Legal · Privacy

Privacy Policy

Version 2026-09-30

This policy explains what personal data moonrockduckets.com and the Moon Rock Duckets beta collect, why, how long it is kept and what you can do about it. It covers the website, the Beta Key claim form, the game’s key checks, playing with other people and in-game feedback, and it describes only what those systems actually do.

1. Who is responsible

The controller responsible for your personal data is the developer of Moon Rock Duckets (“we”, “us”). Contact: Support@MoonRockDuckets.com.

2. What we collect and why

2.1 When you claim a Beta Key

The claim form sends, and we store:

• your name, as you typed it without surrounding spaces, and your email address, stored trimmed and in lower case so the same address is recognized however it’s typed;
• that you confirmed you are at least 16, and the versions of the Beta Terms and this Privacy Policy you accepted and read;
• whether you chose to receive development updates and future-game news, the time you gave that consent, the time you withdrew it if you unsubscribe, and that it was given through the beta claim form;
• when you claimed, and the license identifier of each key issued to you.

Why we ask: your email address identifies your registration, so each address gets one 30-day beta window, and lets us act on requests about your data. Your name tells us who a registration belongs to when you contact us about it, and is used to address update emails if you ask for them. Your name and email address are required to claim a Beta Key: without them we can’t issue one. The updates box is optional.

We don’t store your IP address, your browser details or your Beta Key with this information. To stop abuse, the claim service limits how many claims can come from one network address (and, for IPv6, from one block of addresses): it counts recent attempts in the server’s memory, using a keyed hash of your address instead of the address itself. That count is never written to disk and is only kept for about an hour, or until the service restarts. We also limit how many keys one email address can claim in a day, using the claim times stored with your registration.

Before issuing a key, we email an eight-digit code to the address you entered. Entering that code on the same claim page proves mailbox access and confirms the choices you made there. Until then, we do not issue a key, create a player profile or change an existing registration’s update preference. Codes expire after 10 minutes, allow at most five attempts and work once. Our database keeps a keyed hash of the code, not the code itself; the delivery service necessarily handles the email containing it. Temporary request records also include the submitted details, document versions, request time, expiry, attempt count and delivery state. An opaque address hash limits repeated verification emails without keeping the address in that counter.

Your key is shown once on the claim page. We don’t email keys. To recover access, verify the same address again: we issue another key with the same end date, and your earlier keys keep working. We keep the name from your first completed claim. The updates box in your latest verified claim replaces your earlier choice; leaving it unticked withdraws an earlier opt-in. Simply typing someone’s address cannot complete a claim or change their preference.

Verified player profiles and retained rewards

After verification, we keep a separate player profile with a random account identifier, your verified email address, and when the profile was created and the address last verified. We link keys issued through that verification to the profile. Successfully activating one records the Beta Tester reward and the time it was earned. We use this record to recognize returning players in future releases. This is separate from promotional subscriptions: unsubscribing does not erase earned rewards. This beta does not yet display the planned badge beside your name. Your display name is chosen and saved in the game; we do not send your email address or rewards account identifier to other players.

2.2 Each time the game starts, and when you join a match

The game checks your key online at every launch, when you request Online Quick Match or rejoin an online room, and again when you join a match hosted by another player. It sends your Beta Key and a random one-time number (so the reply can’t be reused) to our license server over HTTPS, and the server returns a signed answer. The license server stores a random license identifier, a keyed hash of your key (not the key itself), and when the key was issued, first activated, expires or was revoked. Verified claims link that identifier to the player profile described above. The license database does not store the one-time number, your IP address, or any hardware or device identifier. The game keeps your key on your PC so it can check it each time it starts. For Online Quick Match, our matchmaking service supplies a fresh one-time number and receives the signed answer confirming your beta access. Joining another player's game also uses a separate challenge from that host. Your game passes the resulting signed answer to the host. These answers contain your license identifier and access expiry, not your Beta Key or email address. Section 2.6 and "Playing with others" in section 5 explain these connections.

