Desktop Tower Survivor
Privacy Policy
Last updated: 14 October 2026
In short: so your progress can be saved to the cloud and you can compete on the leaderboards, the game stores your Steam ID, your nickname and your progress on a server we run ourselves. There are no ads, no third-party analytics, no profiling, and your data is never sold to anyone. You can delete your account yourself from inside the game, under Options, and everything goes with it.
1. Who handles your data
The data controller is Carlos Bargues Carot, an independent developer based in Spain, author and operator of Desktop Tower Survivor.
Contact: support@kalgator.com
Write to that address about anything concerning your data — it is the same address that handles game support.
2. What data is collected and why
Only what the game actually needs is collected. Nothing is asked for that isn't required.
| Data | Purpose |
|---|---|
| Steam ID Provided by Steam when the game starts | Identifying your account and linking it to your progress. It is the only stable identifier we hold. |
| Internal account ID and access key The key is stored hashed, never in plain text | Making sure only you can access your account and restore your save on another machine. |
| Nickname Chosen by you | Displaying you on leaderboards, tournaments and guilds, and in the results our bot posts on the Kalgator Discord server. It is public within the game. |
| Game progress Save file, records, waves, coins, gems, emblems, lab research… | Cloud saving, syncing between machines and calculating leaderboards. |
| Language | Sending you server text and in-game mail in your language. |
| Account creation and last seen dates | Service maintenance and identifying inactive accounts. |
| Discord account Optional: only if you link it yourself with /link on the Kalgator Discord server. Your Discord ID and display name are stored | Recovering your account on another machine with /recovery, giving you the linking gift and the daily gems from /claim. The game works fine without it. |
| Guild chat messages | So your guild members can read them. Only your guild sees them. |
| Anti-cheat records Runs reporting impossible values | Keeping leaderboards and tournaments fair. |
| Purchase records Item, amount, currency and Steam transaction ID | Delivering what you bought, providing support and meeting accounting obligations. |
About payments
We never see or store payment details. In-game purchases are charged entirely through your Steam Wallet: Valve processes the payment and is the merchant of record. We only receive confirmation that the purchase went through, along with the amount and a transaction identifier. No card numbers, no cardholder name, no billing address.
What your friends see (Steam and Discord)
While you play, your Steam friends can see whether you are in the menu or in a run (mode, tier and wave) and, if the Discord app is open on your computer, your Discord profile shows the same. That information goes straight from your computer to Steam or Discord: it does not go through our server and is not stored there. You can turn it off under Options → General → Show what I play to my friends.
What we do not do
- No advertising and no ad networks.
- No third-party analytics tools (Google Analytics, Facebook Pixel or similar).
- No profiling and no automated decisions that significantly affect you.
- Your data is never sold, rented or shared with third parties for commercial purposes.
- No access log with IP addresses is kept. The server uses your IP only in memory, for one minute, to limit how many requests arrive from the same connection (abuse protection); it is not stored or associated with your account. The server's technical logs only record errors and overwrite themselves.
- This website uses no tracking cookies. It only stores your chosen language in your browser, and only if you change it.
3. Legal basis
- Performance of a contract (Art. 6(1)(b) GDPR) — for everything needed to provide the service: your account, cloud save, leaderboards, guilds and purchases. The game cannot work without this data, which is why consent is not requested for it.
- Legitimate interests (Art. 6(1)(f) GDPR) — for anti-cheat, server security and backups. The interest is keeping the game fair and not losing your progress.
- Consent (Art. 6(1)(a) GDPR) — only for linking your Discord account, which is optional and done by you. You can withdraw consent at any time with
/unlinkon the Kalgator Discord server or by writing to support. - Legal obligation (Art. 6(1)(c) GDPR) — for keeping purchase records for the periods required by Spanish tax and commercial law.
4. Who else can see your data
Nothing is shared with anyone for commercial purposes. The technical providers the service could not exist without are:
| Provider | Purpose | Location |
|---|---|---|
| OVH | Server and database hosting | European Union |
| Valve Corporation | The Steam platform: sign-in and payment processing. Valve is an independent controller for its own data and has its own privacy policy. | USA |
| Google (Google Drive) | Daily database backup, so player progress can be restored if the server fails | USA |
| Discord Inc. | The platform of the Kalgator Discord server, where our bot runs (account linking, /claim, /recovery and tournament and event announcements). Only involved if you use that server. Discord is an independent controller for the data on its platform and has its own privacy policy. | USA |
Transfers outside the European Union
Valve and Google are based in the United States. Both participate in the EU–US Data Privacy Framework, which the European Commission found adequate on 10 July 2023, so the transfer is covered by the safeguard set out in Article 45 GDPR. Discord is also based in the United States and, according to its privacy policy, participates in the same framework; Discord only receives what you use there (your Discord ID when you link, recover or use /claim) and the public nicknames in announcements.
5. How long data is kept
| Data | Retention |
|---|---|
| Account and game progress | For as long as the account exists. Deleted when you delete it. |
| Guild chat messages | 90 days, then automatically deleted |
| Anti-cheat records | 90 days, then automatically deleted. If your account is flagged or suspended for cheating, they are kept for as long as it remains so, so the case can be reviewed if you dispute it. |
| Copy of a deleted account | 90 days, in case you deleted it by mistake and want it back. After that it is permanently destroyed. |
| Steam ID of an account deleted while suspended for cheating | 365 days, only to recognise someone who comes back with a new account after a suspension. Then automatically deleted. |
| Linked Discord account | For as long as it stays linked. Removed when you unlink it or delete your account. |
Discord linking history and /claim records | 90 days after unlinking or after the claim, then automatically deleted |
| Record of the Discord linking gift | The Discord ID that already received it is kept, only so the gift is not given twice to the same Discord account. You can ask for it to be deleted by writing to support. |
| Purchase records | The periods required by Spanish accounting and tax law |
| Backups | Rotated over time; deleted data may persist in an older backup for a few more weeks |
6. Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability at any time. Just write to support@kalgator.com; you will get a reply within one month at the latest, free of charge.
Deleting your account without asking anyone
You do not need to email anyone to leave. Inside the game, under Options → Delete account, you can remove your account and all your progress from the server yourself. A single copy is kept for 90 days in case you change your mind, and is then destroyed.
If you have made a purchase, the accounting record of that purchase is kept even if you delete your account: that is a legal obligation and not something we can waive.
Complaints
If you believe your data is not being handled properly, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es), or with the supervisory authority in your own country. We would appreciate hearing from you first so we can try to sort it out.
7. Anti-cheat and automated decisions
The server automatically checks that submitted results are possible. If it detects impossible values, it may automatically exclude that run from the leaderboards and record the event in a log.
Accounts are never banned automatically — a human always reviews the case first. If you think something has been flagged unfairly, write to support and it will be reviewed by hand.
8. Security
The server and database are not reachable from the internet except through the game's own API. All traffic is encrypted with HTTPS and your account access key is stored as a cryptographic hash, never in plain text. The admin panel requires a one-time code sent by email and keeps an audit log of everything done through it.
No system is perfect. Should a breach occur that poses a risk to your data, the Spanish Data Protection Agency and, where required, the individuals affected will be notified within the deadlines set by the GDPR.
9. Children
Playing requires a Steam account, and Valve requires users to be at least 13 years old. This game is not directed at children under 14, the age from which Spanish law allows a person to consent to the processing of their personal data. No data is knowingly collected from children below that age; if such an account is identified, it is deleted.
10. Changes to this policy
If the game changes and so does what happens to your data, this page will be updated and the date at the top will change. If the change is significant, it will also be announced inside the game.