Privacy Policy
Last updated: [DATE]
1. Your privacy
Your privacy matters to us. We collect as little personal information as we can get away with, we use it only for the purposes described here, and we do not sell it to anyone.
This policy explains what personal information we collect, why we collect it, how long we keep it, who we share it with, and what rights you have over it.
Personal information means information that identifies you or could be used to identify you — your username, email address, date of birth, IP address and similar. It does not include information that is already public or that has been fully anonymised.
If we make a significant change to this policy, we will update the date above and tell you — by email, by a notice on the website, or through a notice when you next log in.
2. Who we are
Data controller: [LEGAL ENTITY OR OPERATOR NAME] Privacy contact: [PRIVACY EMAIL]
LittleWorlds is an independent, fan-made project and is not affiliated with Outsmart Ltd or the original creators of SmallWorlds.
3. What we collect
When you register Username, email address, password (stored only as a secure hash — we never see or store your actual password), and date of birth. We use date of birth to confirm you meet our minimum age and to apply age-appropriate settings.
When you use the game Avatar and character details, spaces you build, items you own, currency balances, friend lists, achievements, progress and settings.
Chat and communications Public and private chat messages, and content you post in shared spaces. These may be logged and retained for moderation, safety and abuse investigation.
Reports and moderation records Reports you make or that are made about you, along with any action taken and our notes on it.
Technical information Our servers automatically log your IP address, browser type and version, device and operating system, timestamps, referring pages, the pages and features you use, and error and crash data.
Cookies and similar technologies Small files stored by your browser. See section 8.
Purchase information If you buy anything, we record what you bought, when, the amount, and a transaction reference. We never store your card number, CVV or other full payment details. Payments are handled entirely by our payment provider, and where you choose to save a card, it is stored in their secure systems, not ours.
What we do not collect We do not ask for your real name, home address, phone number or school. Please do not share those with us or with other players.
4. Why we use it, and our legal basis
Under UK GDPR we must have a lawful basis for each use of your data. Ours are:
| What we use it for | Legal basis |
|---|---|
| Creating and running your account, delivering the game | Performance of a contract |
| Processing purchases and keeping transaction records | Performance of a contract; legal obligation |
| Moderation, safety, preventing cheating, fraud and abuse | Legitimate interests; legal obligation |
| Age verification and applying protections for younger players | Legal obligation; legitimate interests |
| Fixing bugs, improving and securing the service | Legitimate interests |
| Service emails you need to receive (password resets, security, important changes) | Performance of a contract |
| Optional marketing or newsletter emails | Consent — you can withdraw it at any time |
| Non-essential cookies and analytics | Consent |
| Responding to legal requests, defending legal claims | Legal obligation; legitimate interests |
We do not use your data for automated decision-making that has a legal or similarly significant effect on you. Automated systems may flag accounts for cheating or abuse, but a person reviews the outcome before any permanent ban, and you can appeal.
5. Who we share it with
We do not sell your personal information, and we do not share it for advertising.
We share it only in these circumstances:
- Service providers who work on our behalf — hosting and infrastructure, content delivery and security, payment processing, email delivery, and error monitoring. They act on our instructions under contract, may only use the data to provide their service to us, and may not use it for their own purposes.
- Other players — your username, avatar, spaces, owned items and anything you post publicly are visible to other players. Your email address and date of birth are never shown to them.
- Where the law requires it — to comply with a legal obligation, court order or lawful request from an authority, or to establish, exercise or defend legal claims.
- Safety — to prevent or investigate illegal activity, breaches of our Terms of Service, or anything that threatens the safety of any person. Where a child is at risk, we will report to law enforcement and child protection authorities and provide the information they lawfully request.
- If the project changes hands — if LittleWorlds is transferred to, merged with or acquired by another operator, your data may transfer with it. We will tell you first, and your rights under this policy will not be reduced.
Current categories of provider include cloud hosting, CDN and DDoS protection, a payment processor, and an email delivery service. We can tell you who they are on request.
