Privacy Policy

1. Who We Are

Address:
Spicy Koala
LDB Accountants & Advisors Level 1
1-3 Albert Street Blackburn, VIC 3130

Country of Incorporation: Australia

Contact: privacy@spicykoalagames.com

Data Protection Officer: Not applicable

SPICY KOALA is the data controller (or, for California purposes, the "business") responsible for the personal information described in this Policy. If you have any questions about this Policy or our data practices, please contact us using the details above.

2. Scope of This Policy

This Policy applies to information collected through:

- Our Site and any subdomains;

- Our newsletter and email communications;

- Contact, support, and feedback forms;

- Any social media pages or community channels we directly operate (e.g., our official Discord server, where governed by this Policy rather than Discord's own policy for the underlying platform).

This Policy does **not** apply to third-party platforms that host or sell our games (such as Steam, itch.io, GOG, Epic Games Store, or console storefronts). Those platforms have their own privacy policies governing your purchases, accounts, and payment information — see Section 10. It also does not apply to in-game data collection, which is addressed in the privacy notice specific to each game — see Section 11.

3. Information We Collect

3.1 Information You Provide Directly

| Category | Examples | When Collected |

| Contact details | Name, email address | Newsletter sign-up, contact form, support requests |

| Message content | Subject, message text, attachments | Contact form, support tickets |

| Correspondence | Records of your communications with us | Email exchanges, support follow-ups |

| Marketing preference | Newsletter opt-in given directly, or passed to us by a storefront at checkout | Direct sign-up form, or a marketing opt-in you select when purchasing one of our games on a third-party storefront (e.g., Steam or Epic Games Store), where that storefront shares your opt-in with us |

We only collect what is necessary to respond to your inquiry or send the communications you've requested.

3.2 Information Collected Automatically

When you browse our Site, we and our service providers automatically collect certain information via cookies and similar technologies, including:

- IP address and approximate location (city/region level)

- Browser type, device type, and operating system

- Pages visited, time spent, referring/exit pages, and click activity

See **Section 5 (Cookies and Tracking Technologies)** for full details.

3.3 Information from Third-Party Embeds

Our Site may include embedded content from third parties, such as:

- **YouTube** video embeds (trailers, devlogs)

- **Discord** server widgets

- **Steam** widgets or wishlist buttons

When you interact with this embedded content, the relevant third party (YouTube/Google, Discord, Valve, etc.) may collect information directly from your browser according to **their own privacy policies**, independent of us. We do not control and are not responsible for this collection.

3.4 Information We Do Not Collect

We do not collect payment card details, government ID numbers, or precise geolocation through our Site. Purchases of our games are processed entirely by third-party storefronts (see Section 10).

3.5 Aggregated and De-Identified Data

We may create aggregated, anonymized, or de-identified data from the personal information described above (for example, the percentage of visitors who view a particular game page). Once information no longer identifies, and cannot reasonably be used to identify, an individual, it is no longer treated as personal information, and we may use and share it for any business purpose, including analytics and marketing reporting.

4. How We Use Your Information

We use personal information to:

- Respond to contact form submissions and support requests

- Send newsletters, game announcements, and updates (only if you've subscribed)

- Operate, maintain, secure, and improve the Site

- Understand aggregate usage trends (via analytics) to improve our games and marketing

- Measure the effectiveness of our marketing and advertising campaigns

- Comply with legal obligations and enforce our terms

We do **not** sell your personal information to third parties for money, and we do not disclose it to third parties for the third parties' own direct marketing purposes. As described in Section 8, certain advertising/analytics integrations may constitute a "sale" or "sharing" of information under CCPA/CPRA's broad definitions — see Section 9.3 for your opt-out rights.

5. Cookies and Tracking Technologies

5.1 What Are Cookies?

Cookies are small text files placed on your device that allow a website to recognize your browser and remember certain information. We also use similar technologies such as pixels, local storage, and SDKs (collectively referred to as "cookies" in this Policy).

