Privacy Policy

Short version: we collect an email address so we can tell you when the game launches, whatever you type into the game or a bug report, and anonymous page statistics. We do not sell anything to anyone, we set no cookies, and you can delete all of it yourself from your profile.

Who we are

The web edition of Monster Gunslingers is operated by GlossyDev, which is the data controller for everything described here. The game itself — its rules, cards and artwork — belongs to its creator and is used under licence; they are not involved in running this site or handling your data.

Privacy questions and requests: adam@glossydev.com.

What we collect, and why

Your email address

Required to play during the beta, and used to email you about the launch. We ask you to tick a box first, and we store the exact wording you agreed to along with the date — so if you ever ask why you are hearing from us, we can tell you precisely.

Lawful basis: consent. You can withdraw it at any time by unsubscribing from any email we send, or by deleting your account.

Your account

A display name, and — if you choose to create a full account rather than play as a guest — your email address and a password. Passwords are stored only as a scrypt hash; we never see or keep the password itself. Guests are real players with no credentials, which is why you can play without registering.

Lawful basis: performance of a contract — you cannot have an account without an account.

Your games

Every move in a game is recorded, along with who made it, so that a table survives a dropped connection or a server restart. We keep round results and your statistics — rounds played, rounds won, best hand.

Lawful basis: performance of a contract, and legitimate interests in a game that does not lose your table when your train goes into a tunnel.

Bug reports

Whatever you write in the contact form, plus an email address if you give one. We also attach technical details automatically, because asking people for them produces worse answers: your browser and version, your window size and pixel ratio, whether you were on Basic or Full graphics, your browser language, and the code of the last table you had open. Nothing about other tabs, and nothing about you personally beyond what you type.

Lawful basis: legitimate interests in fixing what is broken.

Analytics

We use Umami to count page views and see which parts of the site people use. Umami is cookieless and does not build a profile of you or follow you between sites — it records the page, the referrer and a coarse country, and nothing that identifies you. This is why there is no cookie banner on this site: there is nothing to consent to.

We do not use Google Analytics, advertising pixels, or any cross-site tracking.

Lawful basis: legitimate interests in knowing whether the thing we built works.

What we do not collect

• No cookies. Not one. Your session, your display name, your graphics preference and whether you have joined the beta are kept in your browser’s local storage, on your device. Clearing your browser data removes them and signs you out.
• No IP addresses. We do not store them in our database.
• No payment details. The beta is free and we take no payments.
• No advertising, no data sales, no profiling. We have never sold or shared personal information for money or for cross-context advertising, and we have no plans to.

Who else sees it

We use a small number of services to run the site:

• Kit (formerly ConvertKit) — sends the launch email. It receives your email address, the name you play under if you gave one, and a record of when and to what you consented.
• Umami — anonymous page statistics, as above.
• Our hosting provider — runs the servers and the database, and so necessarily stores the data described above on our behalf.

Each acts on our instructions and may not use your data for their own purposes. Some are in the United States, so if you are in the UK or EEA your data may be transferred there — where that happens we rely on the relevant safeguards, such as the EU–US Data Privacy Framework or standard contractual clauses.

We will also disclose data if the law genuinely requires it. We would push back on a request that seemed to overreach.

How long we keep it

• Your account and game history — until you delete it, or after two years of no sign-in, whichever comes first.
• Your email on the mailing list — until you unsubscribe or delete your account.
• Bug reports — up to two years. We remove the email address attached to a report when the account it came from is deleted, and keep the report itself.

Your rights

Wherever you are, you can ask us for a copy of your data, ask us to correct it, or ask us to delete it. If you are in the UK or EEA, the UK GDPR and GDPR also give you the right to object to or restrict processing, the right to data portability, and the right to complain to your data protection authority — in the UK, the ICO. If you are in California, the CCPA gives you rights to know, delete and correct, and not to be discriminated against for using them.

You do not have to ask us to delete your account. There is a button on your profile page that does it immediately: your account, your email, your place on the mailing list and your statistics all go. Games you played remain, because they are a shared record with the other players at the table, but your name is no longer attached to them.

For anything else, email adam@glossydev.com and we will respond within 30 days.

Children

This site is not intended for children under 13, and we do not knowingly collect anything from them. If you believe a child has given us their details, email us and we will delete the account.

Security

Passwords are hashed with scrypt and a per-user salt. Sessions expire. Traffic is encrypted in transit. We keep as little as we can, which is the only security measure that never fails.

No system is perfect. If you find a vulnerability, please tell us at adam@glossydev.com rather than posting it — we will fix it and credit you if you would like.

Changes

The game is in beta and will change; when this policy changes we will update the date at the top. If a change materially affects how we use your data, we will email the address you gave us rather than quietly editing the page.

Last updated 10 August 2026. See also the Terms of Service.