Form SMSH-101 · Data Handling Disclosure

Privacy Policy

Effective 6 September 2026. Last updated 6 September 2026.

1. Who we are

S.M.A.S.H. Co. (the “game”) and smashco.net (the “site”) are operated by Seedling Systems LLC (“we”, “us”), a limited liability company registered in Hawaii, United States.

For anything in this policy — including a request to see, correct, export or delete your data — contact support@smashco.net, or use the support form. A human reads every message.

2. What this covers

This policy covers the game on every platform we ship it — in a browser, as a desktop download, and on Steam — and the smashco.net website, including the creator editors, the pack marketplace and the leaderboards.

3. What we collect

You can play the game without an account. Everything in the first table below exists only because you chose to create one.

3.1 Your account

What	Why
Email address	To identify your account, let you sign in, and reset your password.
Password	Stored only as a one-way hash. We cannot read it, and neither can anyone who obtains the database.
Display name	Shown on leaderboards and on packs you publish. Choose accordingly.
Steam ID, and when it was linked	Only if you link a Steam account, so your purchase and your progress line up.
Game access tokens	Stored as a hash plus a short prefix, with the time last used, so the game can stay signed in and you can revoke a device.

3.2 Playing the game

What	Why
Saved progress — credits, contracts completed, unlocks, settings	So the same franchise follows you between devices. Only synced if you are signed in.
Leaderboard entries — score, stars, time, the game version, a replay checksum	To rank runs and to detect impossible ones.
Scrip transactions	To track the in-game currency you earn. Scrip is not money — see the Terms.

3.3 Things you create

What	Why
Content packs, levels, prefabs and effects you build, plus their drafts, versions, titles, descriptions, cover images and tags	To store your work, let you edit it across sessions, and publish it if you choose to.
Marketplace listings, ratings, votes, and a record of packs you have used	To run the marketplace and to award scrip for content people actually play.

Drafts are private to you until you publish. What happens to content you publish — and what rights you keep — is covered in section 5 of the Terms of Service. You keep ownership.

3.4 Support requests and diagnostic reports

When you file a support request — from the site or from inside the game — we store the email address you give us, the type, subject and message, and a reference number.

The game can attach a diagnostic report. This is the single most useful thing you can send us when something breaks, so it is worth being precise about what is in it:

• the game version and build id;
• your browser or operating system identifier, and your graphics card and driver as the system reports them;
• the graphics quality preset in use and the measurements that chose it;
• frame timing measurements and a record of any stalls;
• which level or contract was loaded, and whether any assets failed to load;
• a short rolling log of recent game events, if you turned on extra diagnostics.

A diagnostic report never contains your email address, your password, your access token, or the contents of your saved game. You can inspect the exact report before sending it, and you can save it to a file instead of sending it at all. Nothing is transmitted unless you press send.

3.5 Optional performance reports

The game has a setting called Share performance data. It is off unless you turn it on, and it is separate from the diagnostics setting above. If you switch it on, the game sends one report at the end of a play session containing:

• the game version, and whether you are on the browser, desktop or Steam build;
• your graphics card, driver and operating system, and how many CPU threads you have;
• the graphics quality preset the game chose for you, and whether you overrode it;
• summary frame-timing numbers and a count of any stalls;
• how long the session lasted and which levels were loaded.

This report is tied to a random identifier generated on your device, not to your account. We do not attach your email, your user id, or any access token to it, and the system that stores these reports is deliberately built so it cannot be linked back to a person — there is no account column in it, and the endpoint rejects any report that tries to include one.

Why we ask: every performance setting in the game was tuned on a single computer. Without reports from real hardware we cannot tell whether the game runs well on yours, or state an honest minimum specification. Turning it off costs you nothing and we will not ask twice. You can turn it back off at any time in the same place.

3.6 Server logs and security

Like every website, our servers record requests: IP address, the page or endpoint requested, a timestamp, and the browser or client identifier. We use these to keep the service running and to detect abuse — account-stuffing, scraping, spam through the support form. They are not used to build a profile of you and they are not combined with your game activity for any purpose other than investigating a specific security or abuse incident.

3.7 Payments

If we sell anything directly, payments are handled by Stripe. Card numbers go to Stripe and never touch our servers. We keep a record of the transaction — what was bought, when, how much, and whether it succeeded — because we are required to. If you buy the game on Steam, Valve handles that transaction entirely and we receive only aggregate sales figures, not your payment details.

