Privacy Policy
Willow is a fictional horse club game run by TEMNIKOVA, LDA ("we", "the Club"), Campo Grande 28, 7C, 1700-093 Lisboa, Portugal (VAT PT516343653). We are the data controller for willowgame.com. Privacy questions and rights requests: support@willowgame.com.
The short version
- Your stable is a fictional character, not you. Names, bios and stables in Willow are made-up game content — never enter your real name, address, or other personal details.
- The only real-world personal data we need is your sign-in email, held by our authentication provider Clerk. Everything else is fiction you invent plus game progress.
- Club chat is invite-only — no public rooms, and no links, images or files inside messages. A safety filter checks every message before it is stored, and messages auto-delete after about 90 days.
- Free accounts may show ads. No analytics trackers, no selling data, no profiling, no AI training on your content.
- Willow is for players 13 and older. Under the digital-consent age where you live (up to 16 in parts of the EU). A parent or guardian must agree with you.
- Ask us to see, fix, export, or delete your data any time: support@willowgame.com.
1. What we collect and why
| What | Purpose | Legal basis | Kept for |
|---|---|---|---|
| Sign-in email (held by Clerk) | Create your account, keep it yours, restore access | Contract | Until you delete your account |
| Optional Clerk display name & photo | Show your account in the sign-in menu — a pseudonym works fine | Contract | Until you change or delete them in Clerk |
| Game progress — fictional profiles, horses, inventory, balances, journal, achievements | Run the game and save your stable | Contract | Until you delete the profile or account |
| Fictional stable content — profile name, bio, favorite horse, invented sponsor names, uploaded sponsor logos | Display your stable, including your optional public page | Contract | Until you change or remove it |
| Public page & @handle | Publish your optional public stable at /@handle | Contract | Until you unpublish |
| Age attestation — that you passed the age check, plus a broad band (13–15 or 16+); the birth year and month you enter are evaluated once and never stored | Apply the 13+ rule and child-safety defaults | Legal obligation / legitimate interest — protecting children | While your account exists |
| Invite codes & referrals — your permanent invite code and who joined through it | Grant the referral reward (15,000 tickets for each side) and prevent fraud | Legitimate interest — fraud prevention and the promised reward | While the feature runs |
| Sign-in history | Security, abuse prevention, admin audit | Legitimate interest | Per Clerk's retention |
| Technical logs — IP, browser, timestamps (Cloudflare edge) | Deliver pages, block abuse, debug errors | Legitimate interest | Per Cloudflare's retention |
| Support tickets — your email, message and ticket number, plus limited stable context if you are signed in | Answer support, bug and moderation requests | Contract / legitimate interest | 24 months |
| Club chat messages — text-only, up to 280 characters, in invite-only rooms, with the sending account, room and time | Deliver your messages to the room's invited members | Contract | ~90 days, then automatically deleted |
| Chat rooms, members & invites — room names, who invited whom, member/invite status, read markers | Run the invite-only rooms — new members see only messages sent after they accept | Contract | Kept as service records — not auto-deleted (leaving, removal and closing are status markers) |
| Chat mute list — the accounts whose messages and invites you block | Honour your mute settings | Contract | Until you unmute them |
| Chat reports — an excerpt of the reported message, room and message ids, the sender's display name and your handle, stored as a moderation ticket and emailed to our moderation mailbox (agent@citedy.com) | Investigate reported abuse | Legitimate interest — protecting players | With support tickets — 24 months |
| Parental consent record — that a parent confirmed club-chat access, plus the Stripe verification id and the card's brand and last four digits, never the card number | Let riders under 16 use club chat with a parent's confirmed agreement | Legal obligation / legitimate interest — protecting children | Until account deletion or the parent withdraws consent |
| Purchase record — only if paid items are offered; nothing is sold today — Stripe receipt id, the item bought, the amount and the time, never card details | Deliver what you paid for, meet tax and accounting duties | Contract / legal obligation | 10 years (tax law) |
You do not have to provide the fictional-content fields — they exist so the game is fun. The only contractual must is a working sign-in. If you never create a profile, we store only your sign-in. For the legitimate-interest rows above, we balance this against your interests by collecting only the minimum needed for each stated purpose.
Club chat is invite-only: members join a named room (up to 25 people) only by accepting an invite sent to their @handle — there are no public rooms, no chat discovery and no shareable join links. Messages are plain text of up to 280 characters — links, images and files cannot be sent. New members see only messages sent after they accept. Chat shows your fictional stable name and @handle, never your email; starting or joining a chat can assign you a numeric @handle but does not publish your public page. Players can only be invited through a published Willow page (@handle); if your page is hidden, nobody can find or invite you, and you can still accept existing invitations. Messages are stored on our servers — they are not end-to-end encrypted — and every message passes an automated safety filter before it is stored (see section 11). You can mute a player (hiding their messages and blocking their invites) and report any message; the room's owner can remove members and close the room.
