1. Data controller and contact
Fredborg Interactive, c/o Kenneth Fredborg, Guldæble Have 5, 5210 Odense NV, Denmark, is the data controller for this service. Contact us at kontakt@fredborg-interactive.com.
2. Data we process
We process your email address, password hash, detective name, account and email-verification records, login-session information (including time zone, browser locale, and country code when supplied by the hosting request), case progress, messages sent to other detectives, interview messages, and limited game-use events. If you use AI features, we process the question or argument you submit and the resulting game reply. The public Demo can be played without an account. For that Demo, we use a random technical identifier to resume the Demo, apply the browser-based play limit, and prevent abuse; it is not an account identity and we do not store a raw IP address for that identifier.
3. Why we use the data
We use account and game data to create and secure your account, provide and synchronise gameplay, deliver verification and password-reset emails, prevent misuse, maintain the service, and respond to support requests. The usual legal bases are performance of our contract with you, our legitimate interests in security and operation, and legal obligations where applicable. We ask for consent only where consent is the appropriate legal basis.
If you opt in to the Locke & Graves newsletter, we use your account email address to tell you about new cases and other Locke & Graves news. The legal basis is your optional consent. We store your newsletter preference and the time, notice version, and source of your latest choice with your account. Newsletter consent is separate from accepting the account notices and from cookie or advertising consent.
Newsletter delivery uses our configured Simply email service. We record delivery status and a message reference, and keep a hashed unsubscribe token so links in earlier emails continue to work. No advertising tracking pixel is included. You can unsubscribe from the email link without signing in, or change your preference in your profile. Deleting your account removes its tokens and disconnects delivery records from your account.
4. Recipients and international transfers
We use hosting/database providers, a configured SMTP email provider, and OpenRouter to deliver the selected DeepSeek AI model. OpenRouter may use model-provider infrastructure to process an AI request. Processing may occur outside the EEA, UK, or United States depending on the provider route; where required, we use an appropriate transfer mechanism and safeguards. If you separately accept marketing tracking, we share limited browsing and purchase events with Meta Platforms Ireland Limited for advertising measurement and personalised advertising on Facebook and Instagram. These events may include case/product identifiers, the purchase amount and currency, marketing cookie identifiers, IP address, browser information, and your email address transformed with SHA-256 for purchase matching. A hashed email can still be matched to you; it is not anonymous. We do not send game conversations, detective names, passwords or payment-card details to Meta. The legal basis is your optional consent, not your acceptance of the account notices. Meta may process data outside the EEA, including in the United States, under the safeguards described in its Business Tools Terms, Data Processing Terms and Privacy Policy. Meta's own processing, retention and your choices are explained there.
5. Retention and account deletion
We keep account and case records while your account is active and for as long as needed for security, dispute handling, or legal obligations. You can permanently delete your account from Your Profile. Deletion removes account credentials and direct account identity, including your email, password hash, case access, and other active account records. A new account registered with the same email is not linked back to the deleted research record.
We may retain de-identified gameplay history, questionnaire responses, and AI or game conversations for product improvement, quality assurance, debugging, and understanding how Locke & Graves is used. We remove account links and display names where technically possible. However, free-text content is not automatically anonymous merely because account identifiers have been removed: it may still contain personal data that a player chose to enter. Where retained free text still constitutes personal data, applicable GDPR and other data-protection rights continue to apply. The legal basis for that limited retention is Fredborg Interactive’s legitimate interests in improving, securing, and evaluating the game, subject to the required balancing of those interests against your rights and freedoms. Contact kontakt@fredborg-interactive.com about retained personal data or to exercise an applicable right.
Demo gameplay and optional experience feedback may be retained for product improvement, debugging, and evaluation. An optional free-text comment can contain information you choose to supply, so please do not include sensitive or personal information.
Retained free-text gameplay conversations and questionnaire responses that may still constitute personal data are kept for up to 24 months after account deletion, after which the retained free-text record is deleted or irreversibly anonymised unless a longer period is required for a specific legal obligation or dispute. Truly anonymous aggregate statistics may be retained longer because they no longer identify a person. This retention rule is documented for our future cleanup process; it does not claim that an automated purge runs today.
Cookie/Meta marketing choices are stored for 180 days. A checkout records the choice and its version at checkout time; withdrawing it prevents unsent purchases from being shared. Purchase-matching data is cleared after successful delivery or withdrawal. Unfinished checkout data expires after two days, and failed purchase deliveries expire after 47 hours; expired data is removed on the next cleanup request. Minimal delivery and choice records expire after 180 days. Account deletion removes linked marketing checkout records. Our private recovery backups can temporarily retain older records under our release-backup retention process.
6. Your rights
Depending on applicable law, you may request access, correction, deletion, restriction, objection, portability, or withdrawal of consent. You may also complain to the Danish Data Protection Agency or your local data-protection authority. California residents may have rights to know, delete, correct, and limit certain uses of personal information; contact us to exercise an applicable right.
You can join or leave the newsletter at any time by changing the newsletter checkbox in your profile and saving your preference. Declining or withdrawing newsletter consent does not affect your account, purchases, or gameplay. We keep your preference and latest consent details while your account exists; deleting your account removes them. We only use current newsletter subscriptions for verified email addresses.
Use to reject or withdraw marketing consent on this browser. Refusing does not affect access to the game or purchases. Withdrawal stops future sharing and does not undo processing already carried out; contact us for requests about data already shared, and use Meta's privacy controls for its processing.
7. Children
The service is not intended for anyone under 15. If you believe a child under 15 has provided personal data, contact us so we can investigate and delete it where appropriate.