Privacy policy

1. Who we are

Blotch is made and published by Nathan Glover, an independent game developer based in Australia. In data-protection terms that means Nathan Glover is the data controller for anything described on this page, and there is no company, parent or partner behind it.

This policy covers the website at blotchgame.com, the Blotch game on Steam, and the account service the game talks to at api.blotchgame.com. It does not cover Steam itself, which is Valve's service running under Valve's privacy policy, or any other site a link here takes you to.

2. This website

The site you are reading is static files. There are no cookies, no local storage, no analytics, no tag managers, no embedded video, no social widgets and no fonts loaded from anyone else's server. Nothing on the page tries to work out who you are, and there is no account to make and no form to fill in.

The site is served from Amazon CloudFront. As with any web host, your request reaches Amazon's servers in order to be answered, which necessarily involves your IP address. We do not enable access logging on the distribution and we do not receive, keep or analyse per-visitor records of who loaded the page.

3. Playing on Steam

Blotch is distributed on Steam and uses Steam's own features. When you play, Valve handles your purchase, your account and your identity; we never see your email address, your payment details, your password or your real name. What we can see through Steam's interfaces is your public Steam ID number and, in multiplayer, the persona name you have chosen to display.

The Steam features Blotch uses, and what each one means for your data:

All of the above is stored and governed by Valve under their privacy policy, not by us.

4. What is stored on your device

Most of what Blotch remembers about you never leaves your computer. The game writes plain JSON files into the standard save folder for your platform:

What is in there: your best score and stars per level, your achievement progress, your audio, display, language, control-binding, vibration and accessibility settings, any levels and tile designs you have made, and a saved replay of your best run on each level. None of it contains anything about you personally, and none of it is sent to us.

To wipe the lot, use Reset all save data on the game's Settings screen, or delete the folder above. Deleting the folder does not delete the Steam Cloud copy, so turn Cloud off for Blotch first if you want it gone from both.

5. What our server stores

Blotch has one small server of its own, at api.blotchgame.com. Its only job is to keep an honest record of which cosmetic items you own, so they survive a reinstall and follow you to another machine. When the game starts with Steam running, it proves to that server that you are the owner of your Steam account, and the server keeps:

• your Steam ID number (the public 17-digit one), and the Steam ID of the account that owns the licence if you are playing on a shared or borrowed copy;
• the time you were first seen and the time you were last seen;
• which Steam application you connected from, and whether Valve's response flagged the account as VAC banned, which is the answer Valve returns as part of proving your identity;
• a hash of your current session token and when it expires. The token itself is never written to disk anywhere, on our side or yours;
• the id of each cosmetic item you own, when it was granted, what granted it, and which app it was granted under.

That is the entire record. There is no name, no email address, no IP address stored against you, no gameplay telemetry, no crash reporting, no purchase history and no behavioural profile. The server is never told what level you are on, how you played it or how long for.

The service writes operational logs (a line per request, tagged with the Steam ID it was for, never with your session token) to Amazon CloudWatch. Those logs are kept for 14 days and then deleted automatically.

If Steam is not running, or the service is unreachable, the game plays normally and simply uses the last cosmetic list it cached on your machine.

6. Multiplayer, chat and voice

Multiplayer is peer to peer over Steam's networking, hosted by whichever player started the lobby. While you are in a lobby or a match, the other players in that session receive your Steam persona name, your position and movement, the paint on your blob, the actions you take and anything you type into the in-game chat. That is what makes the match work, and it is exchanged live between the players rather than passing through us.

Voice chat is off until you use it. The default is push to talk, so your microphone only transmits while you hold the key, and the mode can be changed to open mic or Off in Settings. Speech goes to the other players in your session and is not recorded, stored or transcribed by us at any point.

Chat messages are not logged. They exist for the length of the session and then they are gone. Because sessions are peer to peer, we have no way to see, moderate or retrieve what other players said to you; if someone is abusive, Steam's own reporting and blocking tools are the route, and blocking them on Steam keeps you out of lobbies together.

