Privacy Policy
1. Who we are
Swimcraft is a fishing simulation game developed and published by Harbledown Digital ("we", "us", "our"), a sole trader business operated by Elliott Lee in the United Kingdom. We are the data controller responsible for your personal data when you play Swimcraft.
2. What data we collect
Account & identity
A Swimcraft account is required to play. It is what saves your progress, holds your catches, and puts your name against a record.
- Email address — used to create your account, verify it (we send a 6-digit code), let you sign back in, and reset your password. We also use it for essential service messages.
- Password — handled by our authentication provider (Supabase) and stored only as a secure hash. We never see, and cannot recover, your password.
- Sign in with Google or Apple (optional alternative) — if you use these, we receive an account identifier and your email address from that provider. We do not receive your Google or Apple password.
- Display name (angler name) — the name you choose. This is public. It appears against your catches, records and leaderboard entries, and against any venue you publish. Choose a name you are happy for other players to see; it does not have to be your real name.
- Avatar and preferences — your chosen avatar and settings (e.g. units, lb/oz vs metric).
Swimcraft is sold through Steam, but you do not sign in to Swimcraft with Steam. We do not receive your Steam password, your Steam email, or any payment details — purchases stay entirely with Valve.
Gameplay data
- Catch records — every fish you catch is written to your catch history: species, weight, venue, peg/swim, date and time, the tackle and bait used, and an image of the fish. Your catch history is private to you (see section 3).
- Venues you create — venue name, description, location text, country, the photographs you upload, the depth and geometry you paint, water conditions, pegs, and fish stocking data.
- Named specimens — the names you give to individual fish, which other players may see when they catch them in your venue.
- Progression — XP, level, achievements, and personal bests derived from the above.
Photographs and images
Two kinds of image are involved, and both can end up in front of other players:
- Venue photographs. When you create a venue you upload photographs of a real location. If that venue is published, those photographs become part of a playable venue that other players can fish.
- Fish images. An image of the fish is stored with each catch. If that catch sets a record, the image is shown on the public record.
Reports and moderation records
If you report another player's content, or if your own content is flagged by our automated checks or reported, we keep a record of the report, the content in question, and the decision we took. See section 6.
In-game chat
In-game chat is planned for a future Early Access update and is not active in the current version. We do not currently collect or store chat messages. When it launches, this policy will be updated before it goes live, and messages will be moderated (section 6).
Technical data
We keep technical data to a minimum. We do not maintain analytics or profiling logs, and we do not track you across other sites. Our backend provider (Supabase) processes the technical information necessary to operate the database and the authentication service, including the connection data inherent in serving a request.
Website email sign-up (optional)
If you sign up for updates on our website, we collect the email address you provide, solely to send occasional news about Swimcraft. This is separate from your game account. You can unsubscribe or ask us to delete it at any time.
3. What is public, and what is private
This is the section worth reading twice. Swimcraft has global, national and venue leaderboards, so some data is public by design — but a lot less of it than you might assume.
| Data | Who can see it |
|---|---|
| Your full catch history (every fish, every session, with all the tackle detail) | Only you. This is enforced in the database, not just in the interface — the catches table is readable only by the account that owns the row. |
| A record-setting catch (venue record, national record, world record) | Public. Only these fields are published: your display name, the species, the weight, the venue, the peg/swim, and the fish image. |
| A published venue — its name, description, location, country, photographs, pegs, stocking and named fish, and your display name as its creator | Public to other players. |
| Your display name, avatar and level | Public wherever you appear (records, venues, and future chat). |
| Your email address, password, and preferences | Never public. Never shown to other players, never sold, never shared for marketing. |
A catch is only ever published if it beats a record. Ordinary catches stay private. Nothing in your catch history is published because of the date, the time, the conditions, or the tackle you used.
4. Why we process your data, and our lawful basis
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Create and authenticate your account; save and restore your progress | Contract (Art. 6(1)(b)) |
| Store your catches, venues and progression; run records and leaderboards | Contract |
| Publish player-created venues and record-setting catches to other players | Contract |
| Moderate content, act on reports, remove unlawful or unacceptable material, and enforce our rules — including keeping a record of enforcement so it isn't simply repeated | Legitimate interests (Art. 6(1)(f)) — keeping the game safe and lawful for everyone; and legal obligation where online safety law applies |
| Keep an anonymised record on a leaderboard after an account is deleted, so the board stays accurate | Legitimate interests — the integrity of a competitive record board (see section 8) |
| Diagnose errors, secure the service, prevent fraud and cheating | Legitimate interests (Art. 6(1)(f)) |
| Send you essential account emails (verification, password reset) | Contract |
| Send you website updates you asked for | Consent (Art. 6(1)(a)) — withdraw any time |
| Comply with legal obligations | Legal obligation (Art. 6(1)(c)) |
We do not sell your personal data. We do not use it for advertising.
