Privacy policy

Who we are

Mop & Loot is run by NumbSquirrel, who is responsible for your data. Contact: support@mopandloot.com.

What we collect

• Guest play. When you press Play without signing in, we create a guest account with a random ID and a name like "Guest 1234". It contains no personal details.
• Sign-in with Discord or Google. We receive your account ID with that service, your display name and your avatar picture. We do not receive your email address or your password.
• Game data. Your items, coins, tools and orders from the in-game shop, the layout of your house, and the results of your cleaning jobs (how clean, how long, how much each tool was used).
• Technical data. Our server keeps technical logs with IP addresses, time and the requested page, for security and troubleshooting. IP addresses are also used, in memory only, to limit how many guest accounts can be created.

Cookies and browser storage

We use only cookies that the game needs: sid keeps you signed in (30 days) and oauth_state protects the sign-in step (10 minutes). The game also keeps your settings and an unfinished cleaning job in your browser's local storage. There are no advertising or tracking cookies.

Visit statistics

We count visits with Cloudflare Web Analytics. It uses no cookies, does not build a profile of you and does not follow you across other websites. We see totals such as page views, countries and referring sites.

Services we use

• Hetzner Online GmbH hosts our server in Germany.
• Discord and Google handle sign-in; their own privacy policies apply on their sign-in pages.
• Cloudflare provides the visit statistics.
• Google Fonts serves the pixel font, so Google sees your IP address when your browser loads it.
• Porkbun, our domain registrar, forwards email sent to support@mopandloot.com.

Discord, Google and Cloudflare are based in the United States, so some data may be processed there.

Why we use it

To run your account and the game you asked to play, and to keep the service secure and free of abuse. Under the GDPR these are the performance of a contract and our legitimate interests.

How long we keep it

Guest accounts that never sign in are deleted 30 days after they were created. Signed-in accounts are kept until you ask us to delete them. Technical logs are kept only as long as needed for security and troubleshooting.

Your rights

You can ask for a copy of your data, a correction, or deletion of your account and everything in it. Write to support@mopandloot.com and we will answer within 30 days. If you live in the EU or the UK you can also complain to your data protection authority.

Children

Signing in with Discord or Google requires meeting their minimum age. We do not knowingly collect personal data from children under 13, or under the minimum age for this in their country.

Changes

When this policy changes, we update this page and the date at the top.