Rounds you play are recorded locally as a replay you can watch back. That recording stays on your machine.

7. What we never do

• No advertising, ad networks or ad identifiers.
• No analytics or telemetry SDKs, in the game or on this site. We do not know how many people finished level 12.
• No selling, renting or sharing of personal information with anyone for their own purposes.
• No profiling and no automated decision-making about you.
• No tracking across other sites or apps, and nothing that would answer a "do not track" signal differently, because there is nothing to turn off.
• No collection of your location, contacts, files, browsing or anything else outside the game.

8. Why we are allowed to hold it

If you are in the UK or the European Economic Area, the UK GDPR and GDPR require a lawful basis for each use. Ours are:

• Performance of a contract. Verifying your Steam identity and storing which cosmetics you own is how the game does what you installed it to do.
• Legitimate interests. Keeping short-lived server logs so faults and abuse can be diagnosed, and expiring sessions so a stolen token cannot be used indefinitely. We keep the least we can and delete it on a schedule.
• Consent. Anything you switch on yourself: voice chat, publishing a level to Workshop, or submitting a score to a leaderboard by playing a level online.

9. How long it is kept

• Your account record and cosmetics: for as long as you have the game, and until you ask for it to be deleted.
• Session tokens: expired and deleted automatically 24 hours after they are issued.
• Server logs: 14 days, then deleted automatically.
• Local saves and replays: until you delete them.
• Steam Cloud saves, achievements, leaderboard entries and Workshop items: held by Valve under their own retention rules.

10. Your rights

Wherever you live, you can ask us for a copy of what we hold about you, ask for it to be corrected, or ask for it to be deleted. Depending on where you live you may also have the right to object to or restrict a use, to receive your data in a portable format, and to withdraw a consent you gave.

To exercise any of them, email support@blotchgame.com and include your Steam ID or a link to your Steam profile, so the record can be found. We will answer within 30 days. There is no charge, and asking will never affect your ability to play the game, though deleting your record does mean losing any cosmetic items granted to it.

Deleting the account record does not touch your Steam achievements, leaderboard entries, Workshop items or Cloud saves, because those are Valve's to hold. Steam's own account page is where those are managed.

If you think we have handled your data badly, please tell us first and we will try to put it right. You can also complain to a regulator: in Australia the Office of the Australian Information Commissioner, in the UK the Information Commissioner's Office, and in the EEA your national data-protection authority.

California residents: we do not sell or share personal information as those terms are defined by the CCPA and CPRA, and we have not done so in the last twelve months. The rights to know, delete and correct are exercised through the same address above, and you will not be discriminated against for using them.

11. Children

Blotch is not directed at children under 13, and we do not knowingly collect anything from them. A Steam account is required to play, and Valve requires account holders to be old enough under their own terms. If you believe a child has provided information to us, contact us and it will be deleted.

12. Security

Everything the game sends to our server travels over HTTPS. Session tokens are stored only as a hash, so a copy of the database hands out no working sessions, and the token itself is held in memory for the length of a play session and never written to disk. The server is a single function with access to one table and nothing else, and it is the only thing that can read it.

No system is perfectly secure. If something does go wrong in a way that affects you, we will say so directly and promptly rather than burying it.

13. Where data is processed

Our server and this website run on Amazon Web Services in the United States (us-east-1). If you are in the UK, the EEA or elsewhere outside the US, the small record described in section 5 is transferred and processed there, under the standard contractual clauses AWS offers for that purpose. Steam's own services are operated by Valve in locations described in their privacy policy.

14. Changes to this policy

If this policy changes, the date at the top of the page changes with it, and the change is visible in the site's public source history. A change that materially affects what is collected will be announced in the game's Steam news feed and on our Discord rather than made quietly.

15. Contact

Privacy questions, data requests and anything else about this page: support@blotchgame.com.

For help with the game itself, the support page is faster, and the Blotch Discord is the quickest of all.

Nathan Glover, Australia.