Privacy Policy

Effective date: 2026-09-18
Last updated: 2026-10-01

A17PROJECT (“A17PROJECT,” “we,” “us,” or “our”) operates the website https://a17project.com and related communications about our games, including Padel: The Last Rally™, Whispers of Ages™, Finger Wars™, and Beyond the Eight™ (together, the “Services”).

This Privacy Policy explains what personal information we collect, how we use it, with whom we share it, and the choices you have. By using the Services or submitting information to us, you acknowledge this Policy.

If you do not agree, please do not use the Services or submit personal information.

Privacy contact: studio@a17project.com
Operator / data controller: Athanasios Bourantonis, trading as A17PROJECT, Greece (EU) and Sarasota, Florida, USA
Privacy enquiries: Privacy contact page

From 1 January 2027 the operator will be A17PROJECT LLC (Florida); this policy will be updated.

1. Scope

This Policy covers personal information we collect through:

• our website and any pages we link from it that we control;
• alpha / closed playtest applications and related tester communications (see also the short playtest notice at /playtests/privacy);
• newsletter subscriptions;
• launcher account linking, consent, and access to approved downloadable builds, where enabled;
• partnership, press, and creator inquiries sent by email;
• emails you send us.

This Policy does not cover third-party websites, platforms, or services we link to (for example YouTube, Steam, console stores, or social networks). Their privacy practices are governed by their own policies. The launcher account and build-access functions described below are limited to eligible invited testers where enabled. Multiplayer services, purchases, storefront accounts, and automatic gameplay analytics are not active website or launcher services. We will update this Policy before introducing additional processing.

2. Categories of personal information we collect

Depending on how you interact with us, we may collect:

2.1 Information you provide

• Playtest / alpha application (/playtests) — email address; selected game (Padel: The Last Rally, Whispers of Ages, or Finger Wars); preferred platform (currently Windows PC, with Android listed as under consideration); and your consent to be contacted about the playtest.
• Playtest access redemption (/tester) — personal invitation code.
• Playtest feedback (/feedback, after you redeem access) — questionnaire answers (play time, enjoyment, clarity, performance, replay intent, and up to two priority areas); optional comments about the game or build; optional bug reports (description, reproduction steps, impact); and optional screenshot or short clip attachments you choose to upload.
• Emails you send us — including partnership, press, creator, support, or privacy requests sent to studio or game-specific addresses (for example studio@a17project.com).
• Anti-abuse fields — our application form includes a hidden honeypot field not intended for people to fill in; entries that fill it may be treated as automated and discarded.

2.2 Information collected automatically

When you visit our website, we and/or our service providers may automatically collect:

• Operational and security data — request information processed by Cloudflare to serve and protect the website; limited abuse-prevention records containing hashed request keys, counts, and expiry times. Launcher authentication sessions can store IP address, browser user agent, and creation, update, and expiry times. The website does not implement visitor or automatic gameplay analytics.
• Cookies and similar technologies — see Section 7.

2.3 Information from third parties

We may receive information from:

• Email services used to deliver invitations, sign-in codes, and correspondence;
• Publicly available sources you point us to (for example a portfolio or social profile link you include in an inquiry).

We do not knowingly buy personal information from data brokers.

3. How we use personal information

We use personal information to:

• operate, maintain, and improve the Services and our games;
• review and respond to playtest / alpha applications and select testers;
• send playtest invitations, access instructions, build updates, and related support messages;
• evaluate partnership, press, and creator requests;
• communicate with you about studio news you requested or that relate to a relationship you already have with us;
• monitor security, prevent fraud and abuse, and debug technical issues;
• comply with law, enforce our terms, and protect our rights and users;
• link eligible invitations to verified launcher accounts, record launcher authorization consent, and provide access only to approved builds.

