Privacy Policy

1. Who we are

This policy covers Golden Carrack on supported mobile and desktop platforms and the website concatgames.eu. Concat, trading as CONCAT Games, is responsible for the website and support-related personal data described here.

2. Privacy inside the game

Golden Carrack is a single-player game with computer-controlled opponents. We do not collect names, email addresses, location, advertising identifiers or gameplay activity through the game. It does not require registration, contain advertising, or send gameplay analytics or automatic crash reports to us.

Settings, game progress and saves are stored locally. Local game statistics describe the fictional captains and their progress; they are not tracking of you. Computer-controlled opponents make gameplay decisions locally, not decisions about your personal data.

You control any save files or diagnostic logs you choose to export or send to support. We receive them only if you share them with us. Device backups or files you place in your own cloud storage are governed by your settings and the relevant provider, not by a Golden Carrack account service.

3. App stores and external links

The store or platform you use may process account, purchase, download, diagnostic or backup information under its own privacy policy and your settings. This is separate from data collection by the game. We do not receive your payment-card details through Golden Carrack.

Opening an external website, including our support website, is subject to that website’s privacy practices. Using the Unity engine does not mean that Unity Analytics or Unity Ads are enabled in Golden Carrack; those services are not enabled.

4. Website visits and optional support

Our website has no advertising trackers, analytics scripts or third-party embedded video players. The trailer and fonts are served from our own website.

• Support: if you email us or use the contact form, we process your email address, topic, subject, message and any attachments you choose to send. This is necessary to read and answer your request. You do not need to contact us to play the game.
• Form security: the contact page uses the essential concat_contact session cookie for form security and submission feedback. It is not used for advertising. The anti-spam limiter stores keyed hashes derived from the sender’s email address and IP address, with request timestamps. These are pseudonymous security records, not anonymous data.
• Hosting: web and email servers process technical connection data, including IP addresses and request or delivery information, to deliver the website and email and protect them from abuse. Operational logs may contain this information.

Messages are sent to help@concatgames.eu. They are not published or used to add you to a marketing list. Please remove passwords, payment details and unnecessary personal information from screenshots, saves and logs before sharing them.

5. Why we process support and security data

Under the GDPR, our legitimate interests in answering enquiries and keeping the website and support channel secure are the basis for general correspondence and anti-abuse processing (Article 6(1)(f)). When a request is necessary to perform a contract with you, or to take steps you request before a contract, Article 6(1)(b) applies. We may retain or disclose information when necessary to comply with a legal obligation (Article 6(1)(c)).

We do not rely on blanket consent to tracking when you use the game or contact us. We do not sell personal data, share it for behavioural advertising, or use it for automated decisions producing legal or similarly significant effects on you.

6. Who can receive information

We use OVHcloud (OVH) for website hosting and the help@concatgames.eu mailbox. Support correspondence and website connection data are handled by us and this provider as needed to operate those services. Access is limited to what is needed for support, delivery and security. Information may also be disclosed where legally required or necessary to establish, exercise or defend legal claims.

The game itself does not send personal data to us outside the European Economic Area. The location and subprocessors for website and email processing depend on the OVH service and its configuration. Where processing involves a transfer outside the EEA, an applicable adequacy decision or appropriate safeguards are required. See OVHcloud’s data-protection information or contact us about the services and safeguards relevant to your correspondence.

OVH hosting may also set essential technical cookies for routing requests between servers. These are separate from our contact-form cookie and are not added by us for advertising.

7. How long information is kept

• Local game data: stays under your control on your device or in exported files and backups. Deleting the app may not remove exported saves or device backups.
• Support messages: kept for as long as needed to resolve the enquiry and any related follow-up or dispute. Information no longer needed for these purposes is deleted, unless a legal obligation requires retention. Necessary records of a legal claim may remain until the claim is resolved and the applicable retention or limitation period ends.
• Uploads: processed temporarily by PHP and attached to your support email. There is no public attachment archive; the email copy is retained with the correspondence.
• Anti-spam records: used for limits of up to one hour. Expired entries are removed on a subsequent limiter request, so a quiet website can retain expired entries longer. Form tokens expire after one hour. The session cookie has no persistent expiry and is subject to browser session handling.
• Operational logs and backups: retention is determined by the hosting or email service’s configuration and the need to deliver, secure and recover those services, or investigate a specific incident.

8. Your data-protection rights

Where we process personal data about you, you may request access, correction, erasure or restriction and object to processing based on legitimate interests. Portability applies where the legal conditions are met. These rights are subject to the conditions and exceptions in applicable law. We do not need to collect extra identifying data simply to identify a player whose data we do not hold.

Write to help@concatgames.eu. We normally respond within one month. If a complex or numerous request requires an extension of up to two further months, we will explain this within the first month. We may request proportionate information to verify your identity where necessary.

You may complain to the Polish data-protection authority, UODO, or to the competent authority where you live or work. See the European Data Protection Board’s authority directory.

9. Children

The game’s no-personal-data-collection approach applies to all players. Follow the age rating and parental controls of the store and device you use. We do not require an account or personal information from children to play. If a child sends unnecessary personal information to support, a parent or guardian can contact us about its deletion.

10. Security and changes

Our contact form uses server-side validation, upload limits, session-based request protection and anti-spam controls. No system can guarantee absolute security. If a personal-data breach occurs, we will meet the notification obligations that apply to it.

We will update this page and its effective date when our practices change. Material new processing will be explained before it starts, with consent sought where legally required. For questions, contact help@concatgames.eu.