Desync Studios LLC (“Desync Studios”, “we”, “us”) makes the video game Treasure Goblins and operates the website treasuregoblinsgame.com. This policy explains what personal data we handle, why, and what rights you have over it.
We have deliberately built Treasure Goblins to need almost no personal data. There is no account to create, no email to give us, no text chat, no voice chat, no analytics or telemetry, and no advertising. Nearly everything below is a description of data that stays between you, Valve's Steam service, and the other players in your own game session.
If you only read one section, read What we do not do.
1. Who is responsible for your data
Data controller:
Desync Studios LLC
2810 N Church St PMB 99320
Wilmington, DE 19802
United States
Privacy contact: privacy@desyncstudios.com
We are a very small studio. Contacting the address above reaches the person who actually handles these requests.
Valve Corporation operates Steam and is a separate, independent data controller for your Steam account, your purchase of Treasure Goblins, and the Steam features the game uses. We do not control Valve's practices and Valve does not process this data on our behalf. Please read the Steam Privacy Policy for how Valve handles your information.
2. What this policy covers
This policy covers:
- The Treasure Goblins game client, including its multiplayer functionality.
- The website treasuregoblinsgame.com.
It does not cover Steam itself, or any third-party service you reach by following a link from our website or store page.
3. What we do not do
To be explicit, because it is unusual enough to be worth stating plainly:
- We do not operate any game server, database, account system, or backend of our own. There is nowhere on our infrastructure where your player data is stored.
- We do not collect analytics, telemetry, gameplay statistics, or crash reports.
- We do not collect your name, email address, postal address, phone number, date of birth, or payment information. Your purchase is handled entirely by Valve; we never see your payment details.
- We do not have text chat or voice chat of any kind, and the game never accesses your microphone. Player-to-player communication is limited to an emote wheel.
- We do not sell or share your personal information, and we do not engage in “targeted advertising” or “profiling” as those terms are used under GDPR and US state privacy laws.
- We do not use tracking cookies or advertising cookies.
- We do not knowingly collect data from children — see section 10.
4. What data the game processes, and why
All processing below happens either on your own computer or directly between the computers of players in your session, routed through Valve's Steam networking service. We do not receive copies of it.
| Data | Where it comes from | Why | Who can see it | Legal basis (GDPR) |
|---|---|---|---|---|
| Steam ID (your public numeric Steam account identifier) | Steam, when the game starts | To establish the multiplayer connection, to identify who is host, and to match players to their in-game character | Other players in your session; visible in Steam lobby data | Art. 6(1)(b) — necessary to provide the multiplayer game you bought |
| Steam persona name (your public Steam display name) | Steam, when the game starts | Shown on your character's nameplate and on the in-game scoreboard so players can tell each other apart. Also used to label a lobby you host, e.g. “Dave's game” | Other players in your session. If you host a public lobby, this label is visible to anyone browsing for games | Art. 6(1)(b) — necessary to provide the multiplayer game |
| Steam friends and lobby information | Steam, on request | To show you which friends have joinable lobbies, and to let you join by invite or by code | Only you, on your own machine | Art. 6(1)(b) |
| Gameplay state (position, score, health, actions) | Your inputs during a match | To run the shared game simulation | Other players in your session, for the duration of the match | Art. 6(1)(b) |
| Game version | Your game client | Sent when connecting so that incompatible builds are rejected with a clear message instead of desyncing | The host of the session you join | Art. 6(1)(f) — legitimate interest in the game working correctly |
| Your game settings (resolution, quality, volume) | Your choices in the options menu | To remember your preferences | Only you. Stored locally on your own computer, never transmitted | Art. 6(1)(b) |
Network connections and IP addresses
Multiplayer sessions connect through Steam's relay network. This design means players connect via Valve's relay servers rather than directly to each other, so players in your session are not shown your IP address. Valve handles this routing as an independent controller; see the Steam Privacy Policy.
We never receive your IP address from the game, because the game never contacts any server we operate.
5. What other players can see
Because Treasure Goblins is a multiplayer game, some information is necessarily visible to the people you play with:
- Your Steam persona name and, through Steam's own lobby system, your Steam ID. Anyone with your Steam ID can look up whatever your Steam profile makes public. You control that through your Steam privacy settings.
- If you host a public lobby, a lobby name derived from your persona name appears in the in-game public game browser, visible to any player browsing for a game.
- Your gameplay actions and score during the match.
We cannot control what other players do with information they see, in the same way we cannot control what they do with a screenshot. If you would prefer to appear under a different name, change your Steam persona name; the game uses whatever Steam reports.
6. Website
The website treasuregoblinsgame.com is a small informational site. It does not require an account and does not have a login.
- Essential/technical data: our hosting provider automatically processes standard server log data — including IP address, browser type, and pages requested — for the purpose of serving the site securely and diagnosing faults. This is ordinary and unavoidable for any website. Legal basis: Art. 6(1)(f), legitimate interest in operating and securing the site.
- Cookies: we do not set advertising or tracking cookies. If we use any non-essential cookies or website analytics in future, we will ask for your consent first via a banner, and update this policy.
- Embedded content: pages containing an embedded video, storefront widget, or social feed may cause your browser to contact that third party directly, which lets them see your IP address. Their own privacy policies apply.