Legal bases (EEA/UK users — GDPR): where the GDPR applies, we rely on one or more of: performance of a contract or steps at your request before a contract (for example evaluating a playtest application); legitimate interests (operating a small indie studio site, securing services, improving games, responding to inquiries — balanced against your rights); consent (where we ask for it, for example certain cookies or optional marketing); and legal obligation.

4. How we share personal information

We do not sell your personal information for money.

We may share personal information with:

• Cloudflare — website hosting and request handling, D1 database storage for applications, invitations, feedback, newsletter and launcher records, and R2 storage for build packages and optional feedback evidence.
• Spacemail — studio and game mailboxes and SMTP delivery of playtest invitations and launcher email sign-in codes. Application and newsletter forms submit directly to the website; there is no separate external form provider.
• OpenAI / ChatGPT sign-in — the hosting platform’s sign-in used for the studio owner’s administration access. This is separate from tester access and launcher email-code sign-in.
• YouTube / Google — the optional soundtrack player loads a privacy-enhanced YouTube embed after you choose to play it; YouTube handles that playback under its own policy.
• Professional advisors (legal, accounting) under confidentiality;
• Authorities or parties to a legal process when required by law or to protect rights, safety, and security;
• A successor in connection with a merger, acquisition, or asset transfer, subject to appropriate safeguards.

Playtest builds: access is checked against the tester invitation and the approved build. Downloads are served through the website’s protected Cloudflare storage route; the code does not send tester account details to Steam, Apple, Google, or console stores.

We do not authorize service providers to use your information for their own independent marketing.

5. International transfers

The operator is Athanasios Bourantonis, trading as A17PROJECT, Greece (EU) and Sarasota, Florida, USA. Our service providers may process information in the United States or other countries outside your country of residence, including outside the EEA. Those countries may not provide the same level of data protection.

Where required, we will use appropriate safeguards for such transfers (for example Standard Contractual Clauses).

6. Retention

We keep personal information only as long as needed for the purposes described in this Policy, including:

• playtest applications and related communications — typically for the duration of the relevant playtest program and a reasonable period afterward for follow-up, fraud prevention, and record-keeping (reviewed by the studio, normally up to 24 months after last contact unless you ask us to delete sooner or law requires longer; this is a retention policy, not an automatic deletion timer);
• partnership / press inquiries — for as long as needed to evaluate and follow up, then delete or archive as appropriate;
• website logs — for shorter operational periods;
• launcher account, invitation-link and authorization-consent records — while needed to administer invited access and resolve security or support issues, with retention and removal reviewed by the studio. Token expiry or revoking access does not itself delete the account or consent record;
• sign-in codes — valid for five minutes, with hashed verification values stored by the authentication service. Access tokens expire after five minutes and refresh tokens after one hour. Expired records may remain until cleanup; expiry limits access, rather than promising immediate erasure.

When we no longer need personal information, we delete it or irreversibly anonymize it where feasible.

7. Cookies and similar technologies

We and our infrastructure providers may use cookies or similar technologies that are:

• Strictly necessary — a first-party tester-access cookie/session remembers redeemed access for up to seven days. Where enabled, launcher account cookies support email-code sign-in and the authorization/consent flow;
• Security / bot management — for example Cloudflare-related cookies used to protect the site from automated abuse;
• Embedded third-party media — the soundtrack player loads a youtube-nocookie.com embed only after you choose to play it. YouTube may then process playback information or use browser storage subject to Google’s policies.

The website does not load Google Analytics or gTag. If we add non-essential analytics later, we will update this section and obtain consent where required.

You can control cookies through your browser settings. Blocking some cookies may affect site or tester-portal functionality.

8. Children’s privacy

The Services are intended for a general audience and are not directed to children under 13 (or the equivalent minimum age in your country). We do not knowingly collect personal information from children under 13.

If you believe a child has provided us personal information, contact us at the privacy email above and we will take appropriate steps to delete it.