5. Who we share it with
We use a small number of trusted third parties to run Swimcraft. These act as our data processors:
- Supabase — our backend database, file storage and authentication (hosted in the EU, Frankfurt, Germany). Holds your account, gameplay data, records, and uploaded photographs.
- Resend — sends our transactional emails (account verification codes, password resets) from no-reply@swimcraft.harbledowndigital.com.
- Valve Corporation (Steam) — distribution and store platform. Your purchase and your use of Steam are governed by Valve's own privacy policy.
- Formspree — processes the optional email sign-up form on our website. Website only, not the game.
Other players can see exactly what section 3 lists as public — and nothing more.
6. Player-created content and moderation
Swimcraft lets players upload photographs and write text (venue names, descriptions, fish names, display names, and — in a future update — chat messages) that other players can see. That makes us responsible for keeping that content lawful and acceptable, and it is a responsibility we take seriously.
- Content that is unlawful, abusive, hateful, sexual, violent, or otherwise inappropriate is not permitted. Nor is anyone else's copyrighted photograph, or a photograph of an identifiable person who has not agreed to it.
- Player-created venues are checked before they are published. Text is screened automatically; photographs are screened before a venue can go live.
- Every piece of public player content can be reported. We review reports and can remove content, unpublish a venue, remove a record, or suspend or terminate an account.
- We keep a record of reports, flagged content and the decisions we make, so that enforcement is consistent and we can meet our obligations under UK online safety law.
The full rules on what you may and may not upload live in our Terms of Use and Community Guidelines. If you disagree with a moderation decision, contact us and we will look at it again.
7. International transfers
Your data is stored and processed within the European Union (Frankfurt, Germany). The United Kingdom recognises the EU as providing an adequate level of data protection (an "adequacy decision"), so transfers of your data from the UK to the EU are permitted and protected under UK data protection law.
8. How long we keep it, and what happens if you delete your account
- Account, profile, gameplay and catch history: kept while your account is active.
- If you delete your account: we delete your account, your email address, your catch history, and your personal data within 30 days.
- One exception, and we want to be straight about it — records stay on the board. If you hold a venue, national or world record, deleting your account does not wipe the record. Instead, your name is removed and the record is re-attributed to "Deleted angler". The fish, weight, venue and peg remain. This keeps the leaderboards honest: a record that simply vanishes would silently promote someone else to a record they never actually beat. Once anonymised, the entry is no longer personal data.
- Venues you published: a published venue is content other players may be fishing. On deletion we can either remove it or anonymise its creator credit — tell us which you would prefer, and if you don't, we will anonymise it.
- Reports and moderation records: kept for up to 2 years, so that repeat behaviour can be recognised and so we can evidence our decisions if challenged.
- Website email sign-ups: kept until you unsubscribe or ask us to delete.
You can also export your data from within the game at any time.
9. Your rights
Under UK data protection law you have the right to access, rectify, erase, restrict or object to processing of your data, to data portability, and to withdraw consent where processing is based on it. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk.
To exercise any of these, contact us at info@harbledowndigital.com. We will respond within one month.
10. Children
Swimcraft is not directed at children under 13, and you must be at least 13 to create an account. Because the game includes player-created content that other players can see, we do not knowingly allow under-13s to hold accounts. If you believe a child under 13 has provided us with personal data, contact us and we will delete it.
11. Security
We take reasonable technical and organisational measures to protect your data. In particular: passwords are hashed by our authentication provider and never seen by us; database row-level security restricts your catch history to your own account; and the catch ledger is append-only, so records cannot be forged or tampered with by other players. No system is perfectly secure, but we work to protect your information and will notify you and the ICO of any breach as required by law.
12. Changes to this policy
We may update this policy as the game develops (for example, when in-game chat launches). We'll post the updated policy here and update the "last updated" date. Significant changes will be communicated in-game or via our Steam page.
13. Contact
Harbledown Digital (Elliott Lee, sole trader)
Tonford Manor Farm, Tonford Lane, Harbledown, Kent, CT2 9BH
info@harbledowndigital.com