Privacy Policy

Last updated 2026-11-07. Effective when published on fatespun.com. Midnight Kitty LLC, d/b/a Midnight Kitty Games.

This policy explains what information Fatespun collects, why, who it is shared with, and the choices you have. "Fatespun" means the game on every platform it is offered on (Steam on Windows and Mac, and the App Store on iPhone, iPad and Apple silicon Macs), its online services, and the website fatespun.com. "We", "us" and "our" mean Midnight Kitty LLC, d/b/a Midnight Kitty Games.

In short: we collect what it takes to run your account, save your game, show your rival boards to other players, deliver what you buy, keep the game fair, and balance it. If you choose to report a bug, we also receive what you send with the report. We do not show ads, we do not track you across other apps or websites, the game has no third-party analytics or advertising software in it, and we do not sell your information.

1. Scope

This policy covers everyone who plays Fatespun, whether or not they create an account, and everyone who visits fatespun.com. You can play without an account; your progress then stays on your device and none of the online features in this policy apply to you. Steam and the App Store are run by Valve and Apple under their own privacy policies; Section 7 explains what we receive from them.

2. Information we collect

2.1 Information you give us

• Account details. The email address and password you sign up with. Your password is stored only as a secure hash by our authentication provider; we cannot read it.
• Your public name. The handle you choose and the number assigned with it (such as Name#1234), and the portrait you pick from the game's own art. We do not ask for your real name.
• Reports. If you report a player, we record who reported, who was reported, the rival board involved, the reason you chose and when. The reported player is not told who reported them.
• Friends. If you use friends features, we keep your friend requests and friends list.
• Support messages. What you send to support@fatespun.com, and your email address, so we can answer.
• Bug reports. The game has a REPORT A BUG button (in the pause menu, and on the card the game shows if it runs into repeated errors). Before anything is sent, the report screen lists exactly what will go with your note, and nothing is sent until you press SEND. A report holds: the note you type; a screenshot of the game's own screen, taken before the report screen opened, which you can see and switch off; the last part of the game's log file, with file paths, your computer's user name, email addresses, account IDs, sign-in tokens and network addresses removed on your device and again on our server; the game version, platform, operating system version and device model; a random ID the game made for your installation (it is not a hardware ID, it is not shared, and reinstalling the game makes a new one); the name of the error, if the game raised one; and where you were in your run (its seed, class, act and map node). If you are signed in, the report is tied to your account; if you are not, it is tied only to the random installation ID. If your device is offline, the report waits on your device and is sent when you are next online. We use a one-way code of your network address to limit abuse, and we do not keep the address itself. When we reply, the reply appears in the game the next time you play.

2.2 Information created when you play online

• Progress. Your level and experience for each class, unlocks, the items you have equipped, card upgrades, and your balance of thread (an in-game currency earned by playing, never sold).
• Run records. When a run ends, the game sends a record of it so the server can verify it before granting rewards: the class, how far you got, the result of every fight in order (who won and the health left on each side), the deck you finished with, the fight that ended the run, and the game version. We also keep counts of how often each card, trait and boon appears in your runs, which the game shows you.
• Fair play checks. When a run or save fails verification, we record what failed and why on your account.
• Rival boards. When you win certain fights, the board you won with (its cards, upgrades, powers, boons and health) is uploaded so other players can meet it as a rival. It is stored with your account and shown with your handle.
• Cloud save. Your run in progress, so you can continue on another device, with the time it was saved and the game version.
• Online status. If you use friends features, your status (such as online or in a run), visible only to friends you have accepted.

2.3 Purchases

Payments are made through Steam or the App Store. We never receive your card number, bank details or billing address. We receive and keep:

• Steam: the order number, the item, its price and currency, and Steam's record of the transaction, which includes your Steam ID and the country (and, in the United States, the state) Steam reports for the purchase.
• App Store: Apple's signed record of the transaction: its transaction numbers, the item, the purchase date, the price and currency, the App Store country, whether it was a test or real purchase, and an account token. The account token is a random number we create for your Fatespun account so that Apple's record points back to the right account. Apple does not tell us who you are.
• From either store, notices that a purchase was refunded or reversed, so we can remove or restore the item.

2.4 Sign in with Steam (PC only)

If you sign in with Steam, Steam confirms your Steam ID to us. We use it to find or create your account and give the account an internal placeholder address made from a one-way code of your Steam ID. We do not receive your Steam email address, password, real name or friends list.