4. What we do not do

This section is a commitment, not a description of current practice that might quietly change:

• We do not sell, rent, or trade your personal data.
• We do not use it for advertising or marketing, ours or anyone else’s.
• We do not embed third-party advertising or analytics trackers in the game or the site.
• We do not collect anything in the background that you have not switched on. The one setting that sends data automatically is the performance report in 3.5, it ships off, it carries no account identifier, and it is the only one. If we ever add another, it will work the same way and this policy will be updated before it ships, not after.
• We do not read your saved games or your private drafts except where you have specifically asked us to look at one to resolve a support request.

5. Why we are allowed to hold it

If you are in the UK, the EU, or anywhere else with similar law, these are our lawful bases:

Data	Basis
Account, saves, published content, marketplace, leaderboards	Performance of a contract — we cannot provide the service you asked for without them.
Server logs, abuse and cheat detection	Legitimate interests — keeping the service available and honest.
Support requests and any diagnostic report you attach	Legitimate interests, and your own act of sending it.
Optional performance reports (3.5)	Consent — off by default, revocable at any time, and nothing is withheld from you if you decline.
Payment records	Legal obligation — tax and accounting.

6. Cookies and local storage

The site sets a session cookie so you can stay signed in, and a CSRF cookie that stops other sites submitting forms as you. Both are strictly necessary and neither tracks you across other websites.

The game stores things in your browser’s local storage — your graphics and audio settings, key bindings, the diagnostics toggle, and in the browser build your saved progress. That data stays on your device. It is not a cookie, we cannot read it from our servers, and clearing your browser data deletes it.

There are no advertising or cross-site tracking cookies anywhere on this site or in the game.

7. Who else sees it

Only these, and only for the stated reason:

• Our hosting provider, which stores the database and files that run the service.
• Stripe, if you pay us directly, for that payment.
• Valve, if you play through Steam, for the things Steam does — ownership, achievements, and your Steam identity if you link it.
• Anyone you publish to. A pack you publish, its title and description, and your display name are public by design.
• Law enforcement or a court, where we are legally required to. If we are permitted to tell you, we will.

We do not use third-party marketing, advertising, profiling or data-broker services at all.

8. How long we keep it

What	Kept for
Account, saves, drafts	Until you delete your account, then removed within 30 days.
Published packs	See section 10 — deleting your account unpublishes them, with one narrow exception.
Support requests and attached diagnostics	24 months, then deleted. Ask us and we will delete yours sooner.
Optional performance reports	24 months. They carry no account identifier, so we cannot delete “yours” on request — turning the setting off stops any more being sent.
Server logs	90 days, unless one is part of an open security investigation.
Payment records	7 years, because tax law requires it. This survives account deletion.

9. Your rights

Wherever you live, you can ask us to:

• Show you what we hold about you.
• Correct anything wrong.
• Delete your account and the data attached to it.
• Export your data in a portable format, including your saves and everything you have created.
• Object to or restrict a particular use.
• Withdraw consent for anything you opted into, without losing access to anything you did not opt into.

Email support@smashco.net. We will respond within 30 days. We will not charge you, and we will not make the service worse for you because you asked.

California residents: we do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we have not done so in the preceding twelve months. You have the same access, deletion and correction rights listed above, and we will not discriminate against you for exercising them.

UK/EU residents: you also have the right to lodge a complaint with your data protection authority. We would rather you told us first so we can fix it.

10. Deleting your account

You can ask us to delete your account at any time. When you do, we remove your email, display name, saves, private drafts, tokens and leaderboard entries within 30 days.

The one exception: copies of a pack you published that other players have already downloaded remain on their devices, and any pack that has been incorporated into official game content stays in the game. We cannot reach into someone else’s installation. We will remove your name from the public listing on request. This is explained again in the Terms, because it is the part people are most often surprised by.

11. Children

The game is not directed at children under 13, and you must be at least 13 to create an account. We do not knowingly collect personal information from anyone under 13. If you believe a child has given us their information, email support@smashco.net and we will delete it.

12. Where your data lives

Our servers are in the United States. If you are outside the US, using the service means your data is transferred there. Where the law requires a transfer mechanism for that, we rely on the European Commission’s Standard Contractual Clauses.

13. Security

Passwords are hashed, access tokens are stored hashed, traffic is encrypted in transit, and access to the production database is limited to the people who operate the service. No system is perfect. If we ever suffer a breach affecting your data, we will tell you and the relevant authority without undue delay, and we will tell you what actually happened.

14. Changes to this policy

If we change this policy we will update the date at the top. If the change is significant — particularly anything that would widen what we collect or what we do with it — we will say so on the site and in the game before it takes effect, not after.

---

Questions about any of this: support@smashco.net. See also the Terms of Service, which includes the game licence.