Desktop Tower Survivor
Privacy Policy
Last updated: 30 August 2026
In short: so your progress can be saved to the cloud and you can compete on the leaderboards, the game stores your Steam ID, your nickname and your progress on a server we run ourselves. There are no ads, no third-party analytics, no profiling, and your data is never sold to anyone. You can delete your account yourself from inside the game, under Options, and everything goes with it.
1. Who handles your data
The data controller is Carlos Bargues Carot, an independent developer based in Spain, author and operator of Desktop Tower Survivor.
Contact: support@kalgator.com
Write to that address about anything concerning your data — it is the same address that handles game support.
2. What data is collected and why
Only what the game actually needs is collected. Nothing is asked for that isn't required.
| Data | Purpose |
|---|---|
| Steam ID Provided by Steam when the game starts | Identifying your account and linking it to your progress. It is the only stable identifier we hold. |
| Internal account ID and access key The key is stored hashed, never in plain text | Making sure only you can access your account and restore your save on another machine. |
| Nickname Chosen by you | Displaying you on leaderboards, tournaments and guilds. It is public within the game. |
| Game progress Save file, records, waves, coins, gems, emblems, lab research… | Cloud saving, syncing between machines and calculating leaderboards. |
| Language | Sending you server text and in-game mail in your language. |
| Account creation and last seen dates | Service maintenance and identifying inactive accounts. |
| Recovery email address Optional: only if you provide it | Recovering your account if you lose access. The game works fine without it. |
| Guild chat messages | So your guild members can read them. Only your guild sees them. |
| Anti-cheat records Runs reporting impossible values | Keeping leaderboards and tournaments fair. |
| Purchase records Item, amount, currency and Steam transaction ID | Delivering what you bought, providing support and meeting accounting obligations. |
About payments
We never see or store payment details. In-game purchases are charged entirely through your Steam Wallet: Valve processes the payment and is the merchant of record. We only receive confirmation that the purchase went through, along with the amount and a transaction identifier. No card numbers, no cardholder name, no billing address.
What we do not do
- No advertising and no ad networks.
- No third-party analytics tools (Google Analytics, Facebook Pixel or similar).
- No profiling and no automated decisions that significantly affect you.
- Your data is never sold, rented or shared with third parties for commercial purposes.
- No access log with IP addresses is kept. The server only sees the internal address of its own proxy, so your IP is never associated with your account. It may appear briefly in an error log if something goes wrong, and those logs overwrite themselves.
- This website uses no tracking cookies. It only stores your chosen language in your browser, and only if you change it.
3. Legal basis
- Performance of a contract (Art. 6(1)(b) GDPR) — for everything needed to provide the service: your account, cloud save, leaderboards, guilds and purchases. The game cannot work without this data, which is why consent is not requested for it.
- Legitimate interests (Art. 6(1)(f) GDPR) — for anti-cheat, server security and backups. The interest is keeping the game fair and not losing your progress.
- Consent (Art. 6(1)(a) GDPR) — only for the recovery email address, which is optional and stored only if you enter it. You can withdraw consent by deleting it in-game.
- Legal obligation (Art. 6(1)(c) GDPR) — for keeping purchase records for the periods required by Spanish tax and commercial law.
4. Who else can see your data
Nothing is shared with anyone for commercial purposes. The technical providers the service could not exist without are:
| Provider | Purpose | Location |
|---|---|---|
| OVH | Server and database hosting | European Union |
| Valve Corporation | The Steam platform: sign-in and payment processing. Valve is an independent controller for its own data and has its own privacy policy. | USA |
| Google (Google Drive) | Daily database backup, so player progress can be restored if the server fails | USA |
| IONOS | Delivering account recovery emails. Only involved if you have provided an email address. | European Union |
Transfers outside the European Union
Valve and Google are based in the United States. Both participate in the EU–US Data Privacy Framework, which the European Commission found adequate on 10 July 2023, so the transfer is covered by the safeguard set out in Article 45 GDPR.
5. How long data is kept
| Data | Retention |
|---|---|
| Account and game progress | For as long as the account exists. Deleted when you delete it. |
| Guild chat messages | 90 days, then automatically deleted |
| Anti-cheat records | 90 days, then automatically deleted |
| Copy of a deleted account | 90 days, in case you deleted it by mistake and want it back. After that it is permanently destroyed. |
| Purchase records | The periods required by Spanish accounting and tax law |
| Backups | Rotated over time; deleted data may persist in an older backup for a few more weeks |
6. Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability at any time. Just write to support@kalgator.com; you will get a reply within one month at the latest, free of charge.
Deleting your account without asking anyone
You do not need to email anyone to leave. Inside the game, under Options → Delete account, you can remove your account and all your progress from the server yourself. A single copy is kept for 90 days in case you change your mind, and is then destroyed.
If you have made a purchase, the accounting record of that purchase is kept even if you delete your account: that is a legal obligation and not something we can waive.
Complaints
If you believe your data is not being handled properly, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es), or with the supervisory authority in your own country. We would appreciate hearing from you first so we can try to sort it out.
7. Anti-cheat and automated decisions
The server automatically checks that submitted results are possible. If it detects impossible values, it may automatically exclude that run from the leaderboards and record the event in a log.
Accounts are never banned automatically — a human always reviews the case first. If you think something has been flagged unfairly, write to support and it will be reviewed by hand.
8. Security
The server and database are not reachable from the internet except through the game's own API. All traffic is encrypted with HTTPS and your account access key is stored as a cryptographic hash, never in plain text. The admin panel requires a one-time code sent by email and keeps an audit log of everything done through it.
No system is perfect. Should a breach occur that poses a risk to your data, the Spanish Data Protection Agency and, where required, the individuals affected will be notified within the deadlines set by the GDPR.
9. Children
Playing requires a Steam account, and Valve requires users to be at least 13 years old. This game is not directed at children under 14, the age from which Spanish law allows a person to consent to the processing of their personal data. No data is knowingly collected from children below that age; if such an account is identified, it is deleted.
10. Changes to this policy
If the game changes and so does what happens to your data, this page will be updated and the date at the top will change. If the change is significant, it will also be announced inside the game.