Xenobiome Privacy Policy
The short version: no account, no ads, no third-party tracking, no data sold. The game collects anonymous gameplay statistics you can switch off in Options, and sends a bug report only when you write one and press Send.
Who is responsible
Xenobiome is made by Haroldware Solutions Kft. ("we"), the data controller for the processing described here.
Contact: support@xenobiome.net
(or the contact form)
Company registration: 06-09-030350
What we do not do
- No user accounts, logins, or profiles.
- No name, address, phone number or date of birth is requested by the game. It asks for an email only as an optional field in a bug report or to enter the demo's Steam key draw.
- No advertising, no advertising SDKs, no ad identifiers (no IDFA, no Google Advertising ID).
- No hardware identifiers, no device fingerprinting, no location data, no contacts, no photos, no microphone or camera access.
- No tracking of you across other apps or websites.
- We never sell or rent data, and we do not share it for advertising or marketing purposes.
1. Anonymous gameplay statistics
To find out where the game confuses or frustrates people, it can send anonymous gameplay events. The browser version asks first and sends nothing until you allow it. The Steam and mobile versions have it on by default. In every version it can be turned off at any time.
The install identifier
The first time you launch the game it generates a random identifier (a UUID, from a random number generator) and stores it on your device. It is not derived from anything about you or your hardware, it is not linked to any account, and it cannot identify you personally. It exists so that ten events from one installation are not counted as ten separate players. Reinstalling the game produces a new identifier and severs the link to the old one.
In the browser version the identifier is created only after you allow statistics, and it is kept in your browser's local storage together with your saves and settings. The browser version sets no cookies. Clearing the site data for play.xenobiome.net deletes the identifier.
What each event contains
Every event carries the install identifier, a session identifier, the platform (iOS, Android,
desktop or web), the app version, which store build you have, and whether it is the demo. If you
arrived through a link with a tag such as ?src=reddit, that short tag is kept on your
device and added to events so we can tell which channels bring players. On top of that:
| Events | Additional contents |
|---|---|
Sessions (app_open, session_end) | Session length, and how many errors the session hit |
Tutorial (tutorial_step, tutorial_complete, tutorial_abandon) | Which tutorial card you reached |
Runs and progress (run_start, run_continue, run_retry, run_next_region, run_end, run_abandon, first_win, level_reached, pace_mode_selected, fast_forward, build_cancelled, doctrine_taken, secret_found, star_sink, cosmetic_bought, daily_drop_start, daily_drop_end, demo_carryover) | In-game choices and results: map, commander, trait, difficulty, pace, outcome, days survived, score, stars, and which building, doctrine, secret or cosmetic was involved. Cosmetics are bought with in-game stars, not money. |
Settings (graphics_setting, graphics_auto_tier, key_rebind, hints_reset) | Which setting changed and its new value |
Performance (perf_summary) | Frame rate statistics, graphics settings, device model, operating system version, screen size and text scale |
Errors (app_crash, font_load_failed, save_failed, save_unreadable, save_restored_from_backup, storage_parse_failed, storage_mirror_fallback) | The error message and stack trace, the last 15 warning lines the game logged, the save format version, device model, operating system version, screen size and text scale |
Demo (wishlist_click) | Which wishlist button you pressed |
Nothing else is transmitted: not your saves, not your device name, not your IP address beyond the ordinary network connection described below.
How to turn it off
Options -> "Anonymous usage data" -> OFF. The setting persists, takes effect immediately, and discards anything not yet sent. Nothing about the game changes when it is off.
2. Bug reports
The game has a "Report a bug" screen in Options. Nothing is sent from it unless you write a report and press Send. Before sending you can expand "What gets sent" to read the exact, complete contents of your report.
A report contains:
- The problem category and the description you typed.
- An email address only if you choose to type one. It is optional, blank by default, and used solely to reply to you about your report.
- Technical context: app version, platform, operating system version, screen size, language, and whether the build is a desktop or mobile one.
- Game state: which screen you were on, and for an active run the map, difficulty, commander, trait, map seed, day number and Command level. This lets us rebuild the exact situation and reproduce the bug.
- The most recent 120 warning and error lines the game logged internally. These are the game's own diagnostic messages. They do not contain your files, your keystrokes, or anything from outside the game.
- The install identifier described above.
