Privacy Policy

1. Scope and who operates RuneLatch

This Privacy Policy applies to runelatch.com, RuneLatch accounts, browser-based tabletop puzzles, live rooms, Dungeon Master controls, beta feedback, and related support communications. In this policy, “RuneLatch,” “we,” “us,” and “our” refer to the operator of runelatch.com.

This policy does not govern third-party websites or services that you visit through external links. Their own privacy terms apply.

2. Information we collect

Account and profile information

When you create or use a permanent RuneLatch account, we may collect your email address, display name, account identifier, account creation and sign-in timestamps, email-confirmation status, role, access plan, and beta-access status. Passwords are handled by our authentication provider and are not stored in RuneLatch’s public website files or ordinary profile tables.

Anonymous player and live-room information

Players may be able to join a room using an anonymous identity. We may process an anonymous account identifier, chosen display name, room membership, participation status, and timestamps. For live sessions, we may also process a room code or room name, selected puzzle, current stage, shared puzzle state, attempts, hint activity, completion status, and other information needed to synchronize the session.

Puzzle and account activity

We may record puzzle access, progress, completion, room creation and participation, account settings, and actions needed to operate access controls, moderation, anti-brute-force protections, rate limits, and administrative tools.

Feedback, reports, and screenshots

If you submit beta feedback or a bug report, we may collect the report category and severity, your description, expected behavior, the relevant room or puzzle, current stage, page address, browser information, viewport dimensions, timestamps, and any optional screenshot you choose to upload. Screenshots may contain information that is visible on your screen, so review them before submission.

Technical, security, and usage information

RuneLatch and its service providers may process IP address, browser and device type, operating system, approximate location derived from IP address, referring page, requested pages, error and security events, challenge outcomes, and timestamps. We use this information to deliver the site, prevent abuse, investigate problems, and understand general usage.

Communications

If you contact us, we collect the information contained in your message and the contact details needed to respond.

3. How we use information

We use information to:

• create, authenticate, secure, and maintain accounts;
• operate live rooms, synchronize players, save progress, and deliver puzzles;
• apply access levels, beta access, and Dungeon Master controls;
• validate answers and enforce rate limits and anti-brute-force protections;
• moderate display names, detect fraud or abuse, and protect the platform;
• investigate bugs, review feedback, and improve usability and reliability;
• measure general website performance and understand how RuneLatch is used;
• respond to support, privacy, and account requests;
• comply with legal obligations and enforce applicable terms.

4. Analytics, cookies, and local storage

Open analytics settings

Google Analytics

RuneLatch uses Google Analytics 4 to understand aggregate website traffic and engagement. Depending on your browser and consent settings, Google Analytics may process page views, sessions, approximate location, browser and device information, referring sources, scroll activity, outbound clicks, and similar usage events. Google Analytics may use a first-party cookie such as _ga to distinguish browsers and sessions.

RuneLatch has disabled Google Signals and Google Analytics user-provided data collection. We do not intentionally send email addresses, display names, room codes, puzzle answers, feedback text, or other directly identifying content to Google Analytics.

You can learn how Google processes information from sites using its services at Google’s partner-sites privacy page. Google also provides a Google Analytics opt-out browser add-on.

Essential storage and site preferences

RuneLatch may use browser cookies, local storage, and similar technologies for authentication, security, saved theme preference, temporary session state, puzzle attempts, anonymous player display names, and other functions needed to operate or remember your choices. Clearing browser data may sign you out or remove locally saved preferences and progress.

Your browser controls

Most browsers allow you to block or delete cookies and site data. Blocking essential storage may prevent account, room, or puzzle features from functioning correctly. RuneLatch provides a site-level analytics consent control through the Privacy & cookies controls.

5. How information is shared

We do not sell personal information. We may disclose information in the following limited circumstances:

• Service providers: companies that host, secure, analyze, or support RuneLatch, subject to their agreements and privacy practices.
• Room participants: display names, room status, puzzle state, and similar session information may be visible to the Game Master and other participants in the same room.
• Legal and safety reasons: when reasonably necessary to comply with law, protect rights and safety, investigate abuse, or defend legal claims.
• Business transfer: if RuneLatch is reorganized, sold, financed, or transferred, information may be included in that transaction subject to applicable law.

6. How long we retain information

We retain information only for as long as reasonably necessary for the purposes described in this policy, including operation, security, support, dispute resolution, legal compliance, and improvement of RuneLatch.

• Account and profile information is generally retained while the account remains active and for a limited period afterward when needed for security, backup, or legal purposes.
• Live-room and puzzle data may be archived after inactivity and retained while it is needed to provide history, recovery, support, security, and platform administration.
• Feedback reports and optional screenshots may be retained while the issue is reviewed and afterward when reasonably needed for release history, security, or quality assurance.
• Analytics information is retained according to the settings configured in the RuneLatch Google Analytics property and Google’s applicable retention practices.

Some information may remain temporarily in backups or be retained when required by law or necessary to prevent fraud and abuse.

7. Your choices and privacy rights

Depending on where you live, you may have rights to request access, correction, deletion, restriction, objection, or portability of personal information, or to appeal a decision concerning a privacy request.

You may also:

• update available profile information through your RuneLatch account;
• clear browser cookies and local storage through your browser settings;
• use browser tools to block analytics technologies;
• leave a live room or stop using an anonymous player identity;
• request account or personal-information deletion by contacting us.

To protect users, we may need to verify your identity or account ownership before completing a request. Certain information may be retained when an exception under applicable law applies.

RuneLatch does not sell personal information or share it for cross-context behavioral advertising.

8. Security

RuneLatch uses administrative, technical, and organizational safeguards designed to protect information. These include authentication controls, database access policies, restricted storage, rate limits, bot protection, and security logging. No online service can guarantee absolute security, and users should use unique passwords and protect access to their email accounts and devices.

9. Children’s privacy

RuneLatch is not directed to children under 13, and we do not knowingly collect personal information from children under 13. A parent or guardian who believes a child has provided personal information may contact us so we can review and, when appropriate, delete it.

10. International processing

RuneLatch is operated from the United States. Our service providers may process information in the United States and other countries. Those locations may have privacy laws that differ from the laws where you live. Where required, we rely on appropriate legal mechanisms for international transfers.

11. Changes to this policy

We may update this policy as RuneLatch changes. The updated version will be posted on this page with a revised effective date. If a change materially affects how personal information is used, we will provide additional notice when appropriate.

12. Contact RuneLatch