2.5 Information collected automatically

• Security records. Our authentication provider records the IP address and device or browser type used to sign in and keep a session, to protect accounts. We do not use IP addresses to work out where you are, and the game itself does not store them.
• Request logs. The companies that host our services keep short-lived technical logs of requests (such as time, address and response) under their own policies, for security and reliability.
• Game version. Saves, runs and rival boards carry the version of the game that made them.
• How the game is played. We read the run records above together, in aggregate, in our own database: how many runs start and finish each day, where runs end, which classes and difficulty levels are chosen, how many people play the daily challenge, how many accounts are made and when players come back, and how many bug reports arrive. These tallies are made by us from records the game already sends for the reasons above; no analytics company receives anything, and the tallies are not used for advertising or to profile you.

2.6 What we do not collect

We do not collect your precise or approximate location, your device's contacts, photos, camera or microphone, advertising identifiers, hardware device identifiers, health data, date of birth or payment card details. The only identifier the game makes for your device is the random installation ID that goes with a bug report you choose to send (Section 2.1). The game contains no third-party analytics, advertising, attribution or crash-reporting software. Fatespun is built with the Unity engine; Unity's analytics, crash-reporting and performance-reporting services are turned off in the game. Unity can also send Unity anonymous hardware statistics (such as device model, operating system and graphics chip) under Unity's own privacy policy; we never receive them and we turn them off wherever Unity allows.

3. Data that stays on your device

Your settings (sound, display, accessibility and tutorial choices), your local save, and the game's log file are kept on your device and are not sent to us, except that when you press SEND on a bug report, the end of the log file goes with it, cleaned as Section 2.1 describes. When you sign in, your session is stored on your device in encrypted form: protected by Windows on PC, and encrypted with a key kept in the game's own private storage on iPhone, iPad and Mac. The file made by EXPORT MY DATA is saved on your device. If you send us a log file or screenshot for support, we use it only to help you.

4. How we use information

• To create and run your account and sign you in on each device.
• To save your progress and cloud save and keep them in step across devices.
• To show your handle and rival boards to other players, and theirs to you.
• To verify runs and purchases on our server, and to find and stop cheating, forged progress and fraud.
• To deliver what you buy, restore it on your other devices, and remove it if a store refunds it.
• To balance the game. We read run and fight records together, across many players, to tune difficulty and fix unfair cards and fights. We do not use them to profile you or for advertising.
• To review reports, enforce our Terms and keep players safe.
• To find and fix the bugs you report, and to answer you. Bug report contents are read only by us, for that purpose.
• To see how the game is played, in aggregate, so we can decide what to fix and improve (Section 2.5).
• To answer support requests and send account emails: sign-up confirmation, password reset and email change. We do not send marketing email.
• To meet legal obligations, such as keeping sales records for tax.

5. Cookies and local storage

fatespun.com sets no cookies and runs no analytics or advertising scripts. The game is an app, not a web page, and uses no browser cookies; what it keeps on your device is described in Section 3.

6. How we share information

With other players. Every signed-in player can see your handle, its number and your portrait. Rival boards you upload are shown to other players with your handle. Your account's internal ID, a random string that does not reveal your email, travels with your rival boards. Your email address, purchases and progress records are never shown to other players.

With the companies that run our services. They process information only to provide their service to us, under their own privacy terms:

• Supabase: accounts and sign-in, the database for profiles, progress, run records, rival boards, purchases and bug reports, private storage for bug report screenshots, account emails, and our server functions. United States.
• Cloudflare: storage for cloud saves, the service that reads and writes them, and hosting for fatespun.com. United States and Cloudflare's global network.

With the stores. Valve (Steam) and Apple (App Store) process your payments, sign-in (Steam) and refunds as independent companies under their own privacy policies. We send Steam the order details needed to bill a purchase, and we ask Apple and Steam to confirm transactions.

When the law requires it, or to protect people. We may disclose information if required by law, to enforce our Terms, or to protect the rights, property or safety of our players, us or others. If our business is sold or merged, information may pass to the new owner under this policy, and we will tell you first.

We do not sell your personal information, and we do not share it for advertising.

7. Information from Steam and Apple

We receive only what Section 2 describes: your Steam ID when you sign in with Steam, and transaction records from each store when you buy, restore or are refunded. Anything else Valve or Apple knows about you stays with them and is governed by their policies.

