PRIVACY POLICY

SLUG THUG ("we", "us") runs slugthug.com, the SLUG THUG game at slugthug.com/game and its multiplayer servers at mp.slugthug.com. This policy explains what personal information we collect through them, how we use it and the choices you have. For people in the European Economic Area, the UK and Switzerland, SLUG THUG is the "controller" of that information.

Contact us about privacy any time at support@slugthug.com.

When you make an account

• Your email address, when you signed up and last logged in, and whether (and when) you verified the email.
• Your password, stored only in a scrambled form (a salted, one-way hash). We can't see it and nobody at SLUG THUG can recover it.
• The 6-digit codes we email to prove an inbox is yours when a password is reset. They're stored scrambled and work for 10 minutes.
• Nothing about the link we email to verify your address: it isn't stored. It's signed, so only we can make one, and it works for 14 days.
• Which version of these policies you agreed to at sign-up, and when.
• If you made your account in the game, which of its prompts you made it from (for example the chat box), so we can tell which prompts help.

Your player profile

• Your player name (3–16 letters and numbers). Other players can see it.
• Your choices: whether your garden is open to visitors, who may visit your home, your buddies, and the players you've blocked.

Your game

• Logged in: your saved game is copied to your account: progress, in-game cash, items, garden, home, phone and arcade saves, and settings that travel with you. We keep up to 10 earlier copies so a bad sync can be undone, and a short summary (your level and in-game cash) for features like visits and the economy checks below.
• Not logged in: your game stays in your browser's storage on your device. We never see it.
• Your answer to the 21+ question, which is stored inside your saved game.

Playing with others

• Chat and calls are text only; there is no voice. Messages are filtered for slurs, threats and personal info, held on the room's server for 15 minutes, then deleted. Someone who walks into a room sees up to 20 recent lines from the last 10 minutes.
• Where you are online (server and room) is visible to your buddies. Your duel record, the trades you make (item, price and the other player), garden visits and the actions visitors take, your home card, the strain names you claim, your SLUG CUP entries, and your custom licence-plate text in drift rooms are visible to other players or stored to run those features.

Snaps: your photos and clips

• Snaps are pictures and short clips of the game screen, with the game's own sound. The game never uses your device's camera or microphone.
• When you post one, we store it with its type, size, length, where in the game it was taken and the in-game hour, plus the likes and reactions it gets. Posted snaps are public: anyone, logged in or not, can view them on SLUGBOOK until you delete them. You can keep up to 30 photos and 10 clips posted at once.
• Shots you haven't posted stay on your device (up to 24) and are never sent to us.

Safety, reports and fair play

• Reports you file and reports about you. A chat report includes up to 40 recent lines from that room as evidence.
• Blocks, mutes, warnings, bans and the reason for them, and a log of what our moderators did.
• Economy checks: when a saved game uploads, an automated check compares how fast its in-game wealth grew with what's possible in normal play. An impossible jump puts a hold on trading, the strain market and the SLUG CUP until a person reviews it. The hold never changes your save. If you think a hold is wrong, email us and a person will look at it.

Collected automatically

• A random device ID the game makes and keeps in your browser. While the game is on screen it tells us "still here" every few minutes, so we can count players. We store when that ID was first and last seen and whether it was logged in. It isn't linked to your account, name or email.
• How you found us: the label on the link that first brought you (for example "tiktok"), or the name of the site that linked you, so we know which posts work. It's a single word, stored with that device ID.
• Which sign-up prompts work: the game counts, per day, how many times each of its prompts to make an account was seen and tapped. We keep only those daily totals, with no device ID, account or IP address.
• Page and game counts: the site and the game add up, per day, how often each page is viewed and each link or button is tapped, the page a visit started on and what sent it (a link's label, the site that linked it, or "direct"), whether it's a phone, tablet or computer, the country our host reports for the request, and the hour; and in the game, minutes played in each place, what's done there, how smoothly it ran and any errors it hit. Once a day your browser also says it's visiting (and whether it's new, and how many days since its first visit, from dates it keeps itself). We keep only those daily totals, with no device ID, account or IP address. A browser sending Global Privacy Control or Do Not Track isn't counted.
• Your IP address and email in rate limits: to stop abuse, we count attempts (logins, codes, email links, sign-ups, posts) per IP address and, for logins and codes, per email address. Those counters are deleted automatically, usually within a few days.
• Server logs: our host, Cloudflare, records requests and errors, which can include your IP address. If our email provider is down when you join the slime list, your email is written to these logs so the sign-up isn't lost. Cloudflare keeps these logs for a few days.
• We may use Cloudflare Web Analytics, which counts page visits without cookies and without identifying you.

