Privacy Policy

The short version. Play offline and we collect nothing personal — your save lives in your browser. Sign in and we store your email and your game saves. Buy something and Stripe handles your card — we never see it. Analytics run only if you consent, no personal data is ever sold, and you can ask us to delete everything at any time.

1. Who we are

Campley Holdings Ltd (UK) is the data controller for PitchNoir. Contact: privacy@pitchnoir.agency.

2. What we collect

2.1 Offline / local play (no account)

Nothing personal. Your save, wallet and settings live in your browser's local storage and never leave your device.

2.2 Signed-in play (account + cloud saves)

• Account data: email address and authentication identifiers (via Firebase Authentication — including Google sign-in if you use it, which shares your Google account email and display name with us).
• Game data: your saves, agency name, scores, league entries, cosmetic wallet and entitlements — stored in Google Cloud Firestore against your account.
• Player-entered text: agency names, pitch text and similar free-text you write in the game. Don't put personal information in these.

2.3 Payments

Purchases are processed by Stripe. Stripe collects your card and billing details under its own privacy policy — we never see or store card numbers. We keep transaction records (what was bought, when, for how much, and the Stripe reference) for fulfilment, support, refunds and accounting.

2.4 Technical and log data

Standard server logs (IP address, browser type, timestamps) kept by our hosting and functions infrastructure for security and abuse prevention.

2.5 Product analytics — only with consent

If you press ACCEPT on the in-game banner, we collect privacy-respecting product analytics (which screens and features are used) to improve the game. Decline and the game plays identically. No personal data is sold, ever.

3. Why we're allowed to (legal bases)

4. Cookies and local storage

We use local storage for your save, settings, free-go counters and sign-in session — these are strictly necessary for the game to work. Analytics storage is set only after you consent. We don't run advertising cookies or trackers.

5. Who we share data with

• Google (Firebase / Google Cloud) — authentication, database, hosting.
• Stripe — payment processing.
• No data brokers, no advertisers, no sale of personal data.

6. International transfers

Our providers may process data outside the UK (including in the US). Where they do, transfers are protected by UK-approved safeguards (adequacy regulations, the UK Extension to the EU–US Data Privacy Framework, or standard contractual clauses with the UK addendum).

7. How long we keep it

• Account and game data: while your account is active, then deleted on request or after prolonged inactivity.
• Purchase and transaction records: 6 years (UK tax law).
• Server logs: short rolling windows for security.
• Waitlist emails: until you unsubscribe or we launch communications wind-down.

8. Your rights

Under UK GDPR you can ask us for access, correction, erasure, restriction, portability, and to object to processing based on legitimate interests; where processing is based on consent you can withdraw it at any time. Email privacy@pitchnoir.agency and we'll respond within one month. You can also complain to the ICO at ico.org.uk.

9. Deleting your account

Email us from your account address asking for deletion, and we'll remove your account, saves, wallet and entitlements. Transaction records we must keep for tax law are retained (minimised) for the statutory period. Local-storage data on your own device is yours to clear via your browser.

10. Children

PitchNoir is not directed at children under 13, and we don't knowingly collect their data. Purchases require you to be 18+ or have a parent/guardian's permission.

11. Security

Data is encrypted in transit, access to production systems is restricted, payment card data never touches our servers, and server-side pricing and entitlement checks protect purchase integrity. No system is perfectly secure — if a breach affecting you occurs, we'll notify you and the ICO as the law requires.

11a. Artificial intelligence — and what we don't do with your data

PitchNoir's characters and media are AI-generated. That is a content question, covered in full by our AI Transparency Notice. The data-protection points belong here, and they are all negatives — which is the point:

• We do not train models on you. What you write, choose or build in PitchNoir is used to run the game and save your progress. It is not used to train generative models, ours or anyone else's, and it is not sold or shared for that purpose.
• No emotion recognition. Marlowe reacts to the answer you clicked, and the confidence meter is scored from your choices. We do not analyse your face, voice, typing rhythm or any other signal to infer your emotional state.
• No biometric data. We never request or access your camera or microphone, and we do not process biometric data for identification or categorisation.
• No automated decisions with legal effect. Nothing here profiles you as a person or makes a decision about you that produces legal or similarly significant effects, so the Article 22 UK/EU GDPR safeguards are not engaged. Marlowe's verdict is a game outcome, computed from what you clicked.
• Generation happens before release. Media is generated during production, not from your play session, so your gameplay is not sent to any model provider.

If we ever change any of this, we will say so here and in the AI Transparency Notice before it takes effect — not afterwards.

12. Changes

We'll update this policy as the game evolves; material changes will be flagged in the game. The version at pitchnoir.agency/privacy is always current.