Privacy policy

1. Who is responsible for your data

The controller of your personal data is Bartosz Bilejczyk, a sole trader, ul. Sucha 5, 64-920 Piła, Poland, VAT ID PL1182221918, owner of the Together Games and Popcorn Sheep brands ("we"). For anything about your personal data, e-mail hello@togethergames.eu, call +48 665 266 378 or write to the address above.

2. What data we collect, why, and on what legal basis

Cart and order - the contents of your cart, a discount code, the site language and your IP address, which we pass to Shopify when handling the cart (fraud prevention and country detection). Basis: steps taken at your request before a contract and its performance (Art. 6(1)(b) GDPR).

Visit source - when you add the game to your cart, we store in the cart the landing page address, the referring page, campaign tags (UTM), the Google or Meta ad click ID and your cookie banner choice. This tells us where a paid order came from. Basis: our legitimate interest in measuring our sales and the channels that bring them (Art. 6(1)(f) GDPR).

Pre-order reminder - your e-mail address, language and where on the site you signed up. We send you a reminder when the pre-order opens and news about Popcorn Sheep. Basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with the unsubscribe link in any e-mail.

Sticker vote - your nickname, your votes and finished packs and, if you give it, your e-mail address, to which we send the stickers, the VIP code and news about the game. Basis: performing the service you ask for (Art. 6(1)(b) GDPR) and, for e-mails, your consent (Art. 6(1)(a) GDPR).

Analytics and ads with cookies - information about your device, browser and how you use the site. Basis: your consent given in the cookie banner (Art. 6(1)(a) GDPR).

Anonymous statistics without cookies - described in section 3. Basis: our legitimate interest in basic visit statistics (Art. 6(1)(f) GDPR).

Security - a request limit per IP address, technical server logs and the data needed to establish, exercise or defend legal claims. Basis: our legitimate interest (Art. 6(1)(f) GDPR).

Giving us your data is voluntary. Without an e-mail address we cannot send the reminder or the stickers. We do not make decisions about you based solely on automated processing that have legal effects.

3. Cookies and browser storage

Essential - always on, no consent needed: ps_consent (your banner choice, 180 days), ps_cart and ps_has_cart (cart, 10 days), ps_vip and ps_vip_on (VIP code from a link, 30 days). The sticker vote keeps your progress, nickname and the e-mail you gave in your browser storage, so you do not start over when you come back.

Analytics (Google Analytics 4, PostHog, including a recording of the visit with form fields masked) and marketing (Meta pixel) - we only start them after your consent: clicking "Accept" or switching the category on in "Customize". Without analytics consent, visits are not recorded.

Without your consent we store no analytics or marketing cookies on your device. Google Analytics 4 then only receives cookieless signals with no user identifier, and PostHog counts visits and clicks anonymously: the visit ID is created on the PostHog server as an irreversible hash of the IP address, browser data and a daily changing random value, so visits from different days cannot be linked.

You can change your choice at any time under "Cookie settings" in the site footer.

4. Who we share data with

We use companies that process data on our behalf or as separate controllers:

Netlify, Inc. (USA) - site hosting; like any server it sees your IP address and browser data.

Google Ireland Limited - the server of our voting and sign-up system (Google Cloud, EU region), Google Analytics 4 and Google Ads (cookies only with your consent).

Supabase, Inc. - the sticker vote database.

Shopify International Limited (Ireland) - cart, checkout and order handling. Shopify also processes some data as a separate controller; details: privacy.shopify.com/en

Klaviyo, Inc. (USA) - sending reminders, stickers and e-mails.

PostHog, Inc. (data stored in the EU, in Frankfurt) - visit statistics.

Meta Platforms Ireland Limited - the Meta pixel and ads on Facebook and Instagram (only with your marketing consent).

We may also share data with public authorities where the law requires it.

5. Transfers outside the European Economic Area

Some of our providers (e.g. Netlify, Shopify, Google, Meta, Klaviyo) may process data outside the European Economic Area, including in the USA. In those cases the data is protected by a European Commission decision (e.g. the EU-US Data Privacy Framework) or by standard contractual clauses approved by the European Commission.

6. How long we keep data

Cookies - for the period given in section 3 or until you delete them in your browser.

E-mail address for reminders and news - until you unsubscribe.

Nickname and votes - while we run sticker votes or until you ask us to delete them.

Analytics data - no longer than needed for statistics.

Data processed on the basis of consent - until you withdraw it.

7. Your rights

You have the right to access your data, to have it corrected, erased, restricted and ported, and to object to processing based on our legitimate interest. You can withdraw consent at any time; this does not affect processing carried out before you withdrew it. To use these rights, e-mail hello@togethergames.eu.

You can also lodge a complaint with the Polish data protection authority, Prezes Urzędu Ochrony Danych Osobowych (ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl), or with the authority in your EU country.

8. Children's data

The game is for ages 12+, but only people aged 16 or over may give us an e-mail address (reminder, sticker vote). If you are a parent or guardian and believe a child has given us their data, write to us and we will delete it.

9. Changes to this policy

We may update this policy, for example when we change tools or when the law requires it. The current version is always on this page, and the date at the top shows the last change.