When you contact us or join the slime list

• The contact form sends your message, email, and (if you give them) your name and order number to our support inbox by email. It isn't stored in our database.
• The slime list (our email list) keeps your email address, when you joined and whether you're subscribed, with our email provider.

The shop

The shop is closed right now. A cart you build while logged in is saved to your account. When the shop reopens, checkout will collect what's needed to ship your order (name, shipping address, email) and our payment processor will handle your card; we never see or store full card numbers. We'll update this policy before it opens.

What we don't collect

We don't ask for your real name, birthday, phone number or precise location. We don't use your camera, microphone or contacts. There are no advertising IDs, ad networks or third-party trackers in the game or on the site.

• To run your account and the game: logging in, cloud saves, multiplayer, buddies, trades, visits and snaps. (Legal basis in the EEA/UK: performing our contract with you, the Terms of Play.)
• To keep it safe and fair: filtering chat, handling reports, moderation, economy checks, rate limits, security and preventing fraud. (Legitimate interests, and legal obligations where they apply.)
• To understand how many people play, which links bring them and which sign-up prompts work: the device ID, link label and prompt counts above. (Legitimate interests; nothing is used to identify you.)
• To see which pages and parts of the game get used: the page and game counts above. (Legitimate interests; they're daily totals, and nothing in them identifies you.)
• To email you: the link that verifies your email and password-reset codes (contract), and the slime list only if you joined it (consent; unsubscribe any time).
• To answer you when you contact us (legitimate interests, or contract when it's about your account or an order).

We don't sell personal information, and we don't use it for targeted advertising.

We use a small number of service providers who handle data only to run SLUG THUG for us:

• Cloudflare: hosts the site, the game and the multiplayer servers, stores snaps, protects against attacks, resizes images and keeps short-lived logs.
• Neon: our database (accounts, saves, profiles, trades, reports), hosted in the United States.
• Resend: sends our emails (the verify link, reset codes, contact messages, the slime list) and keeps the slime list.
• When the shop reopens, our payment processor and shipping carriers, for orders only.

Other players see what's public in the game: your player name, level, posted snaps, duel record, garden (if open), home card (if you allow visits), and what you say in chat.

We may also disclose information if the law requires it, to protect someone's safety, to enforce our terms, or as part of selling or reorganizing the business (the buyer would be bound by this policy).

We use only the cookies the site needs. No advertising or cross-site tracking cookies.

• slugsess: keeps you logged in for 30 days.
• sluginit: the first letter of your email, for the account button. Also 30 days.
• slug_ref: the launch-link label described above, for 30 days.
• slug_invite: the player name in a buddy's invite link, so a sign-up can say who invited it. Also 30 days.
• slugcontact: stops the contact form being sent twice; lasts one minute.

The game also keeps things in your browser's storage: your saved game and settings, your unposted camera shots, the random device ID, which multiplayer server you picked, and your shop cart, and, for the page and game counts, the day your browser first came and the last day, week and month it counted itself. Clearing your browser's site data removes them. If you aren't logged in, that erases your game.

Do Not Track and Global Privacy Control: we don't track you across other sites and don't sell or share your information, so the one thing these signals change is that a browser sending either isn't in the page and game counts. We treat a Global Privacy Control signal as a request to opt out of sale or sharing anyway.

• Your account, profile and cloud save: until you delete your account, with up to 10 earlier copies of the save.
• Chat and call messages: 15 minutes, unless they're attached to a report.
• Reports: until they're resolved. Closed chat reports are deleted after about 90 days.
• Snaps: until you or a moderator delete them. The files are removed from storage shortly after.
• Device ID and link label: deleted after 60 days without being seen.
• Page and game counts: kept as daily totals, which say nothing about anyone. The dates in your browser stay until you clear its site data.
• Email codes: work for 10 minutes, then are cleaned up. The verify link isn't stored at all and stops working after 14 days.
• Rate-limit counters: deleted automatically, usually within a few days.
• Strain names: a name you claim is released for others after 6 months of inactivity by everyone holding it.
• Trade and market history, SLUG CUP winners and moderation records: kept to keep the economy and the community fair. See below for what happens to them when you delete your account.
• The slime list: until you unsubscribe.
• Support emails: as long as we need them to help you.