2.3 In-game feedback

Only when you choose to send a report, the game sends the category, title and text you typed, the game’s build version, world and mode, and a random report identifier. We store that with the time it was received. No account, contact details, screenshots, log files or device identifiers are attached. If spam protection is switched on for the feedback service, it keeps a keyed hash of your network address for a limited time to limit repeated reports. Please don’t put personal information in your reports.

2.4 Website and server logs

When you visit moonrockduckets.com, the web server on our hosting keeps standard access logs: your IP address, the date and time, the page requested, the result and your browser’s user-agent. Requests to the Beta Key service (the claim form, the game’s key checks and unsubscribe links) and in-game feedback service are configured to be logged in a reduced form, with the date and time, the address requested without any query, the result, the response size and the time taken, and without your IP address. Matchmaking relay connection requests also use reduced request logs containing the time, path without its query, result, response size and duration, without your IP address. The match service does not log signed access proofs or game packet contents. Server error logs can include IP addresses. None of these logs include what you type into the claim form, your Beta Key or your feedback text. We use these logs only to keep the services secure and working. The server is configured for daily rotation with 30 archived log files. For active logs this is approximately 30 days; quiet logs can remain longer until they rotate. This is a rotation policy, not a guaranteed deletion deadline for each log entry.

2.5 Development updates and future-game news by email

If you tick the optional box and complete the emailed-code verification, we use your name and email address to send development updates about Moon Rock Duckets and news about future games in the series. Every update email will include an unsubscribe link and our postal address; using the link stops future promotional emails and records when you withdrew. You can also unsubscribe by emailing Support@MoonRockDuckets.com. You get a Beta Key whether or not you tick the box. Verification and important service notices are separate from promotional updates.

2.6 Online Quick Match

If you choose Online Quick Match or rejoin an online room, your game connects to our matchmaking and relay service using an encrypted TLS connection. It sends a signed proof of beta access, including your license identifier, its expiry and a one-time challenge; the game's build identifier; your selected world and mode; and the room identifier when rejoining. We use these details to confirm access, find a compatible room, reserve a place and carry game traffic between players. The relay does not receive your Beta Key, email address or rewards account identifier.

The relay processes temporary room and participant identifiers, readiness and connection information, and game packets. Those packets can include your chosen display name, the game's underlying network identifier, gameplay and signed host-admission answers. Our infrastructure can see the IP address of each connection. TLS protects traffic between your PC and our service, but the relay can process its readable contents; it is not end-to-end encryption between players. We do not record game-packet contents or create a database of online room history. Temporary state and packet buffers are held in memory as needed for the connection and removed as packets are processed or connections and rooms close. Request and error logs are described in section 2.4.

Online Quick Match is optional. Local-network discovery, direct-IP joining and solo play remain separate choices. The new relay does not change the verified-email profile or retained rewards described above.

3. Our legal bases

Where laws such as the UK and EU General Data Protection Regulation apply, we rely on:

• Contract: to issue your Beta Key, check it when the game starts and provide the beta you asked for;
• Legitimate interests: to keep the website, servers and beta secure, prevent abuse through rate limits and logs, and use feedback to fix and improve the game;
• Consent: to send development update emails. You can withdraw consent at any time; this doesn’t affect anything done before you withdrew;
• Legal obligation: where the law requires us to keep or disclose information.

4. Cookies and tracking

Analytics notice, effective September 30, 2026: we use self-hosted Umami at milo3d.ai/umami to measure visits to our public homepage, beta download page and updates page, and clicks on the beta download button. A click records interest in downloading; it does not tell us whether a download completed.

Analytics is limited to page views for /, /beta/ and /updates/, and beta download-button clicks. It receives the allowed page path and, when present, only the referring website’s hostname. It does not receive query strings, hash fragments, form contents, names, email addresses, Beta Keys or user identifiers. Claim, account, admin and API routes are excluded.

The service processes browser, device and language information and calculates approximate location and visit/session counts on the server. The request’s IP address is processed transiently for these calculations; it is not stored as an IP address in the analytics database. This is separate from web-server access and error logs, described in section 2.4. We do not use session replay or record what you type.