2. What we deliberately do not collect
- Real names inside the game (we ask you not to use them)
- Precise location, contacts, device identifiers for tracking
- Payment details — Willow sells nothing; tickets and gems are earned in-game
- Analytics identifiers, advertising IDs, cross-site trackers
- Blocked chat messages — anything the club-chat filter rejects (links, contact details, personal-data solicitations, abusive terms) is never stored, and no record of the rejected message is kept
- Payment card numbers — a parent's card for the under-16 chat-consent check goes straight to Stripe; we keep only the card's brand and last four digits
3. Your stable is fiction — keep it that way
Willow is designed so younger players and adults can play without anyone knowing who they really are. Your profiles are characters: give your stable, horses, and sponsors invented names.
- Do not enter your real name, address, school, phone, photos of yourself, or anyone else's personal details anywhere in Willow.
- Public pages (
/@handle) only ever show fictional fields: stable name, bio, gems, horses, and layout. Your email, real name, and account data are never displayed. - If we learn a profile field contains real personal information, we may hide, change, or remove it — to protect you, not to punish.
- The same rule applies inside club chat: the filter is designed to block many kinds of personal details before a message can be sent — but invited room members can still read (and could copy) what you do send, so keep it fictional there too.
4. Children and parents
Willow is intended for players 13 and older. At first sign-in we ask a neutral question about your birth year and month — the date itself is never stored: answers under 13 cannot proceed and leave no record, while a passed check keeps only that attestation happened and a broad age band. We do not knowingly collect personal information from children under 13; if you believe a child under 13 has an account, write to support@willowgame.com and we will delete it.
Under your country's digital-consent age — up to 16 in some European countries (13 in Portugal). Ask a parent or guardian to read and accept our terms with you before you play.
Parents: the only personal identifier your child needs is a sign-in email, which stays with Clerk and is never shown publicly. Everything inside the game is fictional content. We encourage you to help your child pick an invented stable name and to remind them never to share real details in bios or uploads.
Club chat follows the same protective design: rooms are invite-only (a child can only join by accepting an invitation), every message is screened by the automated filter before it is stored, and players can mute or report each other. These measures reduce — but cannot eliminate — the risk of a child sharing personal details in free text. We encourage parents to remind children never to share real information even with friends in chat, and you may write to support@willowgame.com at any time to review or delete a child's data or account.
Club chat is additionally gated for riders under 16: before a 13–15 rider can create, join, invite or send, a parent must confirm consent with a bank card through Stripe — a card check only, never a charge. An adult cardholder confirming is our evidence that a parent agreed. Willow never sees the card number; we store only that consent happened, with the card's brand and last four digits, until the account is deleted or the parent withdraws consent via support@willowgame.com.
For clarity on children's data: the categories of personal information we may hold about a child are those listed in section 1, kept for the periods in section 8. Parents may review a child's personal information, ask us to delete it, refuse further collection, or revoke consent at any time via support@willowgame.com. We do not disclose children's personal information to third parties — our providers support internal operations only. If we learn an account belongs to an under-13 player, we delete the account and its chat messages and room records.
5. Public stable pages — on by default, yours to hide
Every account gets a public stable page at /@handle when your first profile is created, showing the profile you select. You can hide the page at any time in profile settings — and make it visible again whenever you like.
While it is visible, anyone with the link can see, at most: the fictional stable name and bio you wrote, your gem count, your horses' fictional names, breeds and ages, stall and paddock layout, and achievements. Everything else — email, sign-in details, tickets, purchases, care stats, your other profiles — stays private.
6. Who processes data for us
A short, deliberate list. None of them receives your game fiction beyond what is technically needed.
| Processor | Role | Location | Notes |
|---|---|---|---|
| Clerk, Inc. | Sign-in, account, session tokens | USA | Holds your email, optional name/photo, sign-in metadata |
| Cloudflare, Inc. | Hosting, database, file storage, content delivery, request logs, email, Turnstile bot check | USA + global edge | All game data lives on Cloudflare infrastructure; Turnstile runs only on the support form |
| HeyGen / Cloudflare Workers AI (FLUX) | Admin-side generation of horse art and videos | USA | Receives only generated or stock horse images — never account data |
| Stripe, Inc. | Card verification for parental consent — a bank-card check, never a charge; payment processing if paid items are ever offered | USA + global | Sees the parent's card details at entry; Willow receives only the verification id and the card's brand/last4 — never card numbers, on purchases either |
Where these providers process data outside the EU, transfers rely on EU Data Privacy Framework certification or Standard Contractual Clauses, depending on the provider. Ask us for details.