You can delete your account any time at slugthug.com/account (we ask for your password again). That immediately removes:

• your login, profile, player name, cart and cloud saves (with their earlier copies)
• your snaps (their files follow shortly), likes, reactions and reports
• buddies, blocks, home card, garden visits, SLUG CUP entries, duel records, gifts and economy checks
• chat reports you filed or that were filed about you

Some things stay, with the link to you removed:

• completed trades and strain-market sales, so the other player's history still adds up, and strain names you created (credited to nobody)
• a SLUG CUP win, which keeps the player name you won under on the winners list
• moderation log entries

If you're banned when you delete your account, we keep a fingerprint of your email address (a one-way hash, which can still be matched to that address) with the ban's end date and reason, so the ban carries over if the same email signs up again. Once the ban ends it's no longer used, and it's cleaned up after that.

The $10,000 starting gift is paid once per email inbox, when an account's email is verified. To keep it once, we keep a fingerprint of the inbox that got it (a one-way hash of the address, with any "+" part and, for Gmail, any dots taken out), and it stays after you delete your account, so the same inbox can't get it again by signing up again. It's used for nothing else.

Invite a buddy. If you sign up after opening a buddy's invite link, we note which player invited you. Your buddy gets in-game cash once your email is verified and you reach level 5. Until then their game shows them your player name, your level and whether you've verified your email, and nothing more. That note stays with your account and is deleted with it.

Deleting your account does not take you off the slime list; use the unsubscribe link in any slime-list email. It also doesn't touch what's stored in your browser: clear your browser's site data for slugthug.com. Chat from the last 15 minutes and server logs expire on their own.

Wherever you live, you can ask us to show you, correct, export or delete the personal information we hold about you, or to stop using it for a purpose you object to. Email support@slugthug.com from the address on your account (that's how we check it's you). We'll answer within 30 days, and we won't treat you differently for asking. Most of it you can do yourself: change your player name in the game, delete snaps in SLUGBOOK, and delete your account at slugthug.com/account.

California

Under the California Consumer Privacy Act you have the right to know what we collect and why (this policy), to access, delete and correct it, to opt out of its sale or sharing (we do neither), and to limit the use of sensitive information (the only sensitive information we hold is your account login, used only to let you in). In the last 12 months we collected identifiers (email, device ID, IP address), internet activity (how you use the game and site), and content you post, from you and your device, for the purposes above, and disclosed them only to the service providers listed. An authorized agent may make a request for you with your written permission.

Other US states

Residents of states with their own privacy laws have similar rights. If we turn down your request, you can appeal by replying to our answer. If we still say no, you can contact your state's attorney general.

The EEA, the UK and Switzerland

You have the rights of access, correction, erasure, restriction, portability and objection, and you can withdraw consent (for the slime list) at any time. Our legal bases are listed under "How we use it". You can complain to your local data protection authority, though we'd like the chance to fix it first.

SLUG THUG is run from the United States. Our database is in the US, and Cloudflare serves the site from data centers around the world. If you play from outside the US, your information is transferred to and processed in the US. Where the law requires it, we rely on our providers' data-protection terms, including the European Commission's Standard Contractual Clauses, to protect it.

Everything travels over encrypted connections (HTTPS). Passwords and email codes are stored only as one-way hashes. The database is reached with a restricted account, and only a few people can use the moderation tools. Still, no system is perfectly secure. If a breach affects your information, we'll tell you and the authorities as the law requires.

SLUG THUG is for adults 21 and older, and it isn't directed to children. We don't knowingly collect information from anyone under 21. If you believe someone underage has an account or has sent us information, email support@slugthug.com and we'll delete it.

We may change this policy at any time. Changes take effect when they're posted, and we'll update the effective date at the top. For important changes, we'll also let you know in the game or on the site before they take effect.

SLUG THUG · support@slugthug.com