Privacy

Last updated: 2026-10-03

Heightmap Games is a small game studio in Norway. This page explains what personal data heightmapgames.com collects, why, and what you can do about it. The short version: the site sets no cookies, runs no analytics, runs no scripts and loads nothing from other companies. If you join the waitlist, we keep your email address until you leave it.

Who is responsible

The data controller is Heightmap Games, Norway. Email: contact@heightmapgames.com.

Visiting the site

No cookies, and nothing else is stored in your browser.
No analytics, ads or tracking pixels.
Fonts and images come from our own server; your browser never contacts Google or anyone else.
Our web server keeps standard logs: IP address, time, page requested, browser type and referring page. We use them to run and secure the site, which is our legitimate interest (GDPR Art. 6(1)(f)), and they are rotated away within 11 weeks.

The waitlist

If you sign up, we store:

your email address;
when you signed up and when you confirmed, and which version of the sign-up wording you agreed to (our record of your consent);
a random code for the unsubscribe link, and a hashed copy of the code in your latest confirmation link (kept so an old link can tell you that you are already on the list);
which of our mailings were sent to you.

Why: to email you alpha invites and devlog updates about Orebound, a few times a year. Nothing else. We don't build profiles, make automated decisions about you, or sell or share the list.

Lawful basis: your consent (Art. 6(1)(a)). We send a mail asking you to confirm, and nothing else unless you do. If the address is typed in again, we send at most three confirmation mails to it in 30 days. You can withdraw consent at any time with the unsubscribe link in every mail, or by writing to us. Withdrawing doesn't affect mail already sent.

Signing up is voluntary, and nothing happens if you don't. The waitlist is for people aged 13 and over.

Abuse protection: so the form can't be used to flood someone's inbox, we count sign-ups per IP address for one hour, in memory only (the address is never written down), and we keep a keyed hash (a scrambled form) of each address we sent a confirmation mail to for 30 days. Both are used only for rate limits: our legitimate interest in protecting the form and other people's inboxes (Art. 6(1)(f)). Our server's own log notes each confirmation mail by a short reference taken from that hash, never by your address.

Proof of consent: when you unsubscribe, your address is deleted. We keep a keyed hash of it with the dates you signed up, confirmed and left, and the version of the wording you agreed to, for 3 years, so that we can show the consent behind mail we sent if it is ever questioned (Art. 6(1)(f), Art. 17(3)(e)). If you ask us to erase your data instead, we keep no such record.

So a backup can't undo it: each unsubscribe and erasure is also noted, as a keyed hash of the address, in a separate list kept for 45 days, longer than our backups. If we ever restore a backup, we use that list to delete the address again (Art. 6(1)(c) and (f)).

How long we keep it

Unconfirmed sign-ups: 7 days.
Confirmed sign-ups: until you unsubscribe or ask us to delete them. Unsubscribing deletes your address straight away; it isn't just flagged.
Rate-limit counts: one hour (IP addresses) and 30 days (hashed addresses).
Proof of consent after you unsubscribe: 3 years.
Withdrawal notes (so a restored backup can't bring an address back): 45 days.
Web server logs: up to 11 weeks.
Backups: deleted data can linger in a backup for up to 14 days.

Who else handles your data

The site and its database run on our own server in Norway.

We send email through Resend (Plus Five Five, Inc., USA), our processor under a data processing agreement. Resend receives your email address and each mail we send you, stores this data in the United States and keeps sent mail and delivery logs for 30 days. Open and click tracking is switched off.

The transfer to the US is covered by Resend's certification under the EU-U.S. Data Privacy Framework, which the European Commission has found to give adequate protection and which also applies in Norway. Resend's agreement also includes the EU Standard Contractual Clauses, which apply regardless: resend.com/legal/dpa.

If you email us

If you write to contact@heightmapgames.com, we use your address and message to answer you (legitimate interests, Art. 6(1)(f)). Our email provider stores the conversation for us, and we delete it when it's no longer needed, at the latest 12 months after the last message.

Your rights

You can ask us for access to your data, to correct it, to delete it, to restrict its use, or for a copy in a portable format. You can also object to anything we do on the basis of legitimate interests. Write to contact@heightmapgames.com, preferably from the address concerned; we answer within one month.

If you think we handle your data wrongly, you can complain to Datatilsynet, the Norwegian Data Protection Authority (datatilsynet.no), or to the authority where you live.

Orebound accounts

The game at orebound.app has its own sign-in accounts. They are covered separately by the game, not by this page.

Changes

When this page changes, we update the date at the top. If a change affects how we use waitlist addresses, we'll email the waitlist first.