Sylvan Tactics - Digital Edition - Privacy Policy

Last Updated: 11-10-2026

This policy explains what information Sylvan Tactics collects, why, and the choices you have. The short version: we only collect gameplay stats if you say yes, those stats are linked to a coded ID rather than your name, and you can turn them off or delete them at any time from Settings → Privacy, on Steam and on the web.

1. Who we are

Sylvan Tactics is developed and published by Random Seed Games ("we", "us"). We are responsible for the information described in this policy (the "controller" under data protection law).

2. What this policy covers

This policy applies to the desktop versions of Sylvan Tactics distributed through Steam:

  • Sylvan Tactics (Steam App ID 4254510)

  • Sylvan Tactics Playtest (Steam App ID 4367960)

  • Sylvan Tactics Demo (Steam App ID 4902820)

and to the web version at https://learn.sylvantactics.com, which you play in a browser without an account.

It does not cover Steam itself. Valve's handling of your Steam account is governed by the Steam Privacy Policy.

3. At a glance

  • Gameplay stats: optional. Collected only after you choose "Share Stats". Used to balance and improve the game.

  • Linked to: on Steam, a coded ID derived from your Steam ID, never your Steam name or the Steam ID itself. On the web, a coded ID derived from a random ID kept in your browser.

  • Never collected: chat, voice, your name, email, payment details, contacts, hardware fingerprints, or your IP address.

  • Kept for: the coded ID is removed after 12 months; the stats then remain only as anonymous totals.

  • Your controls: turn sharing on or off, or delete your stats, in Settings → Privacy.

  • Unreleased content: the full game and the Playtest app check with our server whether your account may try unreleased content. Nothing about the check is stored. Playtesters who sign up are kept on a list by Steam ID (section 6).

  • Sold or used for ads: never.

4. Gameplay stats (optional)

4.1 You choose

The first time you launch the game, it asks whether you want to share gameplay stats. On the web, it asks the first time you open the game on a screen large enough to play; on smaller screens only the menu, card gallery and credits open, and they collect nothing. Nothing is collected or sent until you answer, and nothing at all if you choose "Don't Share". The game plays exactly the same either way.

You can change your answer at any time in Settings → Privacy → Share Gameplay Stats. Turning it off stops collection immediately and discards anything recorded but not yet sent.

Your choice applies to the Steam app you made it in, so the demo and the full game each ask separately. On the web it applies to the browser you made it in. If we change this policy in a way that affects what we collect, the game will ask you again.

4.2 What we collect

If you choose to share, the game sends the following:

Match summaries, at the end of online matches you host and matches against the CPU, including Conquest battles:

  • Match details: game mode, how the match ended, winner, duration, number of turns and actions, when it started and ended, whether it was against the CPU (and at what difficulty), and for a Conquest battle, which battle it was, its layout, the Act, and which campaign it belongs to.

  • Player stats, for both sides of the match: King and Queen health, moves, attacks, abilities and cards played, Sigils gained and spent, damage dealt and taken, promotions, and cards drawn.

  • Card and piece stats: which cards were drafted, drawn, played, discarded or attached, how they performed, and how each piece type was used.

  • Draft picks, in draft mode: the cards offered, the card picked, and how long the pick took.

In an online match, the summary includes your opponent's gameplay stats for that match so we can see how the match played out, but it carries no identifier for your opponent. Only the player who sends the summary is linked to it.

Conquest progress, each time your campaign changes (for example when you move on the map, win or leave a battle, take a reward, or buy something): the state of the campaign at that moment. That includes the map and the route you took, the battles you fought and how they went, the rewards you were offered and the ones you chose, shop stock and purchases, your deck and its upgrades, your King's Health, Coins and Pawns, and the CPU difficulty. Conquest stats are only collected when Conquest is available to you.

Progress events, as they happen:

  • Tutorial: which lessons you start, finish or leave, how far you got, and how long each step took.

  • First launch: whether you chose to start the tutorial.

  • Matchmaking: when you join or leave the queue, how long you waited, and when a match was found.

  • Rated matches (full game only): the result and the change to your hidden matchmaking rating.

Every submission also includes the game version, which Steam app or the web version sent it, and whether developer tools were turned on.

4.3 The coded ID

To connect your matches to each other (for example, to see how players improve over time or where the tutorial loses people), we store a coded ID made with a secret key (a keyed HMAC-SHA256 hash).