8. How long we keep information

• Your account and game data are kept until you delete your account.
• When you delete your account, from the game or by asking us, it is deleted immediately: your sign-in, email address, handle, profile, progress, run and fight records, rival boards, cloud save, friends, store links and the list of items you own. Reports you made are kept anonymized: the link to your account is cleared, and the report stays for moderation.
• Purchase records are kept after deletion, with your account ID, email address and the personal details in the store's record removed. What remains (the store, transaction numbers, item, price, currency and dates) is kept as long as we need it for refunds, chargebacks, tax, accounting and fraud prevention, and no longer than seven years after the purchase unless the law requires longer.
• Reports about another player are kept while we review them and enforce our Terms. After the reporter deletes their account, the report is kept without any link to that account.
• Bug reports (and their screenshots) are kept only while we use them to fix bugs, and never longer than 180 days: every bug report, with its screenshot, is deleted automatically 180 days after it was sent. When you delete your account, every bug report you sent while signed in, and its screenshot, is deleted with it. A report you sent while signed out is tied only to the random installation ID, which we cannot connect to you, so it cannot be found by account; it is deleted by the same 180 day rule. You can also ask us to delete a bug report sooner by emailing support@fatespun.com the time you sent it.
• Backups of our database are overwritten on their normal schedule, within a few weeks.
• Security records and request logs are kept by our providers for their usual short periods.
• Support emails are kept as long as needed to help you, then deleted.
• We may keep totals and statistics that cannot identify you, such as how often a card wins.

Deleting your account does not delete what Steam or Apple hold about your purchases.

9. Security

Information travels over encrypted connections. Each player can reach only their own private records; the database enforces this on every request. Runs and purchases are verified on the server, sign-in sessions are encrypted on your device, and access to our systems is limited. No system is perfectly secure, and we cannot promise that information will never be lost or exposed.

10. Your choices and rights

• See and export: Options, Account, EXPORT MY DATA saves your profile, rival boards and cloud save to a file. Email us for a full copy of everything we hold about you.
• Correct: change your email and password in Options, Account, or email us.
• Delete: Options, Account, DELETE MY ACCOUNT, or email us.
• Report: press and hold a rival's portrait to report its name or cheating.

Depending on where you live, you may also have the right to object to or restrict some uses, to withdraw consent, and to complain to a regulator. Email support@fatespun.com from the address on your account; we may ask you to confirm the request comes from you, and we answer within the time the law sets. We will not treat you differently for using these rights.

11. Players in the EEA, UK and Switzerland

Midnight Kitty LLC, d/b/a Midnight Kitty Games is the controller of your information. We rely on these legal bases:

• Contract: to provide your account, saves, rival boards and purchases.
• Legitimate interests: to keep the game fair and secure, review reports, and balance the game from run records. You may object, and we will stop unless our reasons outweigh your rights.
• Legal obligation: to keep sales records.

You may lodge a complaint with the data protection authority where you live or work.

12. California residents

In the last 12 months we collected these categories: identifiers (email address, handle, account ID, Steam ID), commercial information (purchase records), and internet or other electronic network activity (gameplay records and security records). We collected them from you, your device, Steam and Apple, for the purposes in Section 4. We do not sell or share personal information, as the CCPA and CPRA define those words, and we do not use sensitive personal information. You may ask to know, delete or correct your information, and you will not be treated differently for asking. Email support@fatespun.com.

13. International transfers

We and our providers store and process information in the United States. Where the law requires it, transfers from the EEA, UK and Switzerland are covered by the European Commission's Standard Contractual Clauses and their UK and Swiss equivalents, through our providers' data processing terms.

14. Children

Fatespun is not directed at children under 13, and we do not knowingly collect information from them. In the EEA and UK, a player under 16 (or the lower age set in their country) needs a parent or guardian's permission to create an account. If you believe a child has given us information, email support@fatespun.com and we will delete the account.

15. Changes to this policy

When we change this policy we update the date at the top. If a change is significant, we will tell you in the game or by email before it takes effect.

16. Contact

Midnight Kitty LLC, d/b/a Midnight Kitty Games. Postal address: Nicola Antonio Nastasi, 5551 Hollywood Blvd #1343, Los Angeles, CA 90028, United States. Email support@fatespun.com. See also the Terms of Service and the Support page.