5.2 Categories of Cookies We Use

| Category | Purpose | Can You Opt Out? |

| **Strictly Necessary** | Essential for the Site to function (e.g., security, load balancing, cookie consent preferences) | No — required for basic functioning |

| **Analytics** | Help us understand how visitors use the Site (e.g., Google Analytics, Google Search Console, Microsoft Clarity) | Yes |

| **Advertising / Marketing** | Used to measure ad performance and deliver relevant ads on other sites (e.g., conversion pixels, retargeting tags) | Yes |

| **Third-Party Embed Cookies** | Set by embedded content (YouTube, Discord, Steam widgets) when you interact with it | Yes, via the third party's own controls or by not interacting with the embed |

5.3 Example Cookie Table

*(Replace with your actual cookies once your analytics/ad tools are finalized — most analytics dashboards list this automatically.)*

5.4 Your Cookie Choices

- **Cookie banner:** On your first visit, you'll be shown a cookie banner allowing you to accept all, reject non-essential cookies, or set granular preferences by category. EU/UK visitors will see non-essential cookies blocked by default until you opt in, consistent with GDPR/ePrivacy requirements. A "Manage Cookies" (or similarly labeled) link is available at all times, typically in the site footer, so you can review or change your choices after your first visit.

- **Browser controls:** Most browsers let you block or delete cookies via their settings menu.

- **Analytics opt-out:** [e.g., Google Analytics offers a dedicated browser opt-out add-on.]

- **Industry opt-out tools:** You can also opt out of interest-based advertising across many networks at once via the [Network Advertising Initiative](https://www.networkadvertising.org/managing/opt_out.asp), the [Digital Advertising Alliance](https://www.aboutads.info/), or, for EU/UK visitors, [Your Online Choices](https://youronlinechoices.eu/).

- **Do Not Track / Global Privacy Control:** We honor Global Privacy Control (GPC) signals as a valid opt-out request for sale/sharing under CCPA/CPRA where applicable. Most browsers also offer a separate "Do Not Track" (DNT) setting; because there is no accepted industry standard for responding to DNT signals, our Site does not currently respond to them.

Disabling cookies may affect Site functionality (e.g., embedded video or chat widgets may not load).

6. Legal Bases for Processing (GDPR/UK GDPR)

Where GDPR or UK GDPR applies, we rely on the following legal bases:

| Processing Activity | Legal Basis |

| Responding to contact/support requests | Legitimate interest / performance of a request you initiated |

| Sending newsletters | Consent (you can withdraw at any time) |

| Essential cookies | Legitimate interest (necessary for Site operation) |

| Analytics and advertising cookies | Consent (collected via cookie banner) |

| Legal compliance | Legal obligation |

You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

7. How We Share Your Information

We do not sell personal information for monetary consideration. We may share information with the following categories of recipients:

- **Service providers**, such as:

- Hosting providers (e.g., [insert provider, such as a cloud or web hosting service]);

- Email/newsletter platforms (e.g., [insert provider, such as Mailchimp]);

- Analytics providers (e.g., [insert provider, such as Google Analytics or Plausible]);

- Payment processors, if we sell merchandise directly (e.g., [insert provider, such as Shopify]).

These providers act under contracts requiring them to protect your data and use it only for the purposes we specify.

- **Advertising partners**, where you have consented to advertising cookies, to measure and improve marketing campaigns.

- **Embedded third parties** (YouTube, Discord, Steam), which collect data directly per their own policies when you interact with their embedded content.

- **Legal and safety purposes**, where required to comply with law, enforce our terms, or protect the rights, property, or safety of Spicy Koala, our users, or others.

- **Business transfers**, such as a merger, acquisition, or sale of assets, where personal information may be transferred as part of that transaction, subject to the recipient's continued obligation to use the data only as disclosed in this Policy.

8. Data Retention

We retain personal information only as long as necessary for the purposes described in this Policy:

- **Contact form/support inquiries:** retained for [e.g., 24 months] after resolution, or as needed for record-keeping.

- **Newsletter subscriptions:** retained until you unsubscribe.

- **Analytics data:** retained per our analytics provider's default retention settings (commonly 14–26 months), typically in aggregated or pseudonymized form thereafter.

