Privacy Policy

1. Who I am (data controller)

The data controller for personal data processed through felyra.studio is:

• FELYRA STUDIO S.R.L. — an independent game studio registered in Romania
• Trade Register No.: J2026020138008 · Tax ID (CUI): 54353095
• Registered office: Strada Soporului 8D, Bloc B1, Scara 3, Etaj 0, Ap. 148, Cluj-Napoca, Cluj County, Romania
• Privacy contact: team@felyra.studio

2. Data I collect

• Account data — your name, email address, an encrypted (hashed) password, and an optional profile image, when you create an account.
• Sign-in with Google (optional) — if you choose “Sign in with Google”, I receive your name, email address and profile picture from Google to create or access your account. I never receive your Google password.
• Contributions — names you put in the game, paintings you claim in the Gallery, and donations you make, together with their amounts and timestamps.
• Community content — the art and text you choose to publish: character names, art, Gallery paintings, Library book pages, poll votes, and the display or credit name shown with them. If you joined through a friend's invite link, I also store that relationship so they get credit.
• Messages you send me — if you use the contact form, I receive the name, email address, topic and message you type, and I keep the email thread while I handle your request.
• Payment data — when you pay, card details are entered directly into Stripe and are never seen or stored by me. I keep a payment reference, the amount, and the status.
• Technical data — your IP address and basic request information, used to keep accounts secure and to rate-limit sign-up and login attempts against abuse.
• Cookies — strictly necessary cookies for login, session security and payments. See my Cookie Policy.

I do not collect special-category data, and I don't run advertising or third-party tracking.

3. How I use it (legal bases)

• To provide your account and the service — creating and securing your account, showing your contributions, displaying credits and leaderboards. Legal basis: performance of a contract.
• To process payments — handling character namings, gallery paintings and donations through Stripe and granting any rewards. Legal basis: performance of a contract.
• To review what gets published — Gallery paintings, Library book pages and the names you choose for characters are all checked by me before they go public. This means reading the content you submit, together with the account it came from. Legal basis: legitimate interests (keeping the community and the game safe and lawful), and legal obligation where the law requires me to act on illegal content.
• To keep the platform safe — rate-limiting sign-ups and logins, preventing fraud and abuse, and enforcing the rules. If someone repeatedly breaks the rules or tries to get around a removal, this can include blocking access from the IP addresses or networks being used — kept only as long as it's needed for that purpose. Legal basis: legitimate interests.
• To communicate with you — account, security and payment-receipt emails. Legal basis: contract / legitimate interests.
• To send optional updates — only if you tick the box for it, occasional news about Let It Lie and its launch. Legal basis: consent. You can withdraw any time via the unsubscribe link in every such email, from your profile, or by emailing me — and it never affects your account or anything you've contributed.
• To meet legal obligations — keeping records required by tax and accounting law. Legal basis: legal obligation.

4. Payments

All payments are processed by Stripe Payments Europe, Ltd., a PCI-DSS Level 1 certified payment provider. Your card data is collected and stored by Stripe directly — it never passes through or is stored on my servers. Stripe processes your data as an independent controller for fraud prevention and as my processor for completing the transaction. See Stripe's Privacy Policy.

5. Cookies

I only use cookies that are strictly necessary to operate the site — to keep you logged in, secure your session against forgery, and let Stripe process payments. I don't use analytics, advertising or cross-site tracking cookies. Full details are in my Cookie Policy.

6. Who I share data with

I never sell your data. I share it only with the service providers needed to run Felyra:

• Stripe — payment processing.
• Invoicing & tax (Oblio / ANAF) — when you pay, the data legally required on a fiscal invoice (your name and email, the amount and what it was for) is processed in my invoicing software (Oblio) and reported to the Romanian tax authority (ANAF) through the national e-Invoice system, as Romanian tax law requires.
• Hosting (Hetzner) — my servers run on Hetzner Online GmbH, in EU data centres.
• Email (Hostinger) — account, security and receipt emails are delivered through Hostinger.
• Google — only if you use “Sign in with Google”, to authenticate you.
• Content delivery networks — fonts and scripts load from Google Fonts, Fontshare, jsDelivr, cdnjs and the Tailwind CDN. When your browser fetches those files, these providers technically receive your IP address, as with any website resource.
• Public credits — if you contribute, your chosen display name (or a credit name you set) and your contribution amount appear publicly in the in-game credits and leaderboards. I never publish platform-wide or community-wide totals. You can switch your profile to anonymous at any time, which shows you as “Anonymous” everywhere.
• Rights-holders — if someone credibly reports that content you uploaded infringes their rights, I may share the information needed to identify who uploaded it, to the extent the law allows, so the matter can be resolved (see the Terms).
• Authorities — only where required by law.

My core providers (Hetzner, Stripe Payments Europe, Oblio) process data in the EU. Where a provider (such as Google) may transfer data outside the EU, that transfer is covered by an adequacy decision or Standard Contractual Clauses under the GDPR.

7. How long I keep it

I keep account and contribution data for as long as your account exists. If you delete your account, I erase or anonymise your personal data, except records I'm legally required to keep (for example, payment and invoice records, which tax law requires me to retain for the legally mandated period).

One special case: community art that has already been baked into a released version of the game stays in the game — a shipped game can't be changed retroactively. On request I will remove your name from its public displays (credits, placards), so the art remains but is no longer linked to you.

8. Your rights

Under the GDPR you have the right to:

• Access a copy of your personal data.
• Rectify data that is inaccurate or incomplete.
• Erase your data (“right to be forgotten”).
• Restrict or object to certain processing.
• Portability — receive your data in a machine-readable format.
• Withdraw consent at any time, where processing is based on consent.

To exercise any of these, email team@felyra.studio. You also have the right to lodge a complaint with the Romanian supervisory authority, ANSPDCP.

No automated decisions. I don't use your data to make automated decisions that produce legal or similarly significant effects on you (GDPR Article 22), and I don't profile you.

9. Security

Passwords are hashed with Argon2id and never stored in plain text. Connections are encrypted with HTTPS, payment data is handled entirely by Stripe, and access to systems is restricted. No system is perfectly secure, but I work to protect your data using industry-standard measures.

If a breach happens. If a data breach occurs that is likely to affect your rights, I will notify the Romanian supervisory authority (ANSPDCP) within 72 hours where the law requires it, and inform you without undue delay if the breach is likely to present a high risk to you.

10. Children

Felyra is not directed at children under 16. If you are under 16, please do not create an account or make contributions without the consent of a parent or guardian. If I learn I've collected data from a child without proper consent, I'll delete it.

11. Changes to this policy

I may update this policy as the project grows. Material changes will be reflected by the “last updated” date above, and where appropriate I'll let you know directly.