Privacy Notice
Go North – the text-adventure platform and all the games published on it (test period). Effective from 7 October 2026. Magyar változat (the Hungarian text is the authoritative version).
1. The data controller
Sándor Füleki (a private individual), email: privacy@gonorthgames.com. You can reach us at this address with any privacy question and to exercise your rights.
2. What data do we process, why, and on what legal basis?
| Data | Purpose | Legal basis (GDPR Article 6) |
|---|---|---|
| Email address, password (the password is stored only in a hashed, irreversible form by the sign-in provider) | Creating your account, signing in, distinguishing between players, password-reset emails | providing the game – performance of a contract, point (b) |
| Email address and the fact and time of your consent (only if you tick the box for news about new games when you register; this is optional) | Sending emails about new game releases | consent – point (a); can be withdrawn at any time, which does not affect the lawfulness of the processing before withdrawal |
| Game state, saves, settings, the commands you type and the game's replies | Running the game, letting you continue later, fixing and improving the game | performance of a contract (b) and legitimate interest (f): improving the game |
| Anonymous (guest) session, if you play without signing up: a random identifier in a cookie in your browser, with the game data and technical data above tied to it – we do not ask for an email address in this case | Trying the game without an account, keeping your progress in this browser, and – if you ask – attaching it to an account later | performance of a contract (b), legitimate interest (f): preventing abuse |
| Technical data: truncated IP address (for IPv4, without the last segment) and the country, region, city, time zone and internet provider estimated from it; browser and operating system type, screen and window size, language, device type; the times of your sign-ins | Troubleshooting, helping you, detecting abuse (e.g. circumventing the cost limits) | legitimate interest (f) |
| Problem reports: the description you write, the state of the game at that moment, the last messages, and the technical data above | Finding and fixing the reported problem | legitimate interest (f), and your explicit request expressed by sending the report |
| AI usage data (token counts, cost, response time) | Keeping within the cost limits, keeping the service sustainable | legitimate interest (f) |
| Purchases and entitlements (if you use a paid feature): the product purchased, the purchase's external identifier at the payment provider (e.g. the identifier of the download key – not the key itself, only an irreversible fingerprint of it), the time, whether redemption succeeded or failed, refunds; the entries of your AI-turn balance (credits, and usage per turn) | Providing the access you purchased, preventing double redemption and abuse, handling refunds, accounting | performance of a contract (b), legal obligation (c): accounting and tax records, legitimate interest (f): preventing abuse |
We do not ask for special categories of (sensitive) data; please do not type any into the game either. The game is intended for people aged 16 and over; younger players may register only with parental consent.
3. The AI storyteller
If you play in AI storyteller mode, the text you type and the current situation in the game are processed by the Claude artificial-intelligence service of Anthropic PBC (USA), to interpret your command and write the narration. Under its own terms, Anthropic does not use data sent through its paid API to train its models. In classic mode there is no such data transfer.
Your own AI key. If you enter your own AI key (an Anthropic API key), it stays in your browser (stored for the session only or on this device, as you choose). It is passed to our server with each AI request; the server does not store or log it and discards it when the request ends. In that case Anthropic handles your text under your own agreement and data terms with it; your game state and the commands you type are still handled as described in section 2 above.
Dictation and read-aloud. If you dictate with the microphone button, your voice is turned into text by the service of your browser's maker (e.g. Google, Apple, Microsoft) under its own terms. We do not receive or store the audio; only the recognised text goes into the input field. Read-aloud uses your browser's built-in voice; no data is sent anywhere for it.
3/A. Payment (if you use a paid feature)
Some features (e.g. the AI storyteller, the full version of a game or part of the classic mode) are paid; what is free and what is not in a given game is stated on that game's page. The purchase is made not with us but on the payment provider's site (currently itch.io, in its “Collected by itch.io” mode). The provider is the seller of the purchase (merchant of record): it handles your payment details (card, billing address), the invoice, VAT and refunds, under its own privacy notice, as an independent controller – it is not our processor.
We never receive or store card details, bank account numbers or payment passwords. To verify a purchase, our server queries the provider's server-side interface (using the download key or – if we have enabled it – the email address of your account); from the result we keep only the data listed in section 2 above.
4. Processors and data transfers
| Provider | Task | Location |
|---|---|---|
| Cloudflare, Inc. | Running the website and the server, database (game state, logs, technical data) | global network, USA |
| Supabase, Inc. | Sign-in (email address, password hash), sending the sign-in emails | EU region: Frankfurt (Germany); the provider is based in the USA |
| Anthropic PBC | AI storyteller (see section 3) | USA |
The payment provider (itch.io – Itch Corp, USA) is an independent controller for the purchase (see section 3/A). We pass it only the data needed to verify the purchase (the download key), and only when you ask us to redeem it.
Transfers outside the European Economic Area (to the USA) are based on the EU–US Data Privacy Framework and/or the standard contractual clauses adopted by the European Commission.
5. How long do we keep the data?
- Account data, game state, saves: until the account is deleted.
- Your consent to emails about new games: until you withdraw it (or the account is deleted).
- Anonymous (guest) session data: deleted automatically after 30 days of inactivity; if you attach your progress to an account, it becomes that account's data and the account rule applies from then on.
- Game log (commands, replies), technical data, problem reports: for at most 2 years, or until the account is deleted, whichever is earlier.
- At the end of the test period we will review the data connected to the test and delete what is no longer needed.
- Purchase and entitlement data, AI-turn entries: while the access is active, and afterwards for the period required by accounting and tax law (at most 8 years). When an account is deleted, we do not delete these immediately if the law requires us to keep them; in that case we keep them separately and for this purpose only. (The exact retention period will be agreed with an accountant before paid features launch.)
6. Your rights
You may request access to your data, its rectification, its erasure (deletion of your account), the restriction of processing, a copy of your data in a portable format, and you may object to processing based on legitimate interest. Send your request to privacy@gonorthgames.com; we will reply within 30 days. You can withdraw your consent to emails about new games at any time at the same address.
If you believe we have infringed your rights, you may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH, 1055 Budapest, Falk Miksa utca 9–11, Hungary, www.naih.hu), or with the supervisory authority of the EU Member State of your habitual residence, place of work or the place of the alleged infringement (GDPR Article 77), or you may go to court.
7. Cookies and local storage
We use no advertising or tracking cookies. In your browser's local storage we keep only the sign-in session and a few convenience settings (e.g. the picture-set view); these are needed for the game to work. If you play without signing up, a cookie holds the random identifier of the anonymous session (for at most 30 days); this is also needed for the game to work.
(Draft wording – subject to legal review.) We also run a simple, aggregated measurement of traffic on our own servers to see which steps of the game visitors reach. Only daily counters of events (e.g. "visited", "started a game") are kept permanently, broken down by language and a coarse source (we narrow the source given in the link you opened to a few preset categories, e.g. itch or reddit); they contain no IP address, no browser fingerprint, no email address and no account identifier. To count the same event from the same player only once a day, the server temporarily keeps in its database a hash made from the player's identifier (account or guest session) and a random daily salt; the hash and the salt are deleted when the day changes (at the first measurement of the new day), so only the aggregated counter remains. The measurement sets no cookies; the source and the note that an event has already been sent are kept in your browser's session storage (sessionStorage), which is cleared when you close the tab. Questions: privacy@gonorthgames.com.
8. Security
Only the controller has access to the data; the connection is encrypted (HTTPS), and the sign-in provider stores passwords only as hashes.
We may update this notice as the game changes; we will tell you about material changes in the game. Legal notice (Impresszum) · Back to the game