Privacy Policy

In short

• We collect what we need to run your account, the launcher, friends and chat, and to keep the service safe.
• We do not sell your data. There are no ads, no third-party analytics and no tracking across other sites or apps. We only count downloads and daily players ourselves.
• Only your friends see whether you are online and what you are playing. If Discord status is on, your Discord friends also see what you are playing (see Who we share data with). You can appear offline.
• Chat messages are stored on our servers. They are not end-to-end encrypted.
• You can download a copy of your data and delete your account in the launcher at any time.
• You must be at least 13 years old to create an account.

Who we are

The service is run by Complex Studios, an independent game studio based in the United Arab Emirates, operated by its founder (“Complex Studios”, “we”, “us”). We decide why and how your personal data is used, so we are responsible for it (the “controller” under data protection law).

We have not appointed a data protection officer. The founder handles privacy questions directly; see Contact.

What this policy covers

This policy covers the Complex Launcher, your Complex account, friends, chat and cloud saves, the games and playtests we deliver through the launcher, and this website. If a game ever needs data that is not described here, we will update this policy, or show you a notice for that game, before the game collects it.

Why we are allowed to use your data

Data protection laws only allow us to use personal data for a reason the law accepts, called a “legal basis”. For each kind of data below, we name ours:

• Contract: we need the data to give you the service you signed up for under our Terms of Service.
• Legitimate interests: we need the data for a reason that matters to us and to players, such as keeping accounts secure, stopping abuse, keeping players safe and fixing problems, and this reason is not outweighed by your rights. You can object to this use (see Your rights).
• Consent: you chose to turn something on, and you can turn it off at any time.
• Legal obligation: the law requires it, for example a valid order from a court or an authority.

Where UAE law applies, we use your data to perform our agreement with you, which includes keeping accounts and the service secure, preventing abuse and moderating the community; to meet legal obligations; and to protect ourselves or others in a legal dispute. Crash reports and Discord status are your choice: you can turn them on or off in Settings > Social and privacy at any time. Launcher crash reports and Discord status are on until you turn them off.

What we collect and why

Most of this data comes from you or from your use of the service. Some comes from other players, for example when they send you a friend request or a message or report you, and from our staff, for example their notes on a report.

Your account

Your email address; your password, stored only as a salted one-way hash (scrypt), so nobody, including our staff, can read it; your display name and four-digit tag, which together are your Complex ID; your avatar, if you upload one; the language you chose; whether you appear offline; and the dates your account was created, confirmed and last changed.

Your Complex ID and avatar are visible to other players, who can find you by searching for your name. Avatar images are stored at web addresses that anyone with the link can open. We re-encode every avatar on our server, which removes hidden information such as the place a photo was taken.

• Why: To create and run your account, sign you in, send you emails about your account, show you to other players and show our texts in your language.
• Legal basis: Contract.
• How long we keep it: Until you delete your account. If a new account’s email address is never confirmed, the account is deleted after 7 days.

Sign-ins and devices

For each device you are signed in on: the device name (the name of your Windows computer), the app or browser, the IP address, and when the session started and was last used. We store only a one-way hash of your sign-in token, never the token itself. If you turn on two-step sign-in: your authenticator secret, encrypted, and one-way hashes of your recovery codes. If you choose to trust a PC: a hash of a random key stored on that PC.

• Why: To keep you signed in, show you where your account is signed in so that you can end sessions, and protect your account.
• Legal basis: Contract, and our legitimate interest in keeping accounts secure.
• How long we keep it: A session ends after 30 days without use and after 90 days at the latest, or sooner when you sign out or end it in the launcher. When you change your password, all your other sessions end and your other trusted PCs are forgotten. A password reset ends all sessions and forgets all trusted PCs. Ended sessions are deleted. A trusted PC is forgotten after 90 days. Two-step sign-in data is deleted when you turn it off.

