1. Controller and contact
Foxinelo Ltd., 20–22 Wenlock Road, London N1 7GU, United Kingdom, is responsible for the processing described here. Privacy enquiries: [email protected]; game support: [email protected].
2. Visiting the website
When you visit, we process your IP address, request time and address, transfer and error information and details provided by your browser. These can include browser, operating system and referring page. We use them to deliver the website, investigate faults and prevent attacks. The basis is our legitimate interest in secure operation under Article 6(1)(f) of the GDPR or UK GDPR.
Our hosting provider is Hetzner Online GmbH, Germany. Technical logs are retained for the period needed for operation, fault investigation and security analysis. A specific incident may require longer, purpose-limited retention for investigation or legal claims.
3. Cloudflare and international processing
Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, helps deliver and protect the website. This involves processing IP addresses, connection details and requested content. Its worldwide network may process data outside the UK and European Economic Area. The legal basis is Article 6(1)(f) of the GDPR or UK GDPR.
International transfers rely on applicable adequacy decisions or appropriate safeguards, including contractual data protection clauses. Contact us for information about the relevant safeguards. Further details are available in Cloudflare’s privacy policy.
4. Cookies, content and analytics
We save your expressly selected language in your browser for future visits. Without a choice, we use your browser languages. If none is supported, we use the approximate country Cloudflare derives from the IP address. If that is unavailable, the device time zone may provide a fallback. We do not request GPS location or create movement profiles. You can change language at any time; clearing site data removes the preference. This provides the requested language and serves our legitimate interest in an accessible website under Article 6(1)(f) of the GDPR or UK GDPR.
The website has no own analytics or advertising trackers, embedded social feeds or externally loaded fonts. Images and store badges are served by our website. The protection service may use necessary security cookies. External sites open only when you follow a link and apply their own privacy information.
5. Game data on your device
Vilamio saves your player name, chosen character, language, settings, progress and game events locally on your device. No registration is required. Without signing in to cloud saves, these saves are not transmitted to our game server. The game does not contain advertising or analytics SDKs.
Local recovery copies help protect against damaged files. You can delete your profile and internal copies in the game. Manually exported backups and copies held in device or cloud backups must be deleted separately at their storage locations. Automatic device backups are governed by your operating system settings and provider’s privacy terms. Moving a save file between devices is not automatic synchronisation.
5a. Optional online account and cloud saves
If you use cloud saves, we process your email address, an internal account identifier, the accepted version of the terms and your saves to provide your account and restore your street. The legal basis is Article 6(1)(b) of the GDPR or UK GDPR. Access is verified using a short-lived email code; we do not store an account password. Data are stored on our server with the hosting provider named above. Our email provider processes the information necessary to deliver the code.
We retain the five most recent online saves until replaced by newer versions or deleted with your account. Sign-in codes are valid for ten minutes; sessions expire after 30 days without renewal and no later than 180 days after signing in. Expired authentication records are cleaned up during subsequent sign-in requests. Short-lived pseudonymised request counters help prevent abuse. Saves and account information are not used for advertising.
You can delete your online account and its saves in the game after signing in again. Alternatively, request deletion at [email protected]. We verify your authority to prevent unauthorised deletion. Signing out or uninstalling alone does not delete your online account. Deleting the online account does not remove files saved locally on your devices.
6. Stores and payments
When you visit a store, obtain an app or make a payment, the store processes data under its own responsibility. This website does not request full card details. See Apple privacy information and Google privacy information.
If you send support a purchase receipt to resolve a problem, we process its order and product details for that enquiry. Do not send passwords or complete payment credentials.
7. Contact and retention
When you email us, we process your email address, supplied information and attachments, and technical delivery details to respond. Article 6(1)(b) of the GDPR or UK GDPR applies to contractual and support enquiries; otherwise Article 6(1)(f) applies to our legitimate interest in communication. Contact is voluntary; without information necessary to handle an enquiry, we may be unable to resolve it.
After an enquiry is closed, support data are deleted once they are no longer needed for handling the matter, existing legal claims or statutory retention duties. The period depends on the nature and progress of the enquiry and any applicable legal deadlines. Hosting and email service providers receive only the data needed to provide their services.
8. Your rights
Subject to the applicable conditions, you have rights of access, correction, erasure, restriction and portability. You may object to processing based on legitimate interests on grounds relating to your situation. Consent may be withdrawn for the future. The activities described here do not involve solely automated decisions with legal or similarly significant effects.
You may complain to a competent data protection authority, including in your place of residence. In the UK, this is the Information Commissioner’s Office. Our ICO registration is ZB613316.
9. Changes
We update this information when the processing described changes. New features requiring consent are not enabled merely by changing this policy.