Privacy Policy

Effective date: June 29, 2026

Introduction

We at Winter Cats Studios (“Winter Cats Studios,” “we,” “our,” “us”) respect your privacy. This Privacy Policy explains what personal data we collect and process when you visit our website, subscribe to our newsletter, or contact us through our contact form. “Personal data” means any information that can directly or indirectly identify you (e.g., name, email address, IP address).

Who is responsible

  • Data controller: Winter Cats Studios
  • Contact: contact@thewintercats.com
  • Company: Winter Cats Studios, a company registered in Serbia with the identification number 68110459

What we collect and how we use it

Visiting our website

Our site is delivered and protected by Cloudflare. To provide the site and block bots, Cloudflare may process your IP address, request details (URL, headers, timestamp), and set strictly necessary security cookies (e.g., to distinguish real users from bots). We use this data to keep the site functional and secure.

Analytics (Google Analytics 4)

We show a consent banner and load Google Analytics 4 (GA4) only after you accept analytics. GA4 helps us understand visits in aggregate (e.g., page views, device/browser type, approximate location, and events like button clicks). You can change your choice any time via Cookie Preferences.

Newsletter

If you subscribe, we collect your email address to send you updates about our games (for example, when our Steam page goes live). Each email includes an unsubscribe link. We may record basic engagement signals (opens, link clicks, bounces) to measure deliverability and keep our list healthy.

Contact form

When you use our contact form, we collect your name, email address, and message content solely to respond to your inquiry. This data is transmitted via Resend (our email delivery provider) directly to our inbox and is not stored in any database on our end. The contact form is also protected by Cloudflare Turnstile, which performs bot detection by analysing browser signals (such as interaction patterns and IP reputation) without displaying a visible challenge to most users. No contact form submission data is shared with third parties beyond what is necessary for delivery and bot protection.

Blog comments & annotations

On our blog posts you can leave comments and annotations (comments attached to a highlighted passage of text). When you do, we collect your name and message content, which are stored in a Cloudflare D1 database until removed. Comments and annotations are moderated before appearing publicly. To prevent abuse, we also temporarily store a hash of your IP address and browser user-agent in the same database for up to 6 hours, after which it is automatically deleted. A short-lived HttpOnly rate-limit cookie is also set in your browser for the same purpose. Comment and annotation forms are protected by Cloudflare Turnstile for bot detection (see contact form section above for details).

Legal basis (EU/UK)

  • Website security/hosting: Legitimate interests (GDPR Art. 6(1)(f)).
  • Analytics (GA4): Consent (GDPR Art. 6(1)(a)); analytics runs only after you accept it.
  • Newsletter: Consent (GDPR Art. 6(1)(a)); engagement metrics may rely on legitimate interests (Art. 6(1)(f)).
  • Contact form: Legitimate interests (GDPR Art. 6(1)(f)); processing is necessary to handle and respond to your inquiry.
  • Blog comments & annotations: Legitimate interests (GDPR Art. 6(1)(f)); publishing and moderating community discussion on our content.

Who we share data with

We don’t sell your personal information. We use service providers (processors) to operate the site and email:

  • Cloudflare, Inc. - hosting/CDN, security, bot protection, and database storage (Cloudflare D1) for blog comments and annotations.
  • Google LLC - Google Analytics 4 (analytics).
  • Resend - email delivery for newsletters and contact form submissions.
  • Discord, Inc. - our homepage displays a live community widget. When the widget is visible, your browser fetches data directly from Discord's API and loads member avatars from Discord's CDN, which means Discord can see your IP address. No Discord account is required and no data is sent to Discord from our servers.

These providers may process data outside your country (including the United States). Where required, we use appropriate safeguards (e.g., Standard Contractual Clauses).

Data retention

  • Security/logs: kept only as long as needed for security and troubleshooting.
  • Analytics: retained in GA4 per our settings (e.g., up to 14 months).
  • Newsletter: kept until you unsubscribe or we remove inactive subscribers.
  • Contact form: not stored in any database on our end. The email lands in our inbox and is handled like any business correspondence. You may request deletion by emailing contact@thewintercats.com.
  • Comments & annotations: stored until deleted by us or upon your request.
  • Rate-limit records (IP hash + user-agent hash): automatically deleted after 6 hours.

Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict, object, or port your data, and to withdraw consent at any time (without affecting prior processing). To make a request, contact contact@thewintercats.com.

Children

Our site and newsletter are not directed to children under 13. We do not knowingly collect personal data from children. If you believe a child provided personal data, contact us and we will delete it.

Changes

We may update this Policy from time to time. We will update the Effective date above and, where appropriate, provide additional notice.

Contact

Questions or requests: contact@thewintercats.com