Sign-in history and protection against attacks

To protect your account and the service, we keep:

• Sign-in history: sign-ins and failed sign-ins, sign-outs, password changes and resets, email confirmations, sign-in codes sent, changes to two-step sign-in, recovery codes used and data downloads, each with the time, device name, app and IP address.
• Attack counters: short-lived counts of failed sign-ins and requests per account and per network (IP address range), to stop password guessing and spam.
• Email records: which emails we sent to an address, with the address stored only as a hash, so that nobody can flood an inbox.
• Staff alerts: automatic alerts to our staff about attacks, which can include account IDs and network addresses.

• Why: So that you and we can spot a stolen account, and to block attacks on accounts and on the service.
• Legal basis: Our legitimate interest in keeping accounts and the service secure.
• How long we keep it: Sign-in history: 90 days. Failed sign-in counters: 1 day. Email records: 2 days. Request counters: until their time window ends. Pending sign-in steps and email links expire after 15 minutes to 7 days and are deleted 1 day later. Staff alerts: 180 days after staff have dealt with them. IP addresses stored with sessions are removed after 90 days at the latest.

Friends, chat and online status

Your friends, friend requests and the players you block, with dates; the messages you send and receive in chat, with the time; which messages you have read, which the other person sees; whether you are online, away or offline, what you are doing (in the launcher, or which game you are playing) and when you were last online. While you type, the other person sees that you are typing; this is not stored.

Chat messages are stored on our servers so that they reach all your devices. They are encrypted on the way between the launcher and our servers, but they are not end-to-end encrypted. Our staff tools do not show chats; staff see messages only when a player reports them (see Reports and moderation below).

Your status, activity and last-online time are shown only to your friends. If Discord status is on, Discord also shows what you are playing to your Discord friends (see Who we share data with). If you turn on Appear offline, friends see you as offline, with the time you were last online. That time is still updated when you close the launcher, also while you appear offline. Appear offline does not turn off Discord status.

• Why: To give you friends, chat and online status.
• Legal basis: Contract.
• How long we keep it: Friends, requests and blocks: until you remove them or one of the accounts is deleted. Messages: until you or the other person deletes their account; you cannot delete single messages yet. When either person deletes their account, the whole conversation is deleted for both. Online status is kept in memory only; the last-online time is kept until you delete your account.

Notifications

The items in your launcher inbox: friend requests and accepted requests, new messages, studio news, game releases and updates, moderation notices, and updates on reports you made.

• Why: To tell you about things that happen in the service.
• Legal basis: Contract.
• How long we keep it: Read notifications are deleted 90 days after you read them. Unread ones stay until you read or delete them. You can delete any notification yourself.

Games, playtests and downloads

The games in your library and how you got them (for example with a playtest key); when you started and stopped playing and which version you played; your total playtime and when you last played. When you redeem a playtest key: the key, the time and your IP address.

Records of your downloads and updates (game, version, size, time), and one record for each day you use the service.

When you start a game with online features, the launcher gets a short-lived ticket that the game’s server, run by us, uses to confirm your Complex ID, display name and avatar.

• Why: To give you your games and playtests, show your playtime, check playtest keys for abuse, and count downloads and daily players so that we can run the service.
• Legal basis: Contract for your library, playtime and game tickets. Our legitimate interest in preventing key abuse and in understanding how the service is used, for key redemptions, download records and daily use records.
• How long we keep it: Library and play history: until you delete your account. IP addresses on key redemptions: 90 days; the redemption itself is kept without your account after you delete it, so that we know the key was used. Download records: 180 days. Daily use records: until you delete your account. Game tickets: 5 minutes, deleted 1 day later.

Cloud saves

For games with cloud saves, while cloud saves are on: copies of your save files and earlier versions of them, with their file names, sizes and dates and the name of the PC that uploaded them. On your PC, the launcher also keeps local backup copies of your saves.

Cloud saves are optional: you can turn them off for all games or for one game in the launcher. Our staff tools show which files exist and their sizes, never their contents.

• Why: To sync your saves between your PCs and let you restore an earlier version.
• Legal basis: Contract.
• How long we keep it: Up to 10 versions per game, the current one included (a game can be set to keep up to 50). Everything is deleted when you delete your account.

