Privacy
Panic Buy is made by VLTA LTD (company number 16561041), 19 Wildern Court, Southampton SO30 4DT ("VLTA", "we", "us"). We are the controller of the personal data described here. This page explains what we collect, why, who sees it and what you can do about it, in plain English.
What we collect
If you play as a guest: the name you type, and what you do in the game room (bids, squad, chat phrases). This lives in the game server's memory while the room exists and is deleted when the room closes (rooms close after at most a few hours of inactivity). Your name is also saved in your own browser so you don't have to retype it.
If you make an account (18+ only):
- Your username, your email address and a one-way hash of your password (we cannot read your password). The email is used to confirm your account, to let you reset a forgotten password, and to tell you if your password or email is changed. It is never shown to other players.
- Whether you ticked the optional box to get Panic Buy news emails, and when. If you didn't, we never send you marketing.
- When you confirmed you are 18 or over.
- Your rating, rank, results history, XP and level, badges, streaks, challenge progress, daily board scores, favourite Kev look and past seasons.
- Your mates: the accounts you've added, requests sent and received, people you've blocked and whether you appear offline.
- Your rivalries and Pint Tab: when you play a game while signed in, we keep running totals against the other signed-in players in it (who beat whom to players, snipes, vetoes), and the pints owed between mates. The Pint Tab is a joke IOU; no money is handled. These are deleted with your account and included in your data download.
- Login sessions, stored as hashes, for up to five devices.
Emails we send: a link to confirm your email, a link to reset your password if you ask for one, and a notice if your password or email changes. These are sent for us by Resend, an email delivery service. If you ticked the news box you may also get the odd Panic Buy update, with an unsubscribe link in every one.
Counting visits (no tracking): we count things like "games started today" and "pages opened today" as plain numbers per day. Nothing in those counts identifies you: no cookies, no IP addresses, no device ids. We also record error messages (for example "this button crashed") so we can fix bugs, without anything about who you are.
Technical data: your IP address is used to limit abuse (for example too many new games or login attempts) and is kept only briefly in the server's memory. Our hosting provider keeps standard server logs. We don't build advertising profiles of you.
Purchases: you buy on vlta.co.uk, which is run on Shopify. Shopify handles your payment and order details under its own privacy policy; we never see your card number. To unlock what you bought we check your receipt code (or the email and order number you type) against the order in Shopify. We store a signed unlock token in your browser so the purchase stays unlocked on that device.
Ads: free games show ads on phones in waiting moments. Ads are provided by Google AdSense and only load if you say yes in the cookie banner. See Cookies and ads.
Why we use it, and our legal basis
| What we do | Legal basis (UK GDPR) |
|---|---|
| Run your account, ranked games, leaderboards, mates and unlock purchases | Contract: it's the service you asked for |
| Send confirmation, password reset and security emails | Contract: you can't use an account without them |
| Send Panic Buy news emails (only if you ticked the box) | Consent (untick it in your account, or use the unsubscribe link, any time) |
| Count visits and record errors to fix bugs and improve the game | Legitimate interests (no personal data is stored) |
| Stop cheating, abuse, spam and attacks; keep the service running | Legitimate interests |
| Show Google ads and use ad cookies | Consent (you can change your mind any time) |
| Keep records of sales and tax | Legal obligation (Shopify holds these) |
Who sees your data
- Other players: your username, rank, level, avatar and public stats are visible on leaderboards and your public profile page (
/u/yourname). Your mates can see when you're online unless you switch on "Appear offline". Nobody sees your password, sessions or block list. - Render hosts the game (servers in Frankfurt, Germany) and stores account data on a managed disk.
- Resend delivers our account emails, so it sees your email address and the message.
- Shopify runs our shop and payments.
- Google provides ads, only with your consent.
Some of these providers are based outside the UK. Where data is transferred, they rely on approved safeguards such as the UK addendum to standard contractual clauses or an adequacy decision. We do not sell your data.
How long we keep it
Account data is kept until you delete your account. Guest game data is deleted when the room closes. Server logs are kept by our host for a short period. Order records are kept by Shopify for as long as the law requires.
Your rights
You have the right to access, correct, delete and move your data, to object to how we use it and to withdraw consent. Most of this you can do yourself:
- Download your data: Profile, then Account, then "Download my data".
- Delete your account: Profile, then Account, then "Delete my account". This removes your profile, results, daily scores and mate links straight away.
- Anything else: email info@vlta.co.uk.
If you're unhappy with how we handle your data you can complain to the Information Commissioner's Office at ico.org.uk, though we'd appreciate the chance to fix it first.
Age
Panic Buy is aimed at adults. Accounts, ranked games and mates are 18+ and you confirm that when you sign up. We don't knowingly collect data from under-18s. If you think a child has made an account, email us and we will delete it.
Security
Passwords are hashed with scrypt, repeated wrong passwords lock an account for a short while, reset and confirmation links are random, expire and work once, and connections use HTTPS. No system is perfectly secure, so please use a password you don't use anywhere else.
Changes and contact
If we change this page in a way that matters we'll update the date above and, for big changes, tell you in the game. Questions: info@vlta.co.uk or write to VLTA LTD (company number 16561041), 19 Wildern Court, Southampton SO30 4DT.