Privacy Policy
Yonest (the "we" here) is a publishing platform for AI and indie games. We try to collect only what is needed to provide the service, and we never sell your personal data.
1. Information we collect
- Account information: the email address and display name you provide when you register. Passwords are stored as irreversible hashes, so we cannot recover your original password.
- Session information: after you sign in, we issue a session cookie (
sid) to identify your signed-in state; it is not used for advertising tracking. - Library information: which games you have acquired or own, and when you acquired them.
- Technical information: to keep the service stable and secure, we record access logs for requests (such as IP address, time, request path, and error information).
2. How we use this information
- To create and maintain your account so you can access all games with the same account;
- To verify your account and entitlements before you enter a game, preventing unauthorized access;
- To troubleshoot problems, prevent abuse and attacks, and keep the platform secure;
- To respond to your questions when you contact us.
3. Legal bases for processing
We process your personal data on these legal bases: performance of a contract with you (providing your account, checking entitlements, entering games); compliance with legal obligations (retention required for security and compliance); legitimate interests (keeping the platform secure, preventing abuse, troubleshooting — balanced against your rights). We do not carry out automated decision-making and we do not run profiling-based advertising.
4. Third parties and sharing
We use third-party infrastructure to run the service, mainly Cloudflare (content delivery, database, object storage and email delivery). They act as our processors, process data only as needed to provide their services to us, and are bound by a data processing agreement (DPA). Except where required by law or with your separate consent, we do not share your personal data with other third parties, and we do not sell it.
You can see the current list of sub-processors.
5. International transfers
Our infrastructure may be located outside your country (for example, in the Asia-Pacific region). For such transfers we rely on the Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum (IDTA), or equivalent safeguards, and we require processors to provide a level of protection not lower than locally required.
6. Cookies and device storage
We use device storage only where needed: sid (your login session — essential, HttpOnly), lang (your language preference, written only when you actively switch language), and gid (an anonymous guest ID used only to deduplicate demo-play analytics on the same device; it is not used for sign-in). Visitor statistics use Cloudflare Web Analytics, which sets no cookies and does no cross-site tracking. We show no ads, do no ad tracking, and do not sell data; if we ever introduce tracking that requires prior consent, we will ask for your consent first.
7. Retention
We keep your account and library data while your account is active; sessions last 30 days, access tokens 2 hours, and one-time credentials (reset/verification) expire automatically. After you delete your account there is a 7-day grace period (during which signing in again cancels the deletion); once it ends we permanently delete your personal data (sessions, favourites, reviews, scores, messages, etc.). Security and access logs are kept only as long as necessary.
8. Your rights
Under applicable law you have the right to access and receive a copy (one-click JSON export in account settings); to rectify (change email and password); to erase (self-service deletion); to restrict and to object to processing; and to data portability. We will reply within one month. If you believe we have handled your data improperly, you may complain to a supervisory authority: the Information Commissioner’s Office (ICO, ico.org.uk) in the UK, or your national data protection authority in the EU.
9. Controller and representative
The controller of your personal data is [UK company legal name], registered address: [registered address], company number: [company number], registered in the United Kingdom. If you are in the EU, we have appointed a representative under Article 27 EU GDPR: [EU representative name], address: [EU representative address], email: [representative email].
10. Children
The service is not directed at children below the digital age of consent: 13 in the UK, 16 in most EU member states, 14 in South Korea and 16 in Japan — we apply the threshold for your region and ask you to confirm it at registration. If we learn that we have collected a child’s personal data, we will delete it as soon as possible.
11. Changes to this policy
We may update this policy. For material changes we will give prominent notice on the site and update the “last updated” date at the top of this page.
12. Contact
If you have any questions about this policy, contact: privacy@yonest.games (see also Contact us).
Regional addenda
For different markets this policy is supplemented by regional addenda: UK / EU — see sections 5, 8 and 9 above (international transfers; rights and complaints; controller and EU representative); US — state privacy notices (added before that market goes live); Japan — APPI notice; South Korea — PIPA notice. Addenda only add to your rights and never reduce them.