Crash reports

When a game crashes: the game, its version, the error code, how long it ran, the launcher version and your system (Windows version, processor, memory, graphics cards and language), and any description you write. If “Attach crash files” is on (it is on by default), we also get the crash files that the game names; in Ask mode, the dialog lists them before you send. Game crash reports are linked to your account.

When the launcher has an error: the error message and a technical trace, with your Windows user name, your user folder, email addresses and sign-in tokens removed. The report is linked to your account if you are signed in, and otherwise to a random ID for your installation.

When the launcher crashes completely: a memory dump of the launcher, which can contain anything the launcher had in memory at that moment. We remove sign-in tokens from it and sign out that session. Memory dumps are not linked to an account.

We do not store your IP address with any crash report.

You decide in Settings > Social and privacy. For game crashes, the launcher asks you each time by default and sends nothing until you press Send; you can also choose to always send or never send. Launcher crash reports are sent automatically by default, and you can turn them off. Turning reports off deletes the ones still waiting on your PC.

• Why: To find and fix crashes, and for nothing else.
• Legal basis: Your consent for game crash reports you choose to send. Our legitimate interest in keeping the launcher working for launcher crash reports, which you can turn off.
• How long we keep it: 90 days, then they are deleted with their files. Only our staff can see crash reports, and every download of a crash file is logged. Reports waiting on your PC are deleted after 14 days. When you delete your account, your descriptions, system details and installation ID are removed from your reports at once and their files are deleted. The remaining technical details (versions, error codes, how long it ran, error messages and traces) stay without your account until they are deleted after 90 days.

Reports and moderation

When you report a player: you, the player, their display name and tag at that time, the reason, where you reported from, your note, and copies of the evidence: up to 30 chat messages from the conversation and a copy of their avatar. Then the progress of the report and our staff’s decision and notes. Warnings, chat mutes and suspensions, with their reasons and dates. A log of every action our staff take, with the staff member, the time and their IP address.

The player you report is not told who reported them. The launcher confirms that your report was sent, and you get a notification when your report leads to action.

• Why: To keep players safe, enforce our Terms of Service and Community Guidelines, and keep our staff accountable.
• Legal basis: Our legitimate interest in a safe community, in enforcing our Terms and in protecting ourselves or others in a legal dispute.
• How long we keep it: Reports and their evidence are kept as moderation records for as long as we need them to deal with repeated abuse and to protect players, ourselves or others in a legal dispute, also after an account is deleted. After a deletion they are no longer linked to the account, but they still contain the display name, tag and avatar copy recorded at the time of the report, and the reported messages. Warnings, mutes and suspensions are deleted with the account. The staff action log, which also records their reasons, is kept for as long as we need it to keep our staff accountable and to protect ourselves or others in a legal dispute; its entries cannot be changed or deleted. IP addresses in the log are removed after 90 days.

Emails

We send only emails about your account: confirmation links, sign-in codes, password reset links, a warning when someone tries to create an account with your address, and security notices: a new sign-in, a password change, a password reset, two-step sign-in turned on or off, a recovery code used, and a warning when someone repeatedly enters wrong sign-in codes. Most security notices include the device name, IP address and time, and a “This was not me” link. We do not send marketing emails or newsletters.

• Why: To confirm your address, help you sign in and recover your account, and warn you about activity on it.
• Legal basis: Contract, and our legitimate interest in keeping accounts secure.
• How long we keep it: We do not keep copies of the emails we send.

This website and server logs

You do not need an account to read this website. Our servers write a technical log of each request from this website and from the launcher: the address requested (which can include search words and account IDs), your IP address, the time and the result. Crash report uploads are not logged this way.

• Why: To run the website and the service and to protect them from attacks.
• Legal basis: Our legitimate interest in running a secure service.
• How long we keep it: Request logs are not stored in our database. We set up our hosting to delete them after 30 days at the latest.

