Privacy Policy

Effective date: 14 June 2026 · Last updated: 14 June 2026

🔒 We collect the minimum data needed to operate the Service. We do not sell your data. We do not run advertising. This policy explains exactly what we collect, why, and what your rights are.

1. Who We Are (Controller)

The Life of Kevin ("we", "us", "Service") is operated by the individual developer behind lifeofkevin.com, based in the Netherlands. As the operator of this website, we are the data controller for personal data collected through the Service.

For privacy-related enquiries, contact us via the website at lifeofkevin.com or through the support page.

2. What Data We Collect

We collect the following categories of personal data:

Data	Why we collect it	Legal basis (GDPR)
Username	To identify your account within the Service	Contract (Art. 6(1)(b))
Password (hashed)	Authentication. Stored as a bcrypt hash — we cannot read your password.	Contract (Art. 6(1)(b))
Game progress & choices	To save your in-game state between sessions	Contract (Art. 6(1)(b))
Aggregate usage statistics	To understand how the game is played (e.g. scene completion, day progress). This data is anonymised — not linked to you personally.	Legitimate interest (Art. 6(1)(f))
IP address / server logs	Standard server access logs for security and debugging. Retained for a maximum of 30 days.	Legitimate interest (Art. 6(1)(f))

We do not collect email addresses, phone numbers, payment card data, real names, or location data beyond IP address.

3. How We Use Your Data

We use the data we collect solely to:

Create and maintain your account;
Authenticate you when you log in;
Save and restore your game progress;
Display aggregated, anonymised statistics about the player community;
Protect the security and integrity of the Service;
Comply with legal obligations.

We do not use your data for advertising, profiling, or any automated decision-making with legal or significant effects.

4. Cookies & Local Storage

We use a single authentication token (JWT) stored in your browser's localStorage to keep you logged in. This token contains your username and an expiry timestamp. It is not a tracking cookie and does not leave your device except when sent to our server to authenticate your requests.

We do not use advertising cookies, analytics cookies, or third-party tracking cookies. If you use a third-party authentication provider (e.g. Google, Discord), their cookies are governed by their own privacy policies.

5. Data Sharing & Third Parties

We do not sell, rent, or trade your personal data. Data may be shared only in the following limited circumstances:

Hosting provider: Our server infrastructure is hosted by a third-party provider. They process data on our behalf under a Data Processing Agreement and are not permitted to use your data for their own purposes.
Payment processors: If you make a voluntary donation, payment is handled by a third-party processor (e.g. Ko-fi, Stripe). We do not receive or store your payment card details. Their privacy policies apply to that transaction.
Legal requirements: We may disclose data if required to do so by law, court order, or to protect the rights and safety of users or the public.

6. Data Retention

We retain your account data for as long as your account is active. If you request deletion of your account, we will erase your username, hashed password, and game progress within 30 days of your request.

Server access logs are retained for a maximum of 30 days and then automatically deleted.

Anonymised, aggregated statistics (e.g. total player counts, scene completion rates) do not contain personal data and are retained indefinitely for development and reporting purposes.

7. Your Rights (GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom, you have the following rights under the General Data Protection Regulation (GDPR) and applicable national law:

Right of access — You may request a copy of the personal data we hold about you.
Right to rectification — You may ask us to correct inaccurate data.
Right to erasure — You may ask us to delete your personal data ("right to be forgotten"), subject to any legal obligations to retain it.
Right to restriction — You may ask us to restrict processing of your data in certain circumstances.
Right to data portability — You may request a machine-readable copy of your data.
Right to object — You may object to processing based on legitimate interest.
Right to withdraw consent — Where processing is based on consent, you may withdraw it at any time.
Right to lodge a complaint — You have the right to complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens, at autoriteitpersoonsgegevens.nl.

To exercise any of these rights, contact us via our support page. We will respond within 30 days.

8. Data Security

We implement appropriate technical and organisational measures to protect your data, including:

Passwords are hashed using bcrypt with a sufficient cost factor — we never store plaintext passwords;
Authentication tokens use signed JWT with server-side secret keys;
Server communication is encrypted via HTTPS/TLS;
Access to server infrastructure is restricted to authorised personnel only.

No system is completely secure. In the event of a data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours as required by GDPR, and will notify affected users without undue delay.

9. Children's Privacy

This Service is intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we become aware that we have collected data from a person under 18, we will delete that account and all associated data immediately.

If you believe a minor has registered an account, please contact us immediately via the support page.

10. International Transfers

Our servers are located within the European Union. If any service provider processes data outside the EEA, we ensure that appropriate safeguards are in place (e.g. Standard Contractual Clauses) in accordance with GDPR Chapter V.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above. Material changes will be communicated via a notice on the Service where reasonably practicable. Your continued use of the Service after the effective date of any change constitutes acceptance of the updated policy.