1. Scope and who we are
Knock on Wood Studios (“Knock on Wood,” “we,” “us,” or “our”) creates games, stories, films, experiments, and related studio services. This Privacy Policy applies to knockonwood.studio, the studio arcade, and games or services we operate that link to this policy (together, the “Services”).
It does not govern a third-party service that we merely link to or content operated by someone else. Those services have their own privacy practices.
Some features described below are still being designed. We identify planned features so you can understand our intended direction without suggesting they are already available.
2. Information we collect
The information we collect depends on how you use the Services.
| Category | Examples | Status |
|---|---|---|
| Studio updates | Email address, marketing consent, signup status, source page, form version, and timestamps. | Current |
| Profile and contact details | Name, email address, display name, preferences, and—only when useful for age-appropriate experiences—an age range or age-assurance result. Earlier signup versions may also contain optional demographic or interest responses a visitor chose to provide. | Limited now · planned |
| Arcade Pass and account records | Account identifier, authentication and security events, game progress, achievements, entitlements, credit balance, rewards, and transaction history. | Planned |
| Payment and purchase records | Purchase, amount, currency, date, status, refunds, payment-provider identifiers, billing details, and limited payment-method details such as card brand and last four digits. The payment processor—not Knock on Wood—will collect full payment credentials. | Planned |
| Website and device data | IP address, browser and device type, operating system, language, approximate location derived from IP, referring page, pages or features used, timestamps, performance, and security logs. | Current · expanding |
| Gameplay and diagnostics | Game and version, session time and duration, scores, progress, achievements, gameplay events and choices, crashes, performance, and abuse-prevention signals. Some of this stays only on your device today; server-side gameplay measurement is planned. | Local now · planned |
| AI-assisted processing records | Prompts or task instructions, the limited information supplied to an AI tool, generated or transformed output, and operational metadata about that use. The source information may come from another category in this table, such as feedback, communications, technical logs, or aggregated website and gameplay data. | Current · evolving |
| Communications | Messages, feedback, support requests, and any information you include when you contact us. | When provided |
Where it comes from
We collect information directly from you, automatically from your browser or device, from games you play, and from service providers that help operate the Services. A future payment provider may send us confirmation and transaction details after handling a payment.
The current studio-update record in our database does not include your IP address or user-agent string. Cloudflare may process network identifiers and request headers to deliver and protect the site and to produce aggregated request, visit, hostname, path, and time-based traffic estimates. Our studio dashboard does not receive or store raw visitor IP addresses from that analytics report.
3. How we use information
We use personal information to:
- provide, maintain, troubleshoot, and improve the Services;
- send studio updates you asked to receive and manage unsubscribes;
- respond to questions, feedback, pitches, and support requests;
- create and secure accounts when Arcade Pass launches;
- save progress, operate game features, and connect achievements or entitlements across participating games;
- process purchases, refunds, accounting, and fraud checks when payments launch;
- understand website and gameplay performance, popularity, difficulty, reliability, and how people move through an experience;
- detect, investigate, and prevent fraud, abuse, security incidents, and violations of our terms;
- comply with law, enforce agreements, and protect our rights and the safety of others; and
- create aggregated or de-identified insights that no longer reasonably identify a person.
We do not use an email collected for studio updates to create an Arcade Pass without telling you what is changing and obtaining any consent required by law.
Legal bases for EEA and UK visitors
Where European or UK data-protection law applies, we rely on one or more legal bases: your consent (for example, marketing); performance of a contract or steps you ask us to take; our legitimate interests in operating, securing, measuring, and improving the Services when those interests are not overridden by your rights; and compliance with legal obligations. You may withdraw consent at any time, without affecting earlier processing.
4. AI-assisted operations
We use or may use AI-enabled tools to support studio operations. This can include assisting with software development and quality checks, organizing feedback, summarizing or drafting communications, analyzing aggregate website or gameplay trends, and supporting fraud, abuse, or security review.
Information AI tools may process
Depending on the task, an AI provider may receive limited portions of information described elsewhere in this policy. Examples include communications or feedback you send us; support and account details needed to answer a request; website, gameplay, diagnostic, or security data; and creative material you intentionally submit for us to review. An AI-assisted workflow may create prompts, summaries, classifications, suggested responses, code or quality-review artifacts, and inferred aggregate trends.
We do not intentionally submit passwords, authentication secrets, or full payment-card details to general-purpose AI tools. We also do not currently use personal information collected through the Services to train our own general-purpose AI model.
How we manage AI-related data risk
When personal information is involved, we aim to provide only what is reasonably necessary, remove or aggregate identifying details where practical, limit internal access, and keep a person accountable for the result. When selecting AI providers, we assess their privacy and security terms and, where available, use business or API settings that restrict the provider from using our data to train shared or publicly available models.
We will not intentionally authorize a provider to use personal information from the Services to train a shared or publicly available model unless we first clearly explain that use and obtain consent where required. AI outputs can be incomplete, inaccurate, or biased, so we do not treat an output as the sole authoritative record about a person.
