Privacy at Fern Fossil Valley: Field Notes on Your Data (PIPEDA)

Who keeps the notes (data controller)

The controller for personal data processed through fernfossilvalley.com is the operator of fernfossilvalley.com. Contact: hello@fernfossilvalley.com.

What sits inside a field journal

Journal entry	Why the note exists	How long the note stays
Nickname	The name the valley calls you	Held until the journal is deleted
Email address	Telling your journal apart so you can log back in	Held until the journal is deleted
Password hash	Checking your log-in without us ever keeping the password itself	Held until the journal is deleted
Sign-up date	Support replies and abuse checks at the dig hut	Held until the journal is deleted

That list is complete. Nubbin’s journal has no line for your real name, home address, date of birth or phone number, and none for payment details, since the valley has nothing to sell. The password goes in only as a one-way hash. Lawful basis: performance of a contract, meaning we run the account you asked us for. Delete the account and every entry goes with it immediately; the button is on your account page.

Kept in this browser, not with us

Journal entry	Why the tray holds it	How long the note stays
Satchel balance, level, missions and game settings	Picking up the dig where you left it	Until this browser’s data is wiped clean
Age confirmation	Not asking you again at every corner	Until this browser’s data is wiped clean
Cookie choice	Recalling the cookie choice you made	Until this browser’s data is wiped clean

These entries never leave your device and are never sent to us.

Google tags, set only when you tick yes in the fern banner

Tap “Accept all” and Google Analytics and Google Ads tags start counting: how many people visit, and whether an advert ended in play, such as a first spin. For that, Google is sent your IP address, details of your device and those events. Tap “Essential only” instead and the same tags work in consent mode, setting no cookies and using no advertising identifiers. Lawful basis: consent.

Request logs at the valley host

Our host holds the ordinary request logs for a short time to keep the site secure. Lawful basis: legitimate interests.

Things the dig team never does

Never any payment data, because the valley sells nothing.
No marketing email lands in your inbox unless you request it.
Not one entry of your data is sold or rented to anybody.
No data goes to gambling operators, and not one gambling affiliate link is buried in the valley.

Your rights over the notes

Your data stays yours to manage. Ask to see it, fix it, erase it, limit it or object to how it is processed, and take back consent whenever you like. The Delete button on the account page wipes the account data on the spot, and clearing this site’s data from your browser takes the rest. If you want to complain, write to the Office of the Privacy Commissioner of Canada at priv.gc.ca.

Privacy, in plain field notes