On your PC

The launcher keeps some data on your PC: your sign-in token and a random device key, both encrypted by Windows; a copy of your profile (email, name, tag, avatar and language) so that the launcher works offline, removed when you sign out; your settings and a few display choices; which games are installed and where; local backup copies of your saves (up to 10 per game); crash reports waiting to be sent; and a random ID for your installation. This data stays on your PC, except where this policy says it is sent to us.

Who we share data with

We do not sell your personal data, and we do not use it for advertising. We share data only in these cases:

• Other players see your Complex ID and avatar, and your friends see your online status, as described above.
• Service providers that work for us and may use the data only on our instructions: the company that hosts our servers and stores our data and backups; an email delivery provider, which receives your email address and the content of the emails we send you; and, if we use one, a network protection and content delivery provider, which passes on the traffic between you and our servers, including your IP address. We will name these providers here before the service opens to the public.
• Our game servers receive your Complex ID, display name and avatar when you start a game with online features.
• Discord, only through Discord status: when this setting is on (Settings > Social and privacy; it is off until you turn it on) and the Discord app is running on your PC, the launcher tells the Discord app that you are in the launcher or which game you are playing and for how long, and Discord shows this to your Discord friends. This goes from your PC directly to Discord, and Discord’s own privacy policy applies. Our servers receive nothing from Discord. We rely on your consent, which you give by turning the setting on; you can turn it off at any time.
• When the law requires it: we disclose data when a law, a court order or a valid request from an authority requires it, including requests from UAE authorities, and when it is needed to protect someone from serious harm.
• If the service changes hands: if the founder sets up a company to run the service, your data moves to that company and this policy keeps applying. We will tell you before that happens.

Where your data is stored

Complex Studios is based in the United Arab Emirates. Our servers are in United Arab Emirates. If you use the service from another country, your data is sent to and stored in United Arab Emirates.

Because we work from the UAE, your data is also accessed from there. The UAE has its own data protection law, but the European Union and the United Kingdom have not recognised it as giving the same level of protection as theirs. If your data is stored or handled outside the UAE, we send it only to countries, or with safeguards, that UAE law allows.

If a service provider handles your data in another country, we make sure it is protected as the law requires, for example with standard contractual clauses approved by the European Commission or the UK.

Deleting your account

You can delete your account at any time in the launcher: Settings > Account > Delete account. You confirm with your password. The deletion happens at once and cannot be undone.

This deletes your account and profile, avatar, sessions, sign-in history, trusted PCs, two-step sign-in, friends, requests and blocks, your conversations and their messages (for the other person too), notifications, library, play history, cloud saves, and your warnings, mutes and suspensions.

Some records stay, for the reasons given above:

• reports you made, or that were made about you, with their evidence. They are no longer linked to your account, but they still contain the display name, tag, avatar copy and messages recorded at the time;
• the staff action log, including the reasons recorded for actions on your account;
• playtest key redemptions without your account (their IP address for up to 90 days after the redemption), and download records without your account (for up to 180 days after the download);
• the remaining technical details of your crash reports, without your account, description or system details, until they are deleted after 90 days;
• copies in our encrypted backups, until those backups are replaced by newer ones (we keep only the latest 7 daily backups);
• news articles published by the studio.

Your rights

Depending on where you live, data protection laws, such as the GDPR in the EU and the UK and the UAE data protection law, give you these rights:

• Access: get a copy of your data. In the launcher: Settings > Security and sessions > Your data > Download my data.
• Portability: get the data you gave us in a format a computer can read. The download is a JSON file.
• Correction: have wrong data fixed. You can change your display name, avatar, language and password in the launcher. To change your email address, contact us; the launcher cannot change it yet.
• Deletion: delete your account in Settings > Account > Delete account, or ask us to delete specific data.
• Restriction: ask us to stop using your data for a while, for example while we check a complaint.
• Withdraw consent: turn off what you turned on, such as crash reports. This does not affect what happened before.
• Human review: you can ask for a person to review any decision about you that was made by automated means alone. We do not make such decisions today (see Automated decisions).

