Privacy notice

Who is responsible for your data

FunPro ApS, a Danish company with CVR 46813782, is the controller for Spireline.

For privacy questions or to exercise your rights, email dpo@spireline.io. This is our privacy contact mailbox; its name does not mean that FunPro ApS has appointed a data protection officer under GDPR Article 37. For gameplay, accounts and purchases, use player support or support@spireline.io.

This site and the game

This notice covers Spireline and this website. Features differ between builds: temporary browser test builds may keep saves only on your device, while account-enabled builds use sign-in and cloud saves. Account services, purchases and ads described here are planned features, available only where enabled for your build, country and age group. The v1 release will not include a web version.

This website has no cookies, advertising tools or optional analytics. Our website host, Vercel, receives ordinary connection information, such as your IP address and browser request, to deliver and secure the pages. The support form opens your email app; this website does not submit or store its contents.

What Spireline handles and why

Saves and accounts. Progress and settings are stored on your device. Where sign-in and cloud saves are enabled, account identifiers, sign-in details and cloud progress are also processed to operate your account, save progress and restore access. Supabase is the selected provider for those services. Processing needed to provide these services is based on GDPR Article 6(1)(b).

Age and country. Your age answer and country are used to apply age and country restrictions. When you enter a birth date, the game derives an age band and discards the birth date. The device keeps the band, the month-based date when it next changes, the answer's source and confirmation times. A self-declared answer is not proof of age. Where the native app offers a platform age check for the adult-only Vault, Apple or Google may supply an age eligibility signal. That signal is used for eligibility, not advertising or analytics. Checks required by law use Article 6(1)(c). Our other eligibility checks use Article 6(1)(f), based on our legitimate interest in protecting younger players and applying our product's age and country restrictions.

Purchases and rights. Where purchases are enabled, we process order references, purchase amounts and currency, entitlements, wallet records, redemption and refund records to deliver and settle your rights under Article 6(1)(b), and retain required accounting evidence under Article 6(1)(c). Apple or Google handles purchases made through its store under its own terms and privacy notice.

Support and security. We process your contact details and message to answer support and privacy requests. Account and service logs can include account identifiers, IP addresses, request times and technical errors. Necessary security and abuse checks are based on our legitimate interest in protecting the service under Article 6(1)(f). Contract support uses Article 6(1)(b), and handling statutory rights requests uses Article 6(1)(c). Other support requests are handled under our legitimate interest in answering them, Article 6(1)(f). Necessary security processing is separate from optional play data.

Optional play data

Help improve Spireline by sharing optional play data. It is off by default. You can say no or turn it off in Settings without losing access to the game, changing prices or odds, or losing purchases.

You can withdraw consent in Settings at any time. Collection and upload stop when you withdraw. Withdrawal does not change the lawfulness of processing before it. We do not collect optional analytics for anyone under 18 or whose age is unknown.

Age and consent

In Denmark, the age at which a child can give their own data-protection consent for an information society service is 15. Below that age, parental authorisation is needed where processing relies on that consent. Our launch policy is stricter: no ads or optional analytics for anyone under 18 or whose age is unknown, including with parental purchase approval. A purchase approval does not give analytics or advertising consent.

Optional advertising and privacy signals

Where ads are enabled, adults may choose to watch an ad for a small gameplay benefit. Watching is optional. With valid consent, personalised ads may be offered in Denmark and the EU and other supported countries. Personalised advertising uses Article 6(1)(a), and its choice is separate from play data.

If you refuse or withdraw consent for personalised ads, or if your country is unknown, you may still choose to watch non-personalised or limited ads. We rely on our legitimate interest in funding the free game to deliver these ads (Article 6(1)(f)). Delivering an ad can involve IP addresses, device information and fraud checks. You can object or decline to watch. The ad notice explains the provider and processing before you choose. We do not offer ads in Belgium or the Netherlands, or to anyone under 18 or whose age is unknown.

Where your browser sends Global Privacy Control (GPC), we honour it as an opt-out of sale or sharing for US players. We honour the signal for players anywhere in the United States, without waiting for a state-by-state determination. Advertising-tool defaults do not override it. You can also use the US privacy opt-out control where offered. GPC does not itself grant consent to analytics or advertising.

How long data is kept

Device-only saves remain until you clear them. Account data and cloud saves remain while your account is active, subject to account deletion. Optional play data is kept for up to 12 months after collection, then deleted or aggregated so it is no longer linked to an installation. Support correspondence is kept for up to 24 months after a case closes, unless a specific unresolved claim requires a restricted record for longer. At account deletion, account-linked support messages are erased unless a case or claim is still open.

Ordinary accounting material is kept for five years from the end of the relevant financial year. FunPro ApS's first financial year ends on 31 December 2027, so ordinary accounting records from 2026 and 2027 are kept through 31 December 2032. A different statutory period, such as a tax scheme's recordkeeping requirement, applies only to records covered by that rule.

Unsettled paid rights are kept in a separate minimal rights register for as long as needed to settle them or meet a legal obligation. A minimal deletion record keeps the request reference, dates, result and documented exceptions until the request is completed and any dispute about its handling is resolved. Further retention needs a specific legal basis. It does not keep the deleted profile or gameplay history. The accounting period does not automatically apply to either that deletion record or service logs.

Where Supabase account services are enabled, service logs can include email addresses, IP addresses and browser or device details. Deleting an account does not automatically remove those logs. External logs expire under the active plan's retention period; any database copies have separate retention controls. We will publish the configured periods here before production account services start. This website does not send visitor data to Supabase. Vercel's own connection and security records follow the retention criteria in its privacy notice.

Deletion and remaining paid rights

Before deletion, we offer redemption of remaining redeemable paid value. You can decline and still delete your account. Declining is not a waiver: only the minimal records needed to preserve and settle the remaining claim survive, and you can request later redemption through support. Payment-linked rewards are assessed by their origin, not just an in-game label.

Account deletion does not automatically cancel a purchase, settle a refund or waive a statutory right. The cheating suspension rule in the terms also applies to FunPro-direct refunds and redemption. See the deletion steps and retained records.

Your rights

Depending on the processing, you can ask for access, correction, deletion, restriction or portability, object to processing based on legitimate interests, and withdraw consent. Email dpo@spireline.io. We may ask for proportionate information to confirm your identity. We respond to rights requests within one month, subject to the extensions permitted by GDPR, and explain any lawful refusal or records we must retain.

We cannot remotely erase device-only saves; clear them through your device or browser. If data is linked only to an installation identifier, we may need that identifier to find it. You may complain to Datatilsynet, the Danish Data Protection Agency, or your local supervisory authority.

Providers and international transfers

Vercel hosts this website on a global network. It processes connection and security data in the United States and other countries and acts as a controller for its own service-generated data. Its privacy notice explains that processing and its EU-US Data Privacy Framework certification.

Microsoft 365 handles our support and privacy mailboxes. Microsoft's standard data protection terms cover transfers outside the EU and EEA with standard contractual clauses and also describe its Data Privacy Framework certification. Contact our privacy mailbox to request the safeguards relevant to your correspondence.

Supabase is selected for account services. Before production account services start, this notice will identify their processing locations and applicable transfer safeguards. Advertising providers, where enabled, are identified in the ad notice before you choose. Stores and sign-in platforms process data under their own notices. We disclose data where required by law or needed for a documented legal claim.

Device-only data stays on your device unless you export it. If you play through itch.io, its processing is described in itch.io's privacy policy.

Changes to this notice

Material changes will be dated here and flagged in the game where practical. A new use that requires consent will be put to you before it starts.