Privacy Policy
Last updated 1 November 2026. Applies to the game Nobody's Toy (including its demo) and to this website.
The short version
- We collect as little as we can. No ads, no tracking cookies, and we never sell your data.
- The game uses your Steam ID and Steam name to run your account, your cloud save and your duels.
- Payments go through Steam. We never see your card or bank details.
- You can ask to see or delete your data at any time: contact@nobodystoy.com.
1. Who is responsible
The controller for your data under the EU General Data Protection Regulation (GDPR) is:
Erik Frison
Rotkäppchenweg 6
97084 Würzburg, Germany
Email: contact@nobodystoy.com
2. What we collect and why
Your Steam account ID and Steam name
- Why
- To log you in, keep your progress, and show your name to other players in duels and leaderboards.
- Legal basis
- Providing the game you asked for (Art. 6(1)(b) GDPR).
- Kept
- As long as your account exists. Deleted within 30 days of a deletion request.
Your game data
- What
- Your save: your toys, parts, packs, builds, the history of each item, fight results, ranks and titles.
- Why
- To run the game, keep your cloud save, let your saved build fight in duels while you're away, and check that fight results are fair.
- Legal basis
- Providing the game (Art. 6(1)(b) GDPR).
- Kept
- As long as your account exists. Deleted within 30 days of a deletion request.
Purchase records
- What
- What you bought, the price, the time and the Steam order number. Steam handles the payment itself.
- Why
- To deliver what you bought, handle refunds, and keep the records tax law requires.
- Legal basis
- Providing the game (Art. 6(1)(b)) and legal obligations (Art. 6(1)(c) GDPR).
- Kept
- Up to 10 years, as German tax law requires, even if you delete your account.
Anonymous play events
- What
- A random install number (not linked to your Steam account), the game version, and which steps of the first chapter you reached, with the time.
- Why
- To see where players stop, so we can fix those parts of the game.
- Legal basis
- Our legitimate interest in improving the game (Art. 6(1)(f) GDPR).
- Kept
- Up to 24 months.
Crash reports, only if you press Send
- What
- The game version, your operating system and hardware, and the error log. Before you send it, the game removes your name, your user folder and your PC's name, and shows you the report.
- Why
- To find and fix crashes.
- Legal basis
- Your consent (Art. 6(1)(a) GDPR). Nothing is sent unless you choose to.
- Kept
- 12 months.
Server logs
- What
- Your IP address, the time and the request, when the game talks to our servers.
- Why
- To keep the servers running and secure, and to stop cheating and abuse.
- Legal basis
- Our legitimate interest in a secure, fair game (Art. 6(1)(f) GDPR).
- Kept
- 14 days, longer only for a specific security incident.
Emails you send us
- Why
- To answer you.
- Legal basis
- Our legitimate interest in answering (Art. 6(1)(f) GDPR).
- Kept
- As long as needed to answer, at most 2 years.
We don't ask for your real name, address or birthday in the game, and we don't use your data for advertising.
3. What other players can see
Your Steam name, your toy and its build, your titles, your rank and your duel results. Your saved build can be chosen as an opponent by other players while you're offline.
4. Who else handles data
- Valve (Steam) handles login, payments and your Steam profile under its own rules: Steam Privacy Policy.
- Our server host stores your account and game data for us under a data processing contract (Art. 28 GDPR). We will name it here before the game's online features go live.
- Cloudflare delivers this website and briefly processes your IP address to deliver and protect it.
We never sell your data, and we don't use ad networks or data brokers.
5. Data outside the EU
Valve and Cloudflare are US companies. Where data goes to the US, it's protected by the safeguards those companies provide, such as the EU-US Data Privacy Framework or the EU Standard Contractual Clauses.
6. Cookies
This website sets no cookies and uses no analytics. The game uses no advertising or tracking IDs.
7. Children
Steam accounts are for people aged 13 and over. We don't knowingly collect data from younger children. If you think we have, write to us and we'll delete it.
8. Your rights
You can ask us to:
- show you the data we hold about you and give you a copy (Art. 15 and 20 GDPR);
- correct it (Art. 16);
- delete it (Art. 17);
- limit how we use it (Art. 18);
- stop using it where we rely on our legitimate interest (Art. 21).
You can withdraw consent for crash reports at any time; just stop sending them, and ask us to delete ones you sent.
To use any of these rights, email contact@nobodystoy.com with a link to your Steam profile, so we can find your account. We answer within one month.
Deleting your account removes your Steam ID link, your save, your builds and your ranks within 30 days. Purchase records stay for as long as tax law requires. Anonymous play events can't be linked to you, so they stay.
You can also complain to a data protection authority. Ours is the Bavarian State Office for Data Protection Supervision (BayLDA), lda.bayern.de.
9. Automated decisions
The game matches duel opponents by power automatically. This has no legal or similarly significant effect on you, and we make no other automated decisions about you.
10. Security
Data travels encrypted between the game and our servers, and access to the server data is limited to us and our server host.
11. Changes
If this policy changes, we update this page and its date. Big changes are announced in the game and on the Steam page.