Privacy Policy

Last updated 12 October 2026

This policy explains what personal information Pete Jackson ("we", "us") collects when you use Thermocline and playthermocline.com (the "Service"), what we use it for, and your choices. The short version: we collect little, we use it to run the game and to tell you about our own games, and we never sell your personal information.

1. What we collect

• Your email address, when you join the waitlist, accept an invite or sign in, and the note you choose to add to the waitlist form.
• Your account: your role (playtester or admin), when you joined and were approved, how you arrived (the waitlist, an invite), when you were last seen, and what content your account may play.
• Passkeys: if you add one, we store its public key, an identifier, a counter, the date it was made and last used, and a label such as the kind of device. Your fingerprint, face or device PIN never leaves your device; we never receive them.
• Sign-in: while you are signed in, a session cookie. We store only a scrambled (hashed) copy of its token and the browser's user-agent string. For an email sign-in link we store only a hashed copy of the link's token, and it expires after 15 minutes. Sessions last up to 30 days.
• Gameplay statistics: what you play and how it goes. That covers campaigns and patrols started, finished, replayed or skipped, difficulty, outcomes, career awards, the game's version, a random identifier for your browser and a random one for each visit, and your account's email when you are signed in. In the EU, the EEA, the UK and Switzerland we collect these only if you agree, when the game first asks; everywhere else they are on unless you turn them off. You can change your answer at any time in the game's Settings (Statistics); saying no also deletes the browser identifier and anything not yet sent.
• Feedback you send from the game: ratings and notes.
• Abuse protection: a one-way hash of your IP address when you join the waitlist, used only to limit repeated sign-ups. The bot check on our forms (Cloudflare Turnstile) looks at signals from your browser to tell people from bots.
• Thermocline Radio: when you listen, open the radio page or download its playlist, we record when, for how long, the kind of player app (from its user-agent string), the referring site, and your approximate location (country, region and city, estimated by our hosting provider from your IP address). To count unique listeners we keep a one-way hash of your IP address and user-agent, made with a secret and changed every day; we do not store the IP address itself.
• Purchases, when they open: what you bought and when. Your card details go to the payment processor, not to us.
• Technical data our hosting provider handles to deliver the site, such as your IP address and request logs, under its own policy.

Your progress (campaigns, career, records and any patrol saved part-way) is kept with your account, so it follows you to every device you sign in on. We also keep earlier versions of it, at most one every half hour and the last 30, so you can restore one from your account page. Your settings stay in each browser.

2. What we use it for

• To run the Service: create and secure your account, sign you in, decide what you may play, and stop abuse, fraud and piracy.
• To run the playtest: invite people, understand how the game is played, find bugs and decide what to change.
• To contact you about your account, the playtest and changes to the Service or these policies.
• For our own marketing: to send you news, launch announcements, offers and invitations about Thermocline and our other games, and to describe the game publicly using statistics and feedback, without naming you unless you agree. You can unsubscribe from marketing email at any time using the link in it or by writing to us; we will still send messages about your account.
• To meet legal duties, enforce our Terms of Use and defend our rights.

Where the law asks for a legal basis (as in the UK and EU), we rely on: performing our contract with you (running your account and the game); our legitimate interests (security, improving the game, and marketing our own games to people who have signed up); your consent, where we ask for it; and legal obligations.

3. What we never do

We do not sell your personal information, and we do not share it with others for their own marketing or for cross-context behavioural advertising. We do not use advertising or third-party tracking cookies.

4. Who else handles it

We share personal information only with providers who run parts of the Service for us and may use it only for that. They are Cloudflare (hosting, our database, video storage, the bot check), our email delivery provider and, when purchases open, our payment processor. We may also disclose information when the law requires it, to protect the Service, our users or our rights, or to a successor if the game or business is sold or transferred, in which case this policy continues to apply to it.

5. Cookies and browser storage

We use a small number of essential cookies: the session cookie that keeps you signed in, and a short-lived cookie used while you set up or use a passkey. The game also keeps your saves, settings, a queue of unsent statistics and a random browser identifier in your browser's local storage. You can clear these in your browser at any time; you will be signed out and lose local progress.

6. How long we keep it

We keep your account for as long as it is open, and delete it when you ask us to, unless we need to keep some information to meet legal duties, resolve disputes or enforce our terms. That includes a record of an account closed for piracy or abuse. A waitlist entry is kept until we decide on it and for as long as is useful afterwards. Expired sessions and sign-in links are worthless and are cleared over time. Gameplay statistics and feedback may be kept for as long as they help us develop the game, and may be kept indefinitely once they no longer identify you.

7. Your choices and rights

You can ask us to show you, correct, export or delete the personal information we hold about you, and to stop sending you marketing. Depending on where you live (for example in the UK, the EU, or California and other US states with privacy laws), you may have further rights:

• to object to or restrict some uses;
• to withdraw consent;
• to not be treated differently for using your rights;
• to complain to your data protection authority.

Write to the address below; we may need to check that the request comes from you. We do not sell or "share" personal information as California law defines it, so there is nothing to opt out of. We honour Global Privacy Control signals as a request not to sell or share.

8. Security

We protect your information with care, for example:

• passkeys and one-time email links instead of passwords;
• storing only hashes of session and sign-in tokens;
• encrypted connections;
• access limited to the people who run the Service.

No system is perfectly secure, and we cannot promise that your information will never be accessed without permission.

9. Where it is processed

We are based in the United States, and our providers run global networks. Your information may be processed in the United States and in other countries whose data protection laws differ from yours. Where the law requires it, we rely on appropriate safeguards for these transfers.

10. Children

The Service is not meant for children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has given us information, tell us and we will delete it.

11. Changes

We may update this policy. The new version applies from when it is posted here, with the date at the top. If a change is significant, we will tell you by email or in the Service.

12. Contact

Privacy questions and requests: support@playthermocline.com.