Last drafted 19 August 2026. This is a working draft pending legal review before public launch. Aethus Ltd is the data controller for THOOZIE and is committed to UK GDPR and the Data Protection Act 2018.

1. Who we are

Aethus Ltd, registered in England and Wales, trading as Thoozie. Contact us about your data at lmoshea@me.com.

2. What we hold

• Account data: email address, passkey/authentication credentials.
• Age-gate data: date of birth, and for under-18 accounts, a parent or guardian's verified email for consent to spending.
• Gameplay records: collection, duel history, swap/trade history, coin and pack ledger entries, quest and streak progress.
• Submitted content: any photo, board title or other content you choose to submit, with EXIF location data stripped before storage.
• Payment records: transaction history — card details are held by Stripe, not by us.

3. Why we hold it

To run your account and the game itself (contract necessity), to meet the age-verification and consumer-protection obligations described in our compliance approach (legal obligation), and to improve the game and prevent fraud or abuse (legitimate interest, balanced against your rights).

4. Who processes it

We keep the list of processors short and named:

• Mailgun (EU region) — transactional and account email.
• Stripe — payment processing.
• Our own infrastructure — application, database and backups run on servers we operate in the UK/EU; we do not use third-party cloud platforms for core data storage.

Each processor is bound by data processing terms consistent with UK GDPR.

5. How long we keep it

Account and gameplay data for as long as your account is active, plus a limited retention period after closure for fraud prevention and legal record-keeping. Payment records are kept as long as UK tax law requires.

6. Your rights

Under UK GDPR you can ask us to access, correct, delete, or export your data, restrict or object to certain processing, and complain to the Information Commissioner's Office (ICO) if you think we've got it wrong. Email lmoshea@me.com to exercise any of these.

7. Children's data

We collect the minimum needed to run the age gate and parental-consent flow for under-18 players, and no THOOZIE account is available to anyone under 13.

8. Cookies

We use strictly necessary session cookies to keep you signed in, and privacy-respecting, self-hosted analytics that does not track you across other sites.