These pages and the analytics do not set cookies. We do not use advertising trackers or track you across other websites. If your browser sends Do Not Track or Global Privacy Control, we do not load the analytics tracker. The claim form does not save what you type, or your key, in your browser’s storage.

We keep analytics records while needed to understand use of these public pages and download interest, and periodically review whether they are still needed. Automatic deletion of analytics records is not currently configured. The separate server-log rotation policy in sections 2.4 and 6 does not set an analytics retention period.

5. Who we share data with

• We don’t sell or rent your personal data, and we don’t share it for advertising.
• Linode hosts our website and servers and processes data on our behalf under its data processing agreement; its support staff may access the servers under that agreement.
• Mailgun delivers verification emails through its US service. It receives the recipient address, the message including its short-lived verification code, and delivery information. We disable open and click tracking for verification messages. Our sending domain has message-content retention disabled, so messages are not kept for later retrieval through the Mailgun dashboard or API. This does not remove the processing needed to deliver them or separate delivery-event records. Mailgun retains delivery logs according to the account plan, and may keep bounce, complaint and unsubscribe suppression records until removed to prevent unwanted mail. Its aggregate delivery statistics have a separate retention period. These provider records are separate from our own server-log rotation described in sections 2.4 and 6. Before optional update emails begin, we will confirm their delivery provider and settings here.
• Playing with others.

  In both online and direct connections, the game simulation runs on one player's PC, the host. The host controls the match, and leaving the host ends it. Online Quick Match sends game traffic through our relay as described in section 2.6. The host sees local bridge addresses for those connections, rather than other players' public IP addresses through this transport. The relay and its hosting infrastructure can see connection IPs and process game packets. In-match radio is unavailable in these online sessions.

  LAN discovery and direct-IP joining still connect players' PCs directly. Local Quick Join uses a broadcast to find nearby hosts. The host can see a direct joining player's IP address, and that player can see the host's; other joining players connect to the host rather than to each other. In direct sessions, the game can fetch in-match radio from the host.

  Other players see the display name you chose. The networking layer also exchanges an Unreal player identifier which can contain your Windows computer name and an identifier your PC stores for Unreal Engine games. Choosing a display name or using the relay does not change that underlying identifier. We cannot delete copies held on another player's PC or control what that player does on their PC.

  To admit a joining player, the host receives a signed answer from our license server containing the player's license identifier, access expiry and the host's one-time number. It never contains the Beta Key, email address or rewards account identifier. For online sessions this exchange passes through our relay; for direct sessions it passes directly between the players' PCs. The relay processes it transiently and does not record its contents.

• We may disclose information if the law requires it, or where needed to protect the rights, safety or security of players, the public or us.
• If the game is transferred to a new owner, your data may be transferred with it, and this policy will continue to apply to it.