  • On Steam, the coded ID is made from your Steam ID. We do not store your Steam ID itself with your gameplay stats, and we do not store your Steam name. The only place we keep Steam IDs themselves is the playtester list described in section 6, which is never linked to gameplay stats. Because we hold the key, we can recreate your coded ID if we are given your Steam ID. That is how we find your stats when you ask us to delete them.

  • On the web, when you choose "Share Stats", the game creates a random ID and keeps it in your browser's storage. It is sent with your stats, and we store a coded ID made from it, not the random ID itself. It is not linked to your Steam account or anything else about you. The browser keeps the random ID if you later turn sharing off, so that Delete My Data can still find your stats; deleting your stats removes it, and sharing again starts a new one. If you clear your browser's data, the link between you and the stats sent from that browser is gone, and we can no longer find them for you.

Either way, your stats count as personal data under laws like the GDPR, and this policy treats them that way.

After 12 months, we remove the coded ID from your stats. From then on they are anonymous: they can no longer be linked to you by anyone, including us.

4.4 What we never collect

  • Chat or voice communications

  • Your name, email address, phone number or postal address

  • Payment information

  • Your Steam friends list or profile

  • Hardware identifiers or device fingerprints

  • Your IP address. Our hosting provider necessarily sees it to deliver each request, but we do not store it.

5. Information handled by Steam and other services

Some features run through Steam and are handled by Valve, not stored by us:

  • Verifying uploads. When the desktop game sends gameplay stats, it includes a one-time Steam login ticket. Our server asks Steam to confirm the ticket, which tells us it came from a genuine copy of the game and lets us create your coded ID. We do not keep the ticket.

  • Online play. Lobbies, invites and connections between players use Steam's networking, which relays traffic between players. Your Steam name is shown to your opponent. The game shows your Steam friends list on your own screen so you can invite friends; it is not sent to us.

  • Matchmaking rating (full game only). Your hidden matchmaking rating, and your count of rated wins, losses and games played, are stored as Steam stats on your Steam account so matchmaking can pair you with players of similar skill. This is part of the matchmaking you choose to use, so it does not depend on the gameplay stats setting.

  • Achievements and Steam Cloud. Achievements, and some settings and tutorial progress, are saved to your Steam account so they follow you between computers.

The web version uses these services, which receive your IP address in order to work. We receive nothing from them:

  • Hosting. The web version's pages are served by GitHub Pages, under the GitHub Privacy Statement.

  • Online play. When you host or join an online match in the web version, the game connects to the other player through the PeerJS signaling server and public connection servers (Google STUN servers and the Open Relay TURN service), which see both players' IP addresses to make the connection and may relay match traffic.

6. Access to unreleased content

Before we release new content, such as a new game mode or card expansion, we let a small group of playtesters try it.

The access check. When you start the full game or the Playtest app, the game sends our server a one-time Steam login ticket, along with the game version and which Steam app sent it. Our server asks Steam to confirm the ticket, which tells us your Steam ID, and looks up that Steam ID in our playtester list. It replies with the unreleased content your account may use, if any. The check runs whether or not you share gameplay stats, because it decides what the game shows you. We do not store the ticket, your Steam ID or the result of the check. The demo does not make this check.

The playtester list. If you sign up as a playtester, we add your Steam ID to the list, together with the content you may try and a short note for our own reference (for example, how we know you). The list is never linked to your gameplay stats. You stay on it until you ask us to remove you or we no longer need it for testing. Deleting your stats in Settings does not remove you from the list; email us instead (section 12).

7. Information stored on your computer

The game saves your settings, tutorial progress, Conquest campaign and your answer to the gameplay stats question on your computer (on the web, in your browser's storage). If you have agreed to share stats, it also holds stats that have not been sent yet (for example, while you are offline) until they are sent; choosing "Don't Share" or turning sharing off clears them. On the web, it also keeps the random ID described in section 4.3.

8. Why we use it, and our legal basis

Gameplay stats (section 4). We use them to balance cards and strategies, find where players get stuck, and improve the tutorial and matchmaking. Legal basis under the GDPR and UK GDPR: your consent (Art. 6(1)(a)), which you can withdraw at any time.

