Rules & policies

This notice explains what Cool Monkey Studios ("we", "us") stores about you when you play Underground Evolution at https://underground-evolution.com, why we store it, who else sees it, how long we keep it, and the rights you have.

Who we are

Cool Monkey Studios is the controller of your personal data: company number 15481762, registered in England and Wales, registered office 30b Wilds Rents, London, SE14QG, United Kingdom. Cool Monkey Studios is registered with the UK Information Commissioner's Office (ICO) under registration number ZC282025.

Our representative in the European Union, for players there (GDPR art. 27): Rickert Rechtsanwaltsgesellschaft mbH, Colmantstraße 15, 53115 Bonn, Germany ([email protected]).

Questions about your data: [email protected], or the contact page.

What we collect

When you sign up: your username, email address, password, date of birth and country. The password is stored only as a one-way hash that nobody, including us, can read back. Your date of birth and country are stored encrypted. We also note when you joined and the language you play in.

If you choose: a backup email address and your own recovery question, to help you get back in if you lose your phone. The question is stored encrypted and the answer only as a one-way hash that nobody can read back. We use them only to recover your account, never for news or offers.

When you play: what your character does and owns: stats, money, items, property, gang, fights, crimes, trades and purchases with game money. This is the game itself.

What you write: mail, your profile, gang pages, newspaper articles and classified ads, and messages to staff. What you post in public places can be seen by other players. Staff read private mail only when it is reported to them or to investigate a breach of the rules.

Keeping accounts safe: your IP address, sign-in times, browser type, a random device id kept in a cookie, and the timing of your game actions. We use these to protect your account, to stop cheating and bots, and to enforce bans.

Purchases: what you bought, when, the amount, the order reference, your agreement to immediate delivery (when you gave it and the exact wording you saw), and any refund request you send us (the reason and what you wrote). Payments are handled by PayPal; we never see your full card or bank details.

When you contact us: your name, email address and what you wrote.

Why we use it

What	Why	Legal basis
Account details	To create and run your account	Contract
Date of birth and country	To check that players are 18 or over, to suggest your language, and for statistics that only count players by country and age group (they never name anyone)	Contract; legitimate interests
Backup email and recovery question	To help you get back into your account if you lose your phone, and to warn you of attempts to recover it	Consent (you add them and can remove them at any time)
Your play and what you write	To run the game, show it to other players where the game does, and enforce the rules	Contract; legitimate interests
Addresses, devices and action timing	To keep accounts safe and the game fair	Legitimate interests
Purchases	To deliver what you bought, and for accounts and tax	Contract; legal obligation
Messages to us	To answer you	Legitimate interests

We don't use advertising trackers, we don't build marketing profiles, and we never sell your data. Analytics, only if you agree: we use Google Analytics on the public website (home page, news, website pages and sign-up) to count visits and see which pages are read. It records the pages you visit, your browser and type of device, your rough location (country or city, worked out from your IP address, which Google doesn't keep) and how you found us. Google Ireland Limited does this for us; the data may go to the United States under the safeguards the law requires (the EU-US Data Privacy Framework and its UK extension). Analytics data is kept for [14 months]. The cookie banner is run by Cookiebot (Usercentrics A/S, Denmark), which keeps a record of your choice. The legal basis is your consent, which you can withdraw at any time on the Cookies page. Apart from that, we only use the cookies the site needs to work.

Your date of birth and country are used only for the purposes above. They are never shown to other players, never used for advertising or to set prices, and never passed to payment providers. Statistics made from them only count players, and small groups are left out so that nobody can be picked out.

Who else sees it

• Other players: your username, profile, character and anything you post in public.
• Our staff: only staff with a specific permission can see your date of birth and country, and every time they do it is logged. Other players never see them.
• Payment providers: PayPal, for payments.
• Our hosting provider: IONOS, with servers in United Kingdom.
• Cloudflare, which protects the site and keeps it fast: every visit passes through its network, and on sign-up and a few other forms it checks that a person, not a program, is using the browser (Cloudflare Turnstile). It sees your IP address and browser details, never your account or what you play.
• Email delivery, for the emails the game sends you.
• Top sites you vote on, when you use Vote for us: we send the site a random code (never your name or email), and the site sends us back the IP address you voted from, which we keep for a limited time and then delete.
• Our help desk's service provider, if you use the Consigliere: the Consigliere is an automated assistant, not a person. What you write to it, with the name of the page you were on and a few facts about your character (such as your level and district), is sent to an outside service provider that processes it only to answer you. It never receives your password, email address or payment details, and a picture you attach to a bug report goes only to our staff.
• Your browser's maker, if you use the Consigliere's microphone button: the button uses your browser's own speech recognition, which in some browsers (Chrome) sends the audio to the browser's maker (Google) to turn it into text; the game only ever receives the text, never the sound.
• The authorities, only when the law requires it.

If any of these process your data outside the UK, we make sure it is protected by the safeguards the law requires.

How long we keep it

What	How long
Your account and play	While your account exists. If you ask us to erase your data, your account is anonymised: your name, email, profile and what you wrote are removed, and what is left (numbers in the game's records) no longer identifies you.
An account nobody signs in to	After 380 days without signing in it goes to sleep (dormant): other players no longer see it, nothing is deleted, and signing in wakes it. We email you 15 days before. If it never bought anything and stays asleep for 3 years, we email you 30 days before and then anonymise it as above; its username stays reserved for 90 days. Accounts with a purchase are never anonymised automatically.
Your choice about reminder emails	While your account exists, with the date you said yes or no
Date of birth and country	While your account exists; deleted, not just anonymised, if you ask us to erase your data
Backup email and recovery question	Until you remove them, at most while your account exists; deleted if you ask us to erase your data
A sign-up we couldn't accept	Nothing about the person, only a count per day
Reports that an account may belong to a minor	365 days after the report is closed; what a reporter wrote is removed if the reporter asks us to erase their data
Sign-in records	The IP address and browser are removed after 12 months
Bot detection	Action timings are kept for 90 days
Money history	Kept in full for 13 months, then summarised
Purchases, agreements to immediate delivery and refund requests	6 years, as UK tax law requires; what you wrote in a refund request is removed if you ask us to erase your data
Which version of our terms and notices you accepted, and when	While your account exists, as a record of what we agreed; if your account is anonymised, the record no longer identifies you
Copies of your data you download	7 days

Your rights

• A copy of your data: download it any time from Account → Privacy → Your data. It comes as files you can open or move to another service, and it includes your date of birth and country.
• Correction: change your email and profile yourself, or ask us. Your date of birth and country can't be changed in the game: if they are wrong, ask us and staff correct them (each correction is logged).
• Erasure: ask us to erase your personal data, or close your account yourself in Account → Privacy → Close my account. It closes 14 days later (signing in before then cancels it) and is then anonymised as above; records of purchases are kept as the law requires.
• Objection and restriction: you can object to how we use your data, or ask us to limit it.

Write to [email protected] or use the contact page. We answer within one month. If you are unhappy with our answer, you can complain to the Information Commissioner's Office (ico.org.uk).

Children

Underground Evolution is for adults only: you must be 18 or over to play or buy. If we learn that an account belongs to someone younger, we close it, refund what was bought on it and erase its data. To tell us about such an account, use Report on the player's profile or on a message, or the contact page.

Keeping it safe

Connections are encrypted, passwords are hashed, staff sign in with two-factor authentication, and staff access to player data is logged.

Changes to this notice

When something important changes, we update this page, show what changed and tell you in the game the next time you play.