This policy explains what personal data lastwaters.com collects, why, who it is shared with, how long it is kept, and what you can do about it. lastwaters.com is run by Odd Little Games (“we”, “us”), which is the data controller for the information described here.
What we collect
- Account details — your display name, email address, a hashed copy of your password, and, if you turn on two-factor authentication, its secret and recovery codes.
- What you do in the game — the games you join, the orders you submit, and the results of each turn.
- Messages — messages you send to other players, and reports you file about them.
- Preferences — your email notification and display settings, and which version of the Terms of Service you accepted and when.
- Newsletter consent — whether, and when, you asked to receive the Odd Little Games newsletter.
- Technical data — your IP address and browser user agent, recorded against your signed-in session and when your password is changed, and the time you were last active.
- Moderation records — if your account is reported, warned or suspended, a record of that and of the decision taken.
We do not collect payment details, and we do not ask for your real name, age or location.
Why we use it
- To run the game — creating your account, signing you in, resolving your orders, and delivering messages and the notification emails you have chosen. This is necessary to provide the service you signed up for.
- To keep the game safe — preventing automated sign-ups, limiting repeated sign-in attempts, telling you when your password changes, and handling reports of abuse. This is in our legitimate interest, and yours, in a service that is secure and free of harassment.
- To understand how the site is used — counting visits to improve the game. Analytics cookies are set only if you accept them (see Cookies).
- To send you the newsletter — only if you tick the box at sign-up or in your account settings. This is based on your consent.
We do not sell your data, and we do not use it for advertising.
Who we share it with
We share personal data only with the services we need to run lastwaters.com:
- DigitalOcean, through the xCloud hosting panel, which host our servers and database. In London Data Centre
- Mailgun, which sends our emails and so receives your email address and the content of each email.
- Cloudflare Turnstile, which checks that the sign-up and password-reset forms are used by a person and receives technical data from your browser to do so.
- Bunny Fonts, which serves the site’s typefaces and so receives your IP address when a page loads. It does not set cookies.
- Matomo, our analytics software, which we host ourselves, so visit data is not passed to a third party. London data center
- Substack, which publishes the Odd Little Games newsletter and receives your email address only if you opt in to it. Substack handles your subscription from then on: to stop receiving the newsletter, use the unsubscribe link in any issue.
Other players see your display name, your in-game actions as the game reveals them, and the messages you send them. We may also disclose data where the law requires it.
How long we keep it
- Your account is kept while it is open. When you delete it, it is closed immediately and permanently erased 30 days later; until then you can ask us to restore it.
- Games and messages are kept after your account is deleted, because they are part of other players’ games and conversations. Your name is removed from them and they are no longer linked to you.
- Sign-in sessions expire after 120 minutes of inactivity, unless you choose “remember me”.
- Moderation and deletion records are kept for 90days so we can deal with abuse and show that a deletion request was carried out.
Cookies
These cookies are essential, so they are set without asking:
lastwaterscom-session— keeps you signed in and holds your session. Expires after 120 minutes of inactivity.XSRF-TOKEN— protects forms against cross-site request forgery. Same lifetime as the session.remember_web_…— set only if you tick “remember me”, to keep you signed in between visits.lw_cookie_consent— remembers whether you accepted or declined analytics cookies. Expires after one year.
These analytics cookies are set only if you click Accept on the cookie banner:
_pk_id— recognises a returning visitor. Expires after 13 months._pk_ses— groups page views into a single visit. Expires after 30 minutes.
If you decline, Matomo still counts page views, but without cookies, so it cannot recognise you on a later visit. You can change your choice at any time with the Cookie settings link at the foot of the public pages.
Your rights
Under UK and EU data protection law you can ask us to:
- give you a copy of the personal data we hold about you;
- correct anything that is wrong;
- delete your data — you can also do this yourself from your account settings;
- give you your data in a portable, machine-readable form;
- stop or restrict using your data, or object to how we use it.
We will reply within one month. If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office (ico.org.uk) or the data protection authority where you live.
Children
lastwaters.com is not intended for children under 13. If you believe a child has given us personal data, contact us and we will delete it.
Changes to this policy
When this policy changes we will update the date at the top of this page. If a change affects how we use data you have already given us, we will tell you by email before it takes effect.
Contact
For privacy questions or to exercise any of your rights, email [email protected].