Steam ticket check (section 5), and the checks on web uploads (section 14). We use them to accept stats only from genuine copies of the game and to keep junk data out. Legal basis: our legitimate interest in keeping the stats accurate and free of abuse (Art. 6(1)(f)).

Matchmaking rating (section 5). We use it to provide the matchmaking you choose to use. Legal basis: providing the service you requested (Art. 6(1)(b)).

Access check (section 6). We use it to show unreleased content only to the playtesters it is meant for. Legal basis: our legitimate interest in testing content before release without making it public (Art. 6(1)(f)).

Playtester list (section 6). We use it to give you the playtest access you signed up for. Legal basis: providing the service you requested (Art. 6(1)(b)).

We do not use your information for advertising or marketing, we do not sell or rent it, and we do not use it to make automated decisions about you.

9. How long we keep it

  • Raw copies of match summaries (used to fix processing errors): 30 days, then deleted.

  • Gameplay stats with your coded ID: 12 months, then the coded ID is removed.

  • Anonymous stats (after the coded ID is removed): as long as they are useful for balancing the game.

  • Stats you ask us to delete: deleted immediately.

  • The access check: not kept.

  • Playtester list entries: until you ask us to remove you or we no longer need them for testing.

10. Who we share it with

We do not sell, rent or trade your information. We use these service providers:

  • Cloudflare, Inc. hosts the server that receives gameplay stats and answers the access check, and the database that stores the stats and the playtester list. Cloudflare processes the data only on our instructions, under its Data Processing Addendum. See also Cloudflare's Privacy Policy.

  • Valve Corporation (Steam) verifies Steam login tickets and provides the Steam features described in section 5, under the Steam Privacy Policy.

  • The web version's hosting and online-play services (section 5) receive your IP address to serve the game and connect online matches. We do not share gameplay stats with them.

We may also disclose information if the law requires it.

11. International transfers

Cloudflare operates a global network, so gameplay stats and the playtester list may be processed in countries other than yours, including the United States. Where data from the EU, EEA, UK or Switzerland is transferred to a country without an adequacy decision, the transfer is protected by the Standard Contractual Clauses included in Cloudflare's Data Processing Addendum.

12. Your rights and choices

In the game, at any time:

  • Stop sharing: Settings → Privacy → Share Gameplay Stats → Off. Withdrawing consent does not affect stats already sent while it was on; delete those separately if you want them gone.

  • Delete your stats: Settings → Privacy → Delete My Data. On Steam, this permanently deletes the stats stored under your coded ID, from every Sylvan Tactics app. On the web, it deletes the stats sent from that browser. Stats older than 12 months are already anonymous and cannot be found or deleted, because they are no longer linked to you.

By email (support@randomseedgames.com), you can ask us to:

  • give you a copy of the stats stored under your coded ID

  • correct, delete or restrict the use of your information

  • remove you from the playtester list

  • answer any question about this policy

Include your Steam profile link so we can find your stats. Because Steam IDs are public, we will ask you to confirm that the account is yours before we send you any data. Stats from the web version are linked only to the random ID in your browser, so we cannot find them from an email request; use Delete My Data in that browser. We reply within one month.

Depending on where you live, you may have further rights, including data portability and the right to object. You can also complain to a data protection authority, for example the one in the country where you live. We would appreciate the chance to address your concern first.

13. Children

Steam accounts are for people aged 13 and over, and Sylvan Tactics is not directed at children. The web version needs no account; children under 13 should choose "Don't Share". Some countries set a higher age, up to 16, for agreeing to data collection yourself. If that applies to you, please ask a parent or guardian before choosing "Share Stats". Parents or guardians who believe their child has shared stats can delete them in Settings → Privacy or contact us.

14. Security

Gameplay stats are sent over encrypted connections (HTTPS). From the desktop game they are accepted only with a valid Steam ticket. From the web version, which has no account to verify, they are accepted only from the game's own website and only at a limited rate per browser ID; this limit uses the browser ID, never your IP address. They are stored in Cloudflare's database, which is encrypted at rest. The playtester list is stored in the same database. Access to the stored data is restricted to the developer.

15. Changes to this policy

When we update this policy we will change the "Last Updated" date above. If a change affects what we collect or how we use it, we will announce it on Steam and the game will ask for your permission again before collecting anything under the new terms.

16. Contact

Random Seed Games — support@randomseedgames.com
Steam: https://store.steampowered.com/app/4254510/Sylvan_Tactics/