6. Where your data is held
Our servers and service providers may be located outside the UK. Where personal data is transferred outside the UK, we rely on an appropriate safeguard — an adequacy decision, or the UK International Data Transfer Agreement or Addendum — so that your data keeps an equivalent level of protection.
7. How long we keep it
| Data | Retention |
|---|---|
| Account and game data | While your account is active |
| Account data after you delete your account | Deleted or anonymised within 30 days, except as below |
| Chat logs | [e.g. 90 days], then deleted |
| Moderation and ban records | Up to [e.g. 3 years], so bans can be enforced and appeals reviewed |
| Child safety records | Retained as long as necessary, and shared with authorities where required |
| Purchase and transaction records | 6 years, to meet tax and accounting obligations |
| Server and security logs | [e.g. 90 days] |
If you are banned, we keep the minimum information needed to enforce that ban — otherwise it could be avoided simply by making a new account.
8. Cookies
We use cookies and similar storage for:
- Essential — keeping you logged in, security, load balancing, remembering your settings. These are required for the service to work and cannot be turned off.
- Analytics — understanding how many people visit and which features they use, so we can improve them. These are optional and only set with your consent.
You can clear or block cookies through your browser settings, though blocking essential cookies will stop you logging in.
We do not use advertising or cross-site tracking cookies.
9. Children and younger players
LittleWorlds has a minimum age of 13. We do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has an account, contact [PRIVACY EMAIL] and we will investigate and delete the account and its data.
If the minimum age of consent for online services in your country is higher than 13, that higher age applies.
For players under 18:
- We apply the strongest privacy settings we reasonably can by default.
- We do not show targeted advertising, and we do not profile younger players for marketing.
- We do not ask for more information than we need.
- A parent or guardian may contact us to access, correct or delete their child's data, or to close the account. We may ask for proof of your relationship to the child before acting.
Parents and guardians: we encourage you to talk to younger players about not sharing personal details with anyone online, including other players.
10. Your rights
Under UK GDPR you have the right to:
- Be informed about how we use your data — that is what this policy is for.
- Access a copy of the personal data we hold about you.
- Correction of data that is inaccurate or incomplete.
- Erasure of your data, where we have no overriding reason to keep it.
- Restriction of how we use your data while a dispute is resolved.
- Portability — receive your data in a machine-readable format, or have it sent to another provider.
- Object to processing based on our legitimate interests.
- Withdraw consent at any time, where consent is the basis we rely on. Withdrawing it will not affect anything done beforehand.
To exercise any of these, email [PRIVACY EMAIL]. We will respond within one month. We may ask you to confirm your identity first, so that we do not hand your data to someone else.
Exercising these rights is free, and we will not restrict or ban your account for doing so.
11. Complaints
If you are unhappy with how we have handled your data, please tell us first — we would rather fix it.
You also have the right to complain to the UK's data protection regulator:
Information Commissioner's Office ico.org.uk · 0303 123 1113
If you live elsewhere, you may complain to your local data protection authority instead.
12. Security
We take reasonable technical and organisational steps to protect your data, including encryption in transit, hashed passwords, access controls, and restricting who can see personal data.
No service can be completely secure. Please use a strong, unique password, and do not reuse the one you use elsewhere.
If a data breach occurs that is likely to result in a risk to your rights, we will notify the ICO within 72 hours and tell affected users without undue delay.
13. Marketing emails
We will only send you optional emails about LittleWorlds if you have opted in. Every one of them has an unsubscribe link, and you can also change your preferences in your account settings.
Service emails — password resets, security alerts, and notices about important changes — are not optional while you have an account, because you need them.
14. Third-party links
The website and game may link to third-party services such as our Discord server, social media accounts and payment provider. Those services have their own privacy policies, and we are not responsible for how they handle your data.
15. Contact
- Privacy questions and data requests: [PRIVACY EMAIL]
- General support: [SUPPORT EMAIL]
- Safety and urgent reports: [SAFETY EMAIL]