Privacy Policy
Detective Redstring is a single-player detective game. This policy explains what personal information we collect when you play, why we collect it, who we share it with, and the choices and rights you have — including under the EU/UK GDPR, the California CCPA/CPRA, and other US state privacy laws. We collect only what the game needs to run, we do not sell your personal information, and you can download or delete your data at any time.
1. Who we are
Detective Redstring (“we,” “us,” or “the game”) is the developer and operator of this game. We are the party responsible for the personal information described in this policy. If you have any questions, you can reach us at privacy@detectiveredstring.com.
2. Information we collect
a. Information you give us
- Account details. The email address and password you use to create an account. Passwords are stored only as a salted hash — we never store your password in plain text.
- Detective profile. When you set up your detective, we collect the display name and avatar you choose, and the optional onboarding answers you provide — an age range, gender (including a free-text option if you self-describe), your experience level with detective games, your primary device, and how you heard about us. These optional answers help us tune difficulty and improve the game; you can skip them.
- Communication and marketing preferences. Whether you have opted in to marketing emails or to playtest invitations, and the version of the notice you agreed to. Marketing opt-in is always a separate, unchecked choice.
- Waitlist. If you join our waitlist, we collect the email address you submit so we can tell you when we launch.
b. Information created as you play
- Gameplay records. The cases and sessions you start, the clues and scenes you examine, the hints you request, the evidence you present, and your accusations and their outcomes.
- Your free-text inputs. The questions you type to witnesses during interrogation, the free-text actions you take at a scene, the notes and labels you add to your corkboard, and the words you use to name a suspect, method, and motive. Please avoid typing sensitive personal information into these fields — they are meant for the fiction of the game.
c. Payment information
Purchases and subscriptions are processed by Lemon Squeezy, which acts as our Merchant of Record. This means Lemon Squeezy — not us — collects and processes your payment details (such as your card number and billing address). We never receive or store your full card number. From Lemon Squeezy we receive only your subscription status, plan, renewal date, and opaque customer and subscription identifiers, so we know what you are entitled to play. Your payment is also subject to Lemon Squeezy’s privacy policy.
d. Information collected automatically
- Technical and log data. Basic information your device sends when you use the game, such as your IP address, browser and device type, and an approximate locale and time zone. We use your IP address for security, abuse prevention, and rate-limiting.
- Cookies. We use a small number of strictly necessary cookies to keep you signed in and secure. See Section 7.
3. How and why we use it
We use your information for the purposes below. For players in the EU/UK, the legal basis for each purpose is shown in the right-hand column.
| Purpose | Legal basis (EU/UK GDPR) |
|---|---|
| Create and secure your account; let you sign in | Performance of our contract with you |
| Run the game — save your progress, run interrogations, generate scene narration and hints | Performance of our contract with you |
| Process purchases and manage subscriptions and entitlements | Performance of our contract; legal obligation (tax/accounting records) |
| Prevent fraud and abuse, secure the service, enforce our Terms, and debug problems | Our legitimate interests in a safe, working service |
| Understand and improve the game (analytics on cost, performance, and outcomes) | Our legitimate interests in improving the game |
| Send marketing emails or playtest invitations | Your consent (which you can withdraw at any time) |
| Comply with the law and respond to lawful requests | Legal obligation |
4. AI processing of your gameplay
Detective Redstring uses artificial intelligence to bring witnesses, scenes, and hints to life. When you type a question to a witness or an action at a scene, that text is sent to our AI provider, Microsoft Azure OpenAI Service, to generate the in-game response. A few things to know:
- Your inputs are treated strictly as game data, not as instructions, and are used to produce the in-game response you asked for.
- We do not use your inputs to train foundation AI models, and our AI provider does not use data sent through our service to train its foundation models.
- Our internal usage analytics record only technical measurements (such as token counts, cost, and latency) — notthe text of your questions or the witnesses’ replies.
The witnesses, suspects, and events in the game are fictional and AI-generated. Nothing they say is factual information about real people or a substitute for professional advice.
5. When we share information
We do not sell your personal information. We share it only in these limited ways:
Service providers (subprocessors)
We use a small set of vendors to run the game. They may process your information only on our instructions and for the purposes below:
| Provider | Purpose | What they receive |
|---|---|---|
| Microsoft Azure OpenAI | AI generation of witness dialogue, narration, and hints | Your in-game free-text inputs and the generated responses |
| Lemon Squeezy (Merchant of Record) | Payments, checkout, and subscription management | Payment and billing details you enter at checkout |
| Cloud hosting & storage | Running the service and storing game media and data | Account and gameplay data at rest |
| Error monitoring | Detecting and fixing crashes and bugs | Diagnostic data, with personal data and request bodies scrubbed |
Legal, safety, and business transfers
We may disclose information if required by law or valid legal process, to protect the rights, safety, and security of our players or the public, to enforce our Terms, or in connection with a merger, acquisition, financing, or sale of assets (in which case we will require the recipient to honor this policy).
