; the lawful basis and a data‑subject request process.
- Cookie/consent banner — confirm whether a consent banner is required for your audience.
- Data Protection / privacy contact — the email or person handling privacy requests (default: admin@placesineverheardof.com).