Club chat adds no new processor: messages and room records live in the same Cloudflare D1 database as the rest of the game, and chat-report notification emails are sent through Cloudflare's email-sending service to a moderation mailbox operated for the club (agent@citedy.com, hosted outside willowgame.com).
7. Cookies and local storage
- Strictly necessary only. Clerk sets a session cookie to keep you signed in; Cloudflare may set security cookies for the site to work safely.
- No advertising, analytics, or cross-site tracking cookies — that is why Willow has no cookie banner. There is nothing to consent to.
- Browser local storage remembers small preferences (language, a referral invite code you followed, which notices you've seen, sign-in state, demo settings). It stays on your device and is not used for tracking.
8. How long we keep data
- Account data (email, sign-in) — until you delete your account.
- Abandoned accounts — if an account shows no sign-in or game activity for 24 months, we email the sign-in address and delete the game data after a further 30 days of inactivity. Signing in resets the clock.
- Game saves — while the profile exists; deleted profiles are removed with the save.
- Referral and invite records — while the referral feature runs.
- Support tickets — 24 months, then deleted or anonymised.
- Chat messages — automatically deleted about 90 days after sending (the cleanup runs when the chat is used, so timing is approximate).
- Chat rooms, memberships and invites — kept as service records while the club operates; leaving a room or having it closed leaves a status marker rather than deleting the record. There is no automatic deletion here, so ask us via the rights channel below if you want them removed.
- Chat mute lists — until you unmute the player.
- Parental consent records — while the account exists or until a parent withdraws consent via support@willowgame.com.
- Chat reports — kept with the support tickets they create: 24 months, then deleted or anonymised.
- Edge/security logs — per Cloudflare's standard short retention.
When we no longer need data for the purpose it was collected, we delete or anonymise it.
9. Your rights
You have the right to access, correct, export, delete, restrict, and object to processing of your personal data, and to withdraw consent where consent applies — free of charge. Write to support@willowgame.com from your sign-in email (or so we can verify the account is yours). We answer within 30 days.
Much is self-service: fictional fields can be changed in-game, and your Clerk name, photo, and email can be managed in Clerk account settings. Chat has no self-service export — write to us and we will handle access, correction or deletion of your messages, room records, mute list and reports manually. Parents and guardians may exercise these rights on behalf of their child. Where a record must briefly be kept to finish an abuse investigation, we keep the minimum needed. You can complain to our supervisory authority — CNPD (Comissão Nacional de Proteção de Dados, Portugal) — or to the authority where you live.
10. Security
We keep saves in an isolated per-account store, gate admin access by server-verified roles with an audit log, validate and owner-scope uploads, and never expose admin tools to players. Club chat sits behind your verified sign-in: rooms are members-only with invite acceptance required, there is no public discovery, sending is rate-limited against spam, and the safety filter runs on our servers before a message can be stored. No method of transmission or storage is perfectly secure; if a breach affects your personal data we will notify the CNPD within 72 hours and affected users without undue delay where the law requires.
11. Automated processing
Willow builds no profiles about you and makes no decisions with legal or similarly significant effect by solely automated means. One automated tool does act on content you send: the club-chat safety filter. Every chat message is checked on our servers before it is stored — it looks for links and contact details, phone-number-like digit sequences, phrases that ask for personal details (in English, Russian and Arabic), and an abusive-language list, even when disguised with lookalike characters. A blocked message is simply not sent or stored — no record of the blocked text or the rejection is kept. This is protective filtering, not profiling, and the filter makes no decisions about your account — enforcement beyond blocking a message (restrictions, removals) follows human review of player reports. AI is used only for horse artwork generated by our administrators — never trained on or aimed at your data, and no AI moderates the chat.
12. US and California privacy rights
We do not sell or share personal information for cross-context behavioral advertising, and we do not use or disclose sensitive personal information. The categories we collect and their purposes are listed in section 1 — including the club-chat categories (messages, room and membership records, mute lists and reports) — and this section serves as the notice at collection. US residents can exercise access, correction, deletion, and portability rights via support@willowgame.com; we will not discriminate for exercising them.
13. Changes to this policy
We post changes on this page with a new "Last updated" date, and flag material changes inside the game before they take effect — not just "check back."
14. Contact
TEMNIKOVA, LDA — Campo Grande 28, 7C, 1700-093 Lisboa, Portugal
Email: support@willowgame.com