6. We do not sell or share (as defined by law)
We do not sell your personal information, and we do not“share” it for cross-context behavioral advertising, as those terms are defined under the California CCPA/CPRA and similar laws. We do not use advertising cookies or third-party ad networks, and we do not knowingly sell or share the personal information of anyone.
7. Cookies and similar technologies
We use only strictly necessary cookies — chiefly the secure, HTTP-only cookies that keep you signed in and protect your session. We do not use advertising or cross-site tracking cookies. Because these cookies are essential to provide the service you request, they do not require consent, but you can clear them through your browser (doing so will sign you out).
8. International data transfers
We operate globally, and our providers may process your information in the United States, the European Union, and other countries. When we transfer personal information out of the EEA, the UK, or Switzerland, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (and the UK Addendum), together with additional measures where needed. You can ask us for more detail using the contact below.
9. How long we keep information
We keep your personal information for as long as your account is active and as needed to provide the game. When you close your account, we delete or de-identify the personal information associated with it. We may retain information that has been aggregated or de-identified so that it can no longer reasonably be associated with you, and we may retain limited records where the law requires it (for example, transaction records kept for tax and accounting purposes, which our payment provider also maintains).
10. Your privacy rights
Depending on where you live, you have some or all of the following rights over your personal information:
- Access / know — get a copy of the personal information we hold about you.
- Correction — fix inaccurate or incomplete information.
- Deletion / erasure — ask us to delete your account and personal information.
- Portability — receive your information in a portable, machine-readable format.
- Restriction / objection — limit or object to certain processing, including processing based on our legitimate interests.
- Withdraw consent — opt out of marketing or playtest emails at any time, without affecting the game.
We will respond within the time required by applicable law (generally within 30–45 days) and may need to verify your identity first. Exercising your rights is free and will never result in a lower level of service. If you are in the EEA or UK and believe we have not handled your information properly, you have the right to complain to your local data protection authority — though we hope you will contact us first.
11. California privacy notice
If you are a California resident, the CCPA/CPRA gives you the rights to know, delete, and correct your personal information, to opt out of the sale or sharing of your personal information, and to limit the use of sensitive personal information, along with the right not to be discriminated against for exercising them.
In the past 12 months, we have collected the categories of personal information described in Section 2 — identifiers (such as email), customer records (such as your detective profile), commercial information (such as purchases), internet or network activity (such as gameplay and device data), approximate geolocation, and audio-free text you enter in the game — for the business purposes in Section 3. We disclosed these categories only to the service providers in Section 5 for those purposes.
We do not sell or share your personal information, and we do not use or disclose sensitive personal information for purposes that would require a right to limit it. You may exercise your rights as described in Section 10. You may also designate an authorized agent to make a request on your behalf.
12. Other US state rights
If you live in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, or another US state with a comprehensive privacy law, you have comparable rights to access, correct, delete, and obtain a copy of your personal information, and to opt out of targeted advertising, sale, and certain profiling. As explained above, we do not sell your information, do not use it for targeted advertising, and do not engage in that kind of profiling. You may exercise your rights as described in Section 10, and — where your state provides one — you may appeal a decision by replying to our response.
13. Children
Detective Redstring is not directed to children under 13, and we do not knowingly collect personal information from them. You must be at least 13 years old to create an account, and if you are in the EEA or the UK you must be at least the age of digital consent in your country (which is 16 unless your country sets a lower age). If you believe a child has given us personal information, please contact us and we will delete it.
14. Security
We use technical and organizational measures designed to protect your information — including hashed passwords, encrypted connections, access-controlled storage, and payment handling by a specialized provider so that we never hold your card details. No system is perfectly secure, but we work to protect your information and to respond promptly if something goes wrong.
15. Changes to this policy
We may update this policy from time to time. When we make material changes, we will update the effective date above and, where appropriate, notify you in the game or by email. Your continued use of the game after an update means you accept the revised policy.
16. How to contact us
For any privacy question or to exercise your rights, contact us at privacy@detectiveredstring.com, and we will respond within the timeframe required by applicable law. If you are in the EEA or the UK and believe we have not resolved your concern, you also have the right to lodge a complaint with your local data protection authority.