You have the right to object at any time to our use of your data based on legitimate interests. We then stop, unless we have strong legitimate reasons that outweigh your interests, or we need the data for a legal dispute.

To use a right that the launcher does not cover, or to get data the download does not include (for example messages you received or crash files), contact us. It is free. We answer within one month; if a request is complex, we may need up to two more months and will tell you why. We may need to check that the request comes from the account owner, usually by asking you to write from your account’s email address. We will never ask for your password.

If you are unhappy with how we handle your data, please contact us first. You can also complain to a data protection authority: in the EU or the EEA, the authority in your country; in the UK, the Information Commissioner’s Office (ico.org.uk); in the UAE, the UAE Data Office.

What you must give us and what is optional

To create an account, you need an email address, a password and a display name; without them we cannot give you an account. Your display name and tag are visible to other players. Everything else is optional: an avatar, cloud saves, crash reports, Discord status, and anything you write in chat or in reports.

Automated decisions

We do not make decisions about you by automated means alone that have legal effects or similarly significant effects. Some protections run automatically: after too many failed sign-ins or requests, signing in or sending requests is paused for a while; and if our chat word filter is switched on, it can hide words in messages or stop a message from being sent. Warnings, chat mutes and suspensions are always decided by a member of our staff. We do not build advertising profiles.

Children

You must be at least 13 years old to create a Complex account (see our Terms of Service). If you are under 18, a parent or guardian must also agree to our Terms for you. If you live in the EU, the EEA or the UK and are under the age at which you can agree to the use of your data online in your country (between 13 and 16, depending on the country), a parent or guardian must agree for you.

We do not knowingly collect personal data from children under 13. If we learn that an account belongs to a child under 13, for example from a parent, a report or something the player says, we close the account and delete its data.

The service has no ads and no tracking across other sites or apps, online status is shown only to friends, and every player can appear offline, block other players and report them. Discord status, which shows your game to your Discord friends, is off until the player turns it on in Settings > Social and privacy.

Parents and guardians can ask us to show or delete their child’s data (see Contact), and the account can always be deleted in the launcher. We will never ask you to send identity documents by email. We cooperate with lawful requests from UAE child-protection authorities.

How we protect your data

• Passwords are stored only as salted one-way hashes (scrypt), and sign-in tokens only as hashes.
• The launcher connects to our servers over encrypted HTTPS connections and keeps your sign-in token on your PC encrypted by Windows.
• You can turn on two-step sign-in, see every device signed in to your account and sign them out. We limit failed sign-ins.
• We send security emails about new sign-ins and important changes to your account.
• Avatars are re-encoded to remove hidden information.
• Our staff tools require a password and an authenticator app, and every staff action is logged.
• We make an encrypted backup of our database and player files every day (crash files are left out) and keep only the latest 7.

Chat messages are not end-to-end encrypted. No system is perfectly secure, so we cannot promise that your data will never be accessed without permission.

If a security breach is likely to put you at risk, we will tell you without undue delay, and we will inform the authorities where the law requires it.

Cookies and local storage

This website sets one cookie, lang, and only when you pick a language in the language menu. It remembers your choice for 365 days. Because it is needed for something you asked for, the law does not require us to ask first, so there is no cookie banner.

Our staff’s admin pages use one more cookie, which keeps staff signed in for up to 12 hours. Players never get it.

We use no analytics and no advertising or tracking cookies, and this website loads nothing from other companies: fonts and images come from our own server. The pages that confirm your email address or reset your password run one small script that reads the code from the link; it stores nothing in your browser.

The launcher stores a few display choices on your PC, such as how your library is shown (see On your PC above).

Changes to this policy

When we change this policy, we publish the new version on this page with a new “Last updated” date. If a change is important, we tell you in the launcher or by email before it takes effect. Earlier versions are available on request.

This policy is written in English. Translations are provided for convenience; if a translation differs from the English text, the English text applies.

Contact

The service is run by Complex Studios, an independent game studio based in the United Arab Emirates, operated by its founder.

For privacy questions and requests, email privacy@complexstudioss.com.