6. How long we keep it

• Registration details (name, email address, confirmations, consent records and license identifiers): for the duration of the beta plus 90 days. The beta ends on the date we announce on the beta page or when the last issued key expires, whichever is later. We then delete the registration of everyone who isn’t a confirmed subscriber to development updates, and repeat that clean-up at least monthly, so a record is deleted no later than about a month after it becomes eligible.
• Development updates and future-game news: if you asked for updates and completed verification (see 2.5), we keep your name, email address and consent record to send updates, even after the beta. Once you unsubscribe, the subscription details are deleted in the next monthly clean-up. An unverified claim never becomes a subscription; its temporary details follow the verification-request cleanup below.
• Verification requests: a code becomes unusable after 10 minutes, five failed attempts or successful use. Successful and failed-delivery requests have their submitted details cleared immediately. Expired requests have those details cleared by the hourly cleanup or a later verification request, whichever comes first. Opaque sending-limit counters become eligible for deletion after 24 hours and are removed in that cleanup too.
• Retained rewards: we keep your verified email address, random account identifier, key links and earned reward records while your player profile is maintained for returning-player recognition, including after beta access expires. This is independent of marketing consent. You can request deletion of the profile and its rewards; uninstalling the game or unsubscribing from updates does not request that deletion. Profiles with no earned reward are removed with the corresponding non-subscriber registration during the beta-end cleanup.
• License records (license identifier, keyed hash of the key and its issue, activation, expiry and revocation times): until the beta database is retired, which is no earlier than the end of the beta plus 90 days. A verified player profile can retain its key links for reward recovery after the beta registration is removed; deleting that profile removes those links too. Issued-key records remain so deletion cannot change an existing key’s expiry or revocation.
• Feedback reports: while they are useful for developing the game, and no longer than the duration of the beta plus 90 days.
• Feedback spam-protection records (only if that protection is switched on): a keyed hash of your network address and a count, stored in the feedback database for a short time window (10 minutes unless the service is configured otherwise). Old records are removed when a later report arrives, so one can stay until the next report is received.
• Online matchmaking and relay state: room and participant information, signed access details and pending game packets are held in the match service's memory while needed for the connection or room. The service removes that state as connections and rooms close and does not write it to a database or packet-content log. Request and error logs follow the server-log policy above. Existing license and profile records have their own retention periods and are not deleted merely because an online match ends.
• Server logs: daily rotation with 30 archives, approximately 30 days for active logs; quiet logs can remain longer as explained in section 2.4.
• Backups and working copies: private backup copies of the registration, profile, reward, license and feedback databases are kept for up to 30 days. Data you asked us to erase may remain in a backup until it expires; if we restore a backup, we re-apply every recorded erasure and withdrawal before the service goes back online. Files exported to send update emails are deleted after import.
• Claim rate-limit counts: in server memory only, for about an hour.

7. Your rights

Depending on where you live, you may have the right to:

• ask for a copy of the personal data we hold about you;
• have it corrected if it is wrong, or deleted;
• withdraw your consent to update emails at any time;
• object to, or ask us to restrict, how we use it;
• receive it in a portable format; and
• complain to a data protection supervisory authority, for example the one where you live or work.

To use any of these rights, email Support@MoonRockDuckets.com from the address you registered with. If you no longer have that mailbox, write from any address and quote the license reference shown when you claimed (it is in the key text file you saved). Never send us your Beta Key itself. For a feedback report, quote its report ID from the game’s feedback history. We can’t identify you from web-server logs alone, so we can’t act on requests about them beyond deleting them on schedule. We may ask one or two questions to confirm a request is genuine; we don’t ask for identity documents. We will answer within the time the law requires (usually one month). We do not sell or share personal information for targeted advertising.

8. Children

The beta and this website are not directed at children under 16, and you must be at least 16 to claim a Beta Key. If you believe someone under 16 has given us personal data, contact Support@MoonRockDuckets.com and we will delete it.

9. Security

We use HTTPS, keep registration and license data on private servers with restricted access, and store only keyed hashes of Beta Keys. No system is perfectly secure, so please keep your key private. If a personal-data breach is likely to put you at risk, we will notify the relevant authorities and the affected people as the applicable law requires.

10. International transfers

Our website, license and feedback server is hosted by Linode in Dallas, Texas, United States. Verification emails are processed through Mailgun’s US service. If you live elsewhere, your data is processed in a country other than your own, which may have different data protection laws. Our providers’ data processing agreements address international transfers: Akamai incorporates the applicable transfer mechanisms described in its Privacy Trust Center; Sinch’s agreement for Mailgun includes standard contractual clauses and the UK Addendum where applicable, and describes Sinch Email’s Data Privacy Framework safeguards. These provider arrangements do not make Moon Rock Duckets itself certified under that framework. Email Support@MoonRockDuckets.com for information or copies of the applicable safeguards.

11. Changes to this policy

If we change this policy, we will publish the new version here with a new version date, and you will see the current version the next time you claim a Beta Key. If a change significantly affects how we use data you have already given us, we will tell you before it applies, and ask for your consent where the law requires it.

12. Contact

Controller: the developer of Moon Rock Duckets. Email: Support@MoonRockDuckets.com. You can also read the Beta Terms.