9. Your Privacy Rights

9.1 If You Are in the EU/UK (GDPR/UK GDPR)

You have the right to:

- Request erasure ("right to be forgotten")

- Restrict or object to certain processing

- Withdraw consent at any time

Your local data protection authority is generally the one for the country where you live, work, or where the alleged issue occurred — for example, the ICO in the UK, the IMY in Sweden, the DPC in Ireland, or the CNIL in France. [Insert the authority most relevant to your company's home jurisdiction, and note that EU/UK visitors may instead contact the authority where they live.]

9.2 If You Are in California (CCPA/CPRA)

You have the right to:

- **Know** what personal information we collect, use, and disclose

- **Delete** personal information we hold about you, subject to certain exceptions

- **Correct** inaccurate personal information

- **Opt out** of the "sale" or "sharing" of personal information (including cross-context behavioral advertising)

- **Limit** the use of sensitive personal information (if applicable)

- Not be discriminated against for exercising these rights

**To opt out of sale/sharing:** [Insert link to "Do Not Sell or Share My Personal Information" mechanism, or state that you honor Global Privacy Control signals.]

To exercise any of these rights, you or your authorized agent may contact us at privacy@spicykoalagames.com. We may need to verify your identity before fulfilling certain requests. An authorized agent must provide signed written authorization from you, or proof of power of attorney, before we will act on their request.

9.3 Other Jurisdictions

If you reside elsewhere (e.g., Canada, Brazil, or other regions with applicable privacy laws), you may have similar rights under local law. Contact us and we will address your request in accordance with applicable legal requirements.

10. Third-Party Platforms and Game Storefronts

If you purchase or download our games through **Steam, Epic Games Store, console storefronts, or mobile app stores**, those platforms — not Spicy Koala— collect and process your payment information, account details, and purchase history under **their own privacy policies**. We encourage you to review:

- https://store.steampowered.com/privacy_agreement

If a storefront passes us a marketing opt-in you gave at checkout (for example, agreeing to receive news about our games when purchasing through that storefront), we will use that contact information only for the marketing purpose you consented to, in accordance with this Policy.

We may receive limited aggregated or anonymized sales/analytics data from these platforms (e.g., wishlist counts, regional sales figures), which does not identify you personally.

11. Children's Privacy

Our Site and games may appeal to a broad audience, including younger players, but our Site itself is **not directed at children under the age of 13** (or the relevant minimum age in your jurisdiction, e.g., 16 in parts of the EU), and we do not knowingly collect personal information directly from children through the Site (e.g., via our newsletter or contact form) without appropriate verifiable parental consent.

Where we do not have verifiable parental consent, we will only use a child's contact information to: (a) respond once to a request the child has made, after which we delete that information; (b) seek a parent's contact details in order to obtain consent or provide notice; or (c) as otherwise permitted by applicable law. We will never condition a child's use of the Site on the child disclosing more personal information than is reasonably necessary.

If you believe a child has provided us personal information without appropriate consent, please contact us at privacy@spicykoalagames.com and we will take steps to delete it.

Note: any in-game data collection within our published games is governed by the privacy policy specific to that game/platform, which may differ from this Site policy.

12. Data Security

We implement reasonable technical and organizational measures designed to protect personal information against unauthorized access, alteration, disclosure, or destruction. Depending on the system involved, these measures may include access controls, encryption of data in transit (e.g., TLS/SSL on our store and forms), firewalls, and monitoring for unauthorized access. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

13. International Data Transfers

Your information may be processed in countries other than your own, including [the United States / Country of Hosting], which may have different data protection laws than your jurisdiction. Where required (e.g., for EU/UK personal data transferred internationally), we rely on appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms. Details of these safeguards are available on request from the contact in Section 15.

14. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices or for legal/regulatory reasons. The "Last Updated" date at the top reflects the most recent revision. Material changes will be highlighted on the Site or communicated via email where appropriate.

15. Contact Us

If you have questions, concerns, or requests regarding this Policy or our data practices, please contact:

Spicy Koala

Email: privacy@spicykoalagames.com

Address:

LDB Accountants & Advisors Level 1
1-3 Albert Street Blackburn, VIC 3130
Australia

We aim to respond to all privacy requests within [e.g., 30 days], or sooner where required by applicable law. EU/UK residents may also have the right to lodge a complaint with their local supervisory authority (see Section 9.1).