Privacy Policy

Last updated 2026-09-12. This policy covers the Spellgrove game (Android, iOS and the browser version at https://spellgrove.com/play) and this website, https://spellgrove.com.

Who we are. Spellgrove is made by CoCreations Australia Pty Ltd (ABN 86 632 857 277), trading as CoCreations — a small company in Queensland, Australia. "We" in this policy means that company. Questions, requests and complaints go to hello@spellgrove.com.

The short version

• The game needs an account. An account is a display name, a way to sign in, and what your character has done in the world.
• We collect nothing we do not need to run the game. There are no advertisements, no advertising or analytics SDKs, no in-app purchases, and we never sell or share personal information for marketing.
• You can delete your account, and everything in it, from inside the game at any time. Parents can ask us to delete a child's account.
• The game is played with other people. Other players see your display name and your character. Nothing else about you is shown to anyone.

What we collect, and why

When you make an account

• A display name — the name other players see over your character. You choose it. It does not have to be your real name, and for a child we suggest it is not.
• An email address and a password, if your account was made with email. Email accounts are made on this website (https://spellgrove.com/play); the phone and tablet apps have no email sign-up and only sign in to an account that already exists. The password is stored only as a salted hash; we cannot read it. The email address is used to sign you in, to verify the address, and to reset the password — nothing else. Verification emails are sent for us by Resend (resend.com).
• A Google Play Games or Game Center player id, if you play in the Android or iOS app. The app signs in with the device's own Google Play Games or Game Center player — set up and, for a child, approved by a parent on the device — and never asks for an email address. We receive the player id and the display name the service gives us, and nothing else from your Google or Apple account.
• A character seed — a short code that describes how your character looks. In the apps it is chosen at random.
• Whether you have opted in to tag (the in-game game of chasey). Off for every new account; turned on only from the account page.

While you play

• Where your character is and what it holds — the Area it is in, its position, its health, the elements it has collected, the spells it has found, and the state of your home Area. This is the game; it is saved so you can pick up where you left off.
• Tag events — who tagged whom and when, if you play tag. Kept so the game can enforce its own rules (the twenty-second no-tag-back).
• Sessions — each device you sign in on gets its own session token, with an optional device label you may set, so you can see and sign out devices from the account page.
• Diagnostics reports — if the connection dies, or you tap Send diagnostics in the connection panel, the game sends us its last few connection log lines with the platform name (for example "Android/Pixel 7"), the build id, the Area id and the connection state. We keep the last few per account, to fix connection problems. They contain no message content and no location data.
• Your IP address is seen by our servers, as by any internet service. It is used to rate-limit sign-ups and sign-ins and to keep the service up. It is not stored against your account.

On this website

• The site is static and has no analytics. It sets no cookies. If you sign in to the Building the Game pages it keeps a sign-in token, and a few display preferences, in your browser's local storage — on your device, readable only by this site, and cleared with the Clear site settings link in the footer.

What we do not collect: precise location, contacts, photos, microphone, the contents of your device, advertising identifiers, or anything about you from other apps or sites.

Children

Spellgrove is made with and for children as much as adults — it began as a game designed with the maker's daughter — and it is written to need as little as possible from a player of any age: a display name, a way to sign in, and the state of the game. We do not knowingly collect more than that from anyone, and we do not show advertisements to anyone.

In the Android and iOS apps the account is the device's Google Play Games or Game Center player: the app signs in with it and asks for nothing — no email address, no age, no name beyond the one that service already shows. Those player accounts are set up on the device, and for a child are approved by a parent there. An account made with an email address can only be made on this website, which is where we expect a parent to be the one at the keyboard for a young child; an email account can then be signed into on a phone.

If you are a parent or guardian and your child has an account you did not agree to, or you want to see or delete what is held for it, email hello@spellgrove.com from the address on the account (or with enough detail for us to find it) and we will act on it. Deleting the account from inside the game works for a child's account too — see below.

Who else sees it

• Other players see your display name, your character and where it is in the world, and (if you play tag) whether you are it. That is the whole of what the game shows about you to anyone else.
• Service providers that host and run the game for us: DigitalOcean (the game servers and database) and Resend (email). They process data only to provide that service to us.
• Nobody else. We do not sell personal information, we do not share it for advertising or analytics, and we do not give it to anyone except as the law requires — a court order, or to protect players or the service from abuse.

How long we keep it

For as long as your account exists. Deleting your account removes it and everything in it (below). Server backups are kept for operational safety on a rolling basis; a deleted account can remain in a backup for up to 90 days before that backup is itself deleted. Diagnostics reports are kept only as the last few per account and go with the account.

Deleting your account

Inside the game: Account → Delete my account… (the account page is reached from the title screen, or from the main menu while playing). It asks once, then deletes the account, the character, your home Area, everything collected, every session and every diagnostics report — at once and for good. Nothing about it is recoverable afterwards.

Without the game, or for someone else's account you are responsible for: email hello@spellgrove.com with the display name and the sign-in email or the platform used, and we will delete it and confirm by reply. See https://spellgrove.com/support for the same instructions.

Your rights

Wherever you are, you can ask us what we hold about you, ask for it to be corrected, ask for it to be deleted, and complain to us about how we have handled it — at hello@spellgrove.com. We answer within 30 days.

We are an Australian company and handle personal information in line with the Australian Privacy Principles. If you are in the European Economic Area or the United Kingdom you also have the rights the GDPR and UK GDPR give you (access, rectification, erasure, restriction, portability and objection), and the right to complain to your local supervisory authority; our lawful basis for handling your data is performing the service you asked for (the game), and, for the diagnostics and the rate-limiting, our legitimate interest in keeping the game working and safe. If you are in California, the CCPA rights to know, delete and not be discriminated against apply; we do not sell or share personal information as the CCPA defines those terms.

Our servers are in DigitalOcean's data centres, which may be outside the country you play from.

Security

Connections between the game and our servers are encrypted (TLS). Passwords are salted and hashed. Session tokens can be revoked per device from the account page. Access to the servers is by key, held by the developer. No internet service can promise perfect security; if we learn of a breach affecting your data we will tell you and the relevant authorities as the law requires.

Changes

We will change this policy when the game changes what it needs — a new sign-in method, say. The date at the top moves when it does, and the current version is always at https://spellgrove.com/privacy. A change that materially reduces your privacy will be announced in the game before it takes effect.

Contact

CoCreations Australia Pty Ltd (ABN 86 632 857 277), trading as CoCreations — hello@spellgrove.com — https://cocreations.com.au/