- Links: our site links to Steam and other third-party sites we do not control.
Our website is hosted by Cloudflare, Inc. (Cloudflare Pages), which processes the server log data described above as our processor. Cloudflare publishes a Data Processing Addendum covering this processing.
7. Retention
- We hold no player data, so there is nothing on our side to retain or delete. Gameplay data exists only in memory on participating players' computers during a session, and is gone when the session ends.
- Your local settings stay on your computer until you delete them or uninstall the game.
- Steam data is retained by Valve according to Valve's own policy.
- Website server logs are retained by our hosting provider for a short period for security and diagnostic purposes, typically no longer than 30 days.
- Emails you send us (for example a support or privacy request) are kept only as long as needed to deal with the matter and to keep a record that we did, generally no more than 24 months.
8. International transfers
Desync Studios LLC is based in the United States. If you are in the European Economic Area, the United Kingdom, or Switzerland, correspondence you send us is therefore transferred to and read in the US.
Because we operate no player database, the game itself does not transfer your personal data to us. Multiplayer traffic is routed by Valve, and Valve's transfers are governed by Valve's own policy and safeguards.
Where we do receive personal data from the EEA or UK — in practice, only when you email us — we rely on your consent or on the necessity of that transfer to respond to your own request (GDPR Art. 49(1)(a)–(b)), or on Standard Contractual Clauses where a provider we use offers them.
9. Your rights
If you are in the EEA, the UK, or Switzerland
Under the GDPR and UK GDPR you have the right to:
- access the personal data we hold about you, and receive a copy;
- rectify inaccurate or incomplete data;
- erase your data (“right to be forgotten”);
- restrict processing in certain circumstances;
- object to processing based on legitimate interests;
- data portability for data you provided to us, where processing is based on consent or contract;
- withdraw consent at any time, where we rely on consent;
- not be subject to decisions based solely on automated processing with legal or similarly significant effects — we do not carry out any such processing;
- lodge a complaint with your national data protection supervisory authority. In the UK this is the Information Commissioner's Office. In the EEA, a list of authorities is maintained by the European Data Protection Board. You may also seek a remedy through the courts.
A practical note on making a request: because we hold no player database, we usually have nothing to give you, correct, or erase — there is no record of you on our systems to begin with. If your request concerns your Steam account, your purchase, your playtime, or Steam-side records, that data is held by Valve and you should direct your request to Valve through Steam Support. If your request concerns an email you sent us, we can and will act on it.
To exercise any right, email us at the privacy contact in section 1. We will respond within one month, as required by Art. 12(3), and will tell you if we need to extend that for a complex request. We will not charge you, and we will not treat you worse for asking. We may need to ask you to verify that a Steam ID or email address is genuinely yours before acting.
If you are in California
Under the CCPA/CPRA you have the right to know, delete, and correct personal information, the right to opt out of sale or sharing, the right to limit use of sensitive personal information, and the right not to be retaliated against for exercising these rights.
We do not sell or share your personal information, we do not use or disclose sensitive personal information beyond what is necessary to provide the game, and we do not use your information for cross-context behavioural advertising. The categories of personal information described in section 4 are the only categories involved; we collect them for the business purposes stated there. To make a request, use the privacy contact in section 1. You may use an authorised agent.
If you are elsewhere in the United States
Residents of states with comprehensive privacy laws — including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others as they take effect — have broadly similar rights to access, correct, delete, and obtain a copy of personal data, and to opt out of targeted advertising, sale, and profiling. We do not carry out targeted advertising, sale, or profiling. Use the same contact to make a request. Where a state provides an appeal process for a refused request, you may appeal by replying to our response, and we will reconsider and explain our decision.
Everyone else
Wherever you live, you are welcome to contact us with a privacy question or request and we will deal with it in good faith.
10. Children
Treasure Goblins is not directed at children under 13, and we do not knowingly collect personal data from them. Steam's own Steam Subscriber Agreement requires account holders to be old enough to form a binding contract, and access to the game is through Steam.
In the EEA and UK, where consent is a legal basis for processing, we do not knowingly rely on the consent of a child below the applicable age of digital consent (13–16 depending on country) without the authorisation of a parent or guardian.
If you believe a child has provided personal data to us directly — for example by emailing us — contact us and we will delete it.
11. Security
We keep the attack surface small on purpose: no accounts, no passwords, no backend, and no stored player data means there is very little about you that could be exposed by a breach on our side.
For what we do handle, we use reasonable and appropriate measures: our website is served over HTTPS, and access to our email and developer accounts is protected by strong authentication. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
If a breach affecting your personal data occurs and it presents a risk to your rights, we will notify the relevant supervisory authority within 72 hours where GDPR requires it, and notify affected people where required by law.
12. Changes to this policy
We may update this policy as the game changes — for example if a future update adds a feature that processes new data. When we do, we will change the “Last updated” date at the top and publish the new version at https://treasuregoblinsgame.com/privacy.
If a change materially affects your rights or how we handle your data, we will give clear notice — in the game, on our Steam page, or on our website — rather than relying on you noticing a new date.
13. Contact
Questions, requests, or complaints about privacy:
Email: privacy@desyncstudios.com
Post: Desync Studios LLC, 2810 N Church St PMB 99320, Wilmington, DE 19802, United States
We read everything, and you will get a reply from a human.