We do not currently use AI to make decisions about you that produce legal or similarly significant effects without meaningful human involvement. If we introduce a user-facing AI feature, use AI to personalize an experience in a material way, or materially change the purposes above, we will provide an appropriate notice before that processing begins and offer any choices required by law.
6. Payments
When paid Arcade Pass features are ready, we expect to use Stripe or an equivalent payment service. Checkout will be handled by the selected provider, which will collect and process payment credentials under its own privacy policy. We do not intend to store full card numbers or card security codes.
We may receive and retain the information needed to confirm and support a purchase, such as your name, billing contact details, provider customer and transaction identifiers, purchase amount, currency, status, refunds, and limited payment-method details. We will identify and link to the selected provider before accepting payments.
7. Cookies and local storage
The public website does not currently load analytics pixels or analytics SDKs, and we do not add advertising or analytics cookies. We use Cloudflare's infrastructure-level, server-side traffic reporting instead. Our password-protected administrative dashboard uses an essential, secure session cookie that expires after up to 12 hours. Public visitors do not receive that dashboard cookie.
Games and site features may use browser local storage or session storage to remember high scores, an unfinished run, preferences, guest or session identifiers, or similar state. That information stays on your device unless a feature clearly sends it to us. You can remove it using your browser controls, although doing so may erase saved progress or preferences.
If we later add client-side analytics or other non-essential technologies that use cookies, local storage, pixels, or similar tools, we will update this notice. Where law requires consent, we will ask before using them and provide a way to change your choice.
8. Retention and security
How long we keep information
We keep personal information only as long as reasonably necessary for the purpose described in this policy, including to provide the Services, meet legal and accounting obligations, resolve disputes, and prevent abuse. The period depends on the type of record:
- studio-update records are kept while you remain subscribed; after you unsubscribe, we may keep the minimum record needed to honor that choice;
- communications are kept as long as needed to respond and maintain an appropriate business record;
- future account and gameplay records will generally be kept while an account is active and for a reasonable period afterward, unless you request deletion or law requires longer retention;
- payment, tax, fraud, and transaction records will be kept for periods required by applicable law and legitimate accounting or security needs;
- AI prompts and outputs that contain personal information follow the retention needs of the underlying operational task; we aim to use configurable provider retention and delete or de-identify the record when it is no longer needed;
- technical, analytics, and security logs are kept for the shortest practical period consistent with measurement, reliability, and safety, then deleted, aggregated, or de-identified where feasible; and
- information stored only in your browser remains until it expires or you clear it.
Backups may retain information for a limited additional period before they are overwritten. We will publish more specific retention periods when planned account, payment, and gameplay-measurement systems are selected.
How we protect information
We use administrative, technical, and organizational safeguards appropriate to the nature of the information. Current signup data is stored in Cloudflare D1 and accessed through a password-protected dashboard with secure session controls. No method of storage or transmission is completely secure, so we cannot guarantee absolute security.
9. Children’s privacy
The Services are intended for a general audience and are not directed specifically to children under 13. Studio email updates are for people age 13 and older. We do not knowingly collect personal information from a child under 13 without the notice and verifiable parental consent required by law.
Before launching Arcade Pass or persistent gameplay profiles, we plan to use an age range or another proportionate age-assurance method where needed to provide age-appropriate protections. If a user is below the age at which they may consent on their own, we will limit collection, obtain parental authorization where required, or decline to create the account.
We do not knowingly use personal information from a child under 13 to train a general-purpose AI model. If you believe a child provided personal information to us in a way that is not permitted, contact us at hello@knockonwood.studio so we can investigate and delete it as appropriate.
10. Your choices and privacy rights
You can unsubscribe from studio updates through the link in an email or by contacting us. Depending on where you live and subject to legal exceptions, you may also have the right to:
- know whether we process your personal information and access or receive a copy of it;
- correct inaccurate information;
- delete information;
- restrict or object to certain processing;
- receive portable information you provided to us;
- withdraw consent;
- opt out of a sale, targeted advertising, certain sharing, or certain profiling if we ever engage in those practices; and
- appeal a decision on a privacy request and receive equal service for exercising your rights.
To make a request, email hello@knockonwood.studio with the subject “Privacy request.” Tell us what you are requesting and how we can identify the relevant record. We may need to verify your identity before acting. An authorized agent may submit a request where applicable law permits it, but we may ask for proof of authority and verification from you.
If European or UK data-protection law applies, you may also lodge a complaint with the supervisory authority where you live or work. We would appreciate the chance to address your concern first.
We honor legally required browser-based privacy preference signals when applicable. Because we do not currently sell personal information or use cross-context behavioral advertising, there is no sale or advertising opt-out needed today.
11. International transfers
We and our service providers may process information in the United States and other countries, which may have different data-protection laws from where you live. Where required, we will use recognized transfer safeguards, such as contractual protections, and provide additional information on request.
12. Changes and contact
We may update this policy as the studio and Services change. We will post the updated version here and change the “Last updated” date. If a change materially affects how we use personal information, we will provide additional notice or request consent when required.
Questions, requests, or concerns can be sent to:
Knock on Wood Studioshello@knockonwood.studio