Because the game is fully playable offline, a report you write without a connection is saved on your device and sent the next time the game is online. If it cannot be delivered within 14 days it is discarded from your device. You can also copy or share the report text yourself and send it to us by any route you prefer.
Bug reports are sent even if you have turned anonymous usage data off. Writing a report and pressing Send is a deliberate request for help, and we treat it as your consent for that one message. If you would rather not send anything at all, do not use the bug report screen.
3. Demo feedback and the Steam key draw
The demo has a "Share feedback" screen with a short survey. Nothing is sent from it unless you answer at least one question and press Send. A feedback entry contains:
- Your answers: the choices you picked and anything you wrote.
- An email address only if you enter the Steam key draw. If you do not tick the draw box, no email is sent, even if you typed one.
- The same technical context and game state as a bug report (see above), plus which demo maps you have won, how many runs you have played and for how many in-game days, and how long the current session has lasted.
- The install identifier described above.
Like bug reports, feedback is sent even if you have turned anonymous usage data off, and an entry written offline is kept on your device and sent later. If it cannot be delivered within 30 days it is discarded.
The draw email is used only to run the draw and contact winners, and is deleted by 31 January 2027. The legal basis for it is running the draw you entered (GDPR Article 6(1)(b)). The draw rules say who can enter and how winners are picked.
4. The contact form on this website
The contact form at xenobiome.net sends us the subject you pick, your message, your email address, your name if you give one, and the country your request came from. It is delivered to our support inbox as an ordinary email; nothing from the form is stored in a database or added to any mailing list. We keep the correspondence until the matter is closed and for up to 24 months after, the same as an email you send us directly. The legal basis is our legitimate interest in answering people who write to us (GDPR Article 6(1)(f)).
To keep the form from being used by spam robots it is protected by Cloudflare Turnstile, which decides whether a submission looks automated. Turnstile is a privacy-first alternative to reCAPTCHA: it sets no cookies for advertising, does not build a profile of you, and the signals it collects are used only to score that one submission. Writing to support@xenobiome.net from your own mail client avoids it entirely.
5. Who processes this data
| Processor | Purpose | Where |
|---|---|---|
| PostHog | Receives and stores the gameplay events, bug reports and demo feedback on our behalf | European Union (eu.i.posthog.com) |
| Cloudflare | Hosts xenobiome.net and play.xenobiome.net, relays the browser version's events to PostHog, runs the contact form and its Turnstile anti-spam check, and delivers and forwards email for our support address | Global network |
Both act under contract on our instructions and may not use the data for their own purposes. Data is stored in the EU. As with any internet connection, the receiving server necessarily sees the IP address your device connects from; it is used for delivery and coarse country-level statistics and is not used to identify you.
The stores you buy the game from - Valve (Steam), Apple (App Store) and Google (Google Play) - collect their own data under their own privacy policies, which we do not control. Purchases, refunds and payment details are handled entirely by them; we never see your payment information.
6. Legal basis and retention
Where the GDPR applies, our legal basis is your consent (Article 6(1)(a)) for anonymous usage data, which you may withdraw at any time in Options, and for bug reports, which you send by an explicit act, and for demo feedback, which you also send by an explicit act. Event data and feedback answers are retained for up to 24 months and then deleted. Bug reports are kept until the issue is resolved and for up to 24 months thereafter. Draw emails are deleted by 31 January 2027.
7. Children
Xenobiome is not directed at children under 13, and we do not knowingly collect data from them. The game asks for no personal information at all, so no such data is gathered in the ordinary course of play. If you believe a child has sent us personal information through a bug report, write to us and we will delete it.
8. Your rights
If you are in the EU, EEA or UK you have the right to access, correct, delete, restrict and port your data, to object to processing, to withdraw consent, and to lodge a complaint with your national supervisory authority. Elsewhere, comparable rights may apply under local law; we honour these requests regardless of where you live.
To exercise them, write to support@xenobiome.net - or use the contact form - and quote your install identifier. The game shows it in Options, under "Install ID"; clicktap it to copy. Everything we hold is keyed to that identifier and nothing else, so quoting it is what lets us find your records - and, since it is a secret held only on your device, what lets us confirm they are yours. Deleting the game, or turning off usage data, ends collection immediately in any case.
9. Changes
If this policy changes materially we will update the date at the top and note the change here. The version in effect when you play is the one that applies.