Effective July 10, 2026 — Pueblo de Vacas Studios LLC
What We Collect
When you register, we collect your first name, last name, date of birth, email address, and chosen username. Every successful login records your IP address, your user ID, and a timestamp in our login history for security and fraud prevention. While you are logged in, we maintain a server-side session record linked to your account.
We do not collect passwords. When you log in, we generate and store a hashed one-time passphrase. We do not collect or store full payment card details — payment processing is handled by our payment processor(s). When payments are enabled, we store a non-sensitive payment method identifier provided by the payment processor for fraud prevention purposes, specifically to enforce bans on payment methods associated with fraudulent chargeback activity.
How We Use It
- Account operation — your name and email are used to send login codes and for internal account management only.
- Age verification — your date of birth is checked at registration to confirm you are 18 or older and is not used for any other purpose.
- Gameplay — your username, leaderboard stats, rank, Claims to Fame awards, and Krill activity are used to operate the game and display results on public leaderboards and The Current feed.
- Security, rate limiting, and fraud prevention — IP addresses are logged on every login and used to enforce request limits, detect abuse, and maintain a list of banned IPs associated with fraudulent activity. Payment method fingerprints are stored solely to enforce payment bans on accounts terminated for chargeback fraud. We do not build advertising or behavioral profiles from IP or payment data.
What Is Public vs. Private
Your username, rank, leaderboard position, Claims to Fame awards, and game activity (Krill purchases, spends, Rot events) are publicly visible on leaderboards, public profiles, and The Current feed — including to visitors who are not logged in.
Your first name, last name, email address, and date of birth are private. They are never shown on public profiles, leaderboards, or the feed under normal circumstances. However, in cases of confirmed fraud or chargeback abuse, we reserve the right to make otherwise-private account information public — including the account holder's name — for the purposes of publicising fraudulent activity and protecting the platform and its users from future harm. By using Whale Watch you acknowledge and consent to this possibility in the event of fraud.
Cookies and Session Data
We use a single session cookie to keep you logged in. This cookie contains only a session token; no personal data is stored in the cookie itself. The session is stored server-side and is invalidated when you log out.
We do not use advertising cookies, tracking pixels, or third-party analytics cookies.
We send email only to deliver one-time login codes. We do not send marketing email without explicit consent. We do not sell or share your email address with third parties.
Third-Party Services
We do not sell, rent, or trade your personal information to any third party, for any reason, ever.
Whale Watch does not currently use third-party analytics, advertising networks, or social login providers. When production payments are enabled, transactions will be processed by one or more third-party payment processors, each operating under their own privacy policy. We will share only the information necessary to process a transaction.
Data Retention
Account data is retained for as long as your account is active. Login codes are deleted or expire within 15 minutes of generation. Session records are invalidated on logout. Feed events and ledger entries are retained as part of the game record and audit history. Login history (IP address, site, timestamp) is retained for security and fraud investigation purposes.
Banned accounts are not deleted. The account record, ban reason, login history, and associated payment method fingerprints are retained indefinitely to enforce the ban and prevent re-registration. The public profile of a banned account remains visible with a ban notice.
You may request deletion of your account by contacting us at the address below, provided the account is not banned. Immutable ledger records required for financial audit may be retained in anonymised form after account deletion.
Security
Login codes are stored hashed. Sessions are server-side. Database credentials and SMTP secrets are not logged or exposed in application output. We apply rate limiting to authentication and purchase endpoints. No system is perfectly secure; we will notify affected users of any breach that poses a material risk to their data.
Children
Whale Watch requires users to be 18 or older. We do not knowingly collect data from anyone under 18. If you believe a minor has registered, contact us immediately and we will remove the account.
Your Rights
You may request a copy of the personal data we hold about you, ask us to correct inaccurate data, or request deletion of your account. Contact us at contact@pueblodevacas.com.
Changes
We may update this policy as the service evolves. Material changes will be posted on this page with an updated effective date. Continued use of Whale Watch after a change is posted constitutes acceptance of the revised policy.
Contact
Pueblo de Vacas Studios LLC
contact@pueblodevacas.com