Privacy Policy

Who we are

MaskedWaffle is operated by MaskedWaffle Ltd, a private limited company registered in England and Wales under company number 17507750, with its registered office at 128 City Road, London, United Kingdom, EC1V 2NX. MaskedWaffle Ltd is the controller of the personal information described in this policy. Email privacy@maskedwaffle.com or write to our registered office with any privacy question or request.

What we collect

• Sign-in and membership: your Patreon name, account identifier, tier, membership start date and, where available, next renewal date. We use a one-way key derived from the identifier day to day, and keep the identifier itself in a restricted record once you accept our terms so your acceptance can be identified after deletion. We never receive your Patreon password, payment details or email address.
• Artist profile: your artist name and any country, logo and social handles you add, with their review status and any review reasons.
• Submissions: artwork files, filenames, card details, Evolution links, review status and reasons, and the confirmations you give.
• Contact: your email address and message when you email us.
• Activity records: an audit trail of important account, submission, review and admin actions, and records of when you accepted our legal documents.
• Exit feedback: an optional reason for leaving, stored without any link to your account.

Patreon provides the sign-in and membership information; everything else comes from you or your use of the portal. The providers listed below keep standard server logs, including your IP address and browser details; we do not store those ourselves.

Why we use it

• Contract: to sign you in, apply submission allowances, run the portal, review submissions, publish accepted work in Trading Art Shop and credit you.
• Consent: to use an artwork for promotion when you tick the separate, optional promotion box. You can withdraw that permission for future use at any time.
• Legitimate interests: to secure and administer the service, prevent misuse, keep an accountable record of important actions, and handle copyright, ownership or other legal claims.
• Legal obligations: where the law, a court order or a valid request from an authority requires us to keep or disclose information.

We do not sell personal information, use it for advertising, or make automated decisions about you with legal or similarly significant effects. Membership information, an artist name, one social handle and the artwork confirmations are required to use the submission service; country, logo and promotional use are optional.

What becomes public

If your artwork is accepted and released, players can see the artwork and card details, and your artist name, logo, country and social handles may be shown so they can find you. Do not put private contact details in those fields.

Who we share it with

Only as needed to run the service: Patreon (sign-in and membership checks), Supabase (database), Cloudflare (private image storage and delivery), Vercel (website hosting), and people helping us operate or advise the business. Accepted artwork and public profile details reach players through game distributors and platforms.

We may also disclose information where the law requires it, to protect rights or safety, or in a sale or reorganisation of the business under appropriate confidentiality. Some providers process information in the United States; where transfer rules apply we rely on UK adequacy regulations or approved contractual safeguards, and can tell you which applies on request.

How long we keep it

• The temporary Patreon access token used during sign-in is not kept; cookie lifetimes are listed below.
• Profiles and submissions are kept while you use the portal, unless you delete them.
• Audit records become eligible for deletion after two years and are removed by a daily cleanup.
• Website Terms acceptance records and the restricted Patreon account identifier are kept while your account is active and for six years after deletion (the legal limitation period for contract claims), then deleted automatically.
• Artwork acceptance and licence evidence is kept while the artwork remains licensed for any released game build and for six years after that licence ends, and is reviewed at least yearly.
• Published artwork and credits may remain in game builds already released, as explained in the Artist Terms.
• Exit feedback is deleted after 12 months. Image identifiers may be held after account deletion until the next game update and storage cleanup complete.
• Backups and provider logs expire on our providers' normal schedules.

Cookies

The site uses only the cookies needed to sign you in, with no advertising or analytics cookies and no local browser storage, so no cookie banner is shown.

• patreon_oauth_state: protects the Patreon sign-in request against tampering. Expires after 10 minutes.
• patreon_pending_session: holds your verified Patreon sign-in while you accept the Website Terms. Expires after 10 minutes.
• patreon_session: keeps you signed in to the artist portal. Expires after one hour.
• maskedwaffle_admin_access, maskedwaffle_admin_refresh and maskedwaffle_admin_expiry: keep MaskedWaffle staff signed in to the admin area. Expire after no more than eight hours.

All are secure, HTTP-only, SameSite cookies sent only to this site. Blocking or deleting them in your browser will sign you out. If we ever add analytics or advertising storage, we will update this policy and ask for consent first where required.

Your rights and complaints

You can update your profile, manage submissions and delete your account in the portal. Deleting your account stops new promotional use and queues released game data for removal from the next update; signing out or cancelling Patreon does not by itself delete your records.

You can also ask us for access to, correction, deletion, restriction or portability of your personal information, object to its use, or withdraw consent. Some rights have legal exceptions, for example where information is needed for a legal claim.

To make a data protection complaint, email privacy@maskedwaffle.com. We will acknowledge it within 30 days, look into it without undue delay, keep you informed and tell you the outcome. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, although we would appreciate the chance to resolve your concern first.

Children

The portal is for artists aged 18 or over. We do not knowingly collect information from anyone younger. If you believe we have, email us and we will delete it.

Changes

We update this policy when our processing changes and show the date above. We will bring material changes to the attention of affected users where reasonably practical.