9. Your rights and choices

Depending on where you live, you may have rights to:

• access, correct, or delete personal information;
• receive a portable copy of information you provided;
• object to or restrict certain processing;
• withdraw consent where processing is based on consent;
• opt out of certain sharing or targeted advertising, if we ever engage in those activities;
• lodge a complaint with a competent supervisory authority, including the Hellenic Data Protection Authority. You may complain to an authority in the EU member state of your habitual residence, place of work, or the alleged infringement.

To exercise rights: email studio@a17project.com (or use the contact path at /privacy-contact) with enough context for us to understand your request. Please do not send passwords or payment details. We may need to verify your identity before responding.

Marketing: newsletter subscription is optional and separate from playtest contact consent. You can unsubscribe as described below or email us. Operational messages about an active playtest you joined are not marketing.

California / other US state laws: if applicable, you may have additional rights regarding access, deletion, correction, and opt-outs. We will not discriminate against you for exercising privacy rights.

10. Security

We use reasonable administrative, technical, and organizational measures appropriate to the nature of the data and our size as an independent studio. No method of transmission or storage is completely secure. Keep invitation and one-time email codes private and notify us of suspected unauthorized access. Launcher sign-in uses an email code rather than a password.

11. Changes to this Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and change the “Last updated” date. For material changes, we will provide additional notice when appropriate (for example by email if we have your address, or a notice on the site).

12. Contact us

Athanasios Bourantonis, trading as A17PROJECT, Greece (EU) and Sarasota, Florida, USA
Email: studio@a17project.com
Website: https://a17project.com

For privacy questions or requests, contact us at the email above or use the privacy contact page.

13. Newsletter

The newsletter form collects your email address and your explicit consent to studio updates. The database also stores subscription status, consent version, creation and update timestamps, and a personal unsubscribe token. The legal basis for newsletter updates is consent. Playtest applications do not subscribe you to the newsletter.

Use the newsletter unsubscribe page with the personal link/token provided for your subscription, or email studio@a17project.com. You may withdraw consent at any time without affecting earlier lawful processing.

We retain an active subscription until you unsubscribe or request deletion. Unsubscribing changes the stored status; it does not automatically erase the record. We retain the email, consent/status history and unsubscribe token only as needed to respect your preference and maintain consent records, and review removal when no longer needed. The current website stores and exports the subscriber list; it does not implement an automatic newsletter campaign sender.

14. Launcher accounts and approved downloadable builds

Where launcher access is enabled for an eligible invitation, the launcher opens the website’s account page. You sign in using a one-time email code. The verified email must match the permitted invitation. The consent page asks you to authorize the launcher to read invitation/build access and request downloads of approved builds. Signing in does not give unrestricted or public download access.

The code stores:

• Account and sign-in records — account/user identifiers, email address, an account name, email-verification state, and creation/update timestamps; sign-in session identifiers and tokens, expiry times, IP address and browser user agent where available; email-code verification identifiers, hashed code values and expiry times.
• Invitation linking — the invitation identifier, verified user identifier and time they were linked.
• Authorization consent — user and launcher-client identifiers, approved scopes/resources and requested identity claims, and consent creation/update times.
• Authorization/session records — token and session identifiers, linked user/client/resource/scope information, expiry, rotation and revocation records, and limited download-access grant identifiers tied to the authorized session.
• Abuse prevention — request/rate-limit keys, counts and timing/expiry records.

The protected download route checks the invitation, account/session, authorization and active approved build before serving the package from Cloudflare R2. It does not collect payment information, multiplayer activity or automatic in-game telemetry. The authentication library runs on our hosting infrastructure; it is not an additional hosted sign-in service.

We use this information to provide the requested invited access, record authorization, prevent abuse and provide support, relying on performance of the requested service and legitimate interests in security; optional communications rely on the separate consent described above. To withdraw access or request deletion, contact studio@a17project.com or the privacy contact page. Revoking launcher authorization or an invitation stops the related access; it does not automatically erase all account or consent records.