Your data is yours.

What this covers

Kerrberry Systems LLC, based in the United States, runs two things:

• The consultancy site at kerrberry.com: informational pages, blog posts, and a contact form.
• Double Skunk online services at doubleskunk.kerrberry.com: the game site plus the backend that powers leaderboards, weekly challenges, and ranked play in the Double Skunk game on Steam.

This policy covers kerrberry.com and all of its subdomains, including doubleskunk.kerrberry.com. If you only ever visit the consulting site, the game sections do not apply to you.

Questions about the consulting site go to hello@kerrberry.com. Questions about Double Skunk go to doubleskunk@kerrberry.com, the same address shown inside the game.

What we collect

Contact form (consulting)

When you fill out the form at /contact, we record:

• Your name and email (required).
• Optional fields you choose to fill in: company, project type, description, budget range.
• An internal status and notes that our team uses to track your inquiry.

Double Skunk: what the game sends

Everything online in Double Skunk is opt-in. If you never open the Online Hub, or you decline the stats-sharing prompt, the game sends nothing to our server. The full game is playable with zero data leaving your device, and solo campaign saves stay on your machine. Online match play itself also does not touch our server: card moves travel peer to peer over Steam's networking. Only the submissions below reach our infrastructure, and only after you opt in:

• A Steam session ticket when the game signs in, along with the game version. The ticket is an opaque Steam credential; we validate it and do not store it.
• Ranked match results: pegs scored, turns played, win or loss, final scores on both sides, how the match ended, its duration, the game version that submitted it, and the Steam ID of the player you faced. A submission therefore carries your opponent's Steam ID as well as your own identity. Your rating before and after the match is stored with each result.
• Weekly challenge scores: which challenge and week you played, the seed and rules version that define that week's fixed match, your score, your total pegs, how many hands you played, and the game version that submitted it. The server also records when you submitted and how many tries you used.
• Leaderboard requests: when the game centers the leaderboard on your own entry, the request includes your own Steam ID.

Requests from the game also carry the game engine's default identifier, which names the engine version and your operating system, for example "GodotEngine/4.6 (macOS)". It ends up in the request records described under operational logs below.

Double Skunk: what our server derives from Steam

The game never sends these directly. Our server works them out from Steam when you sign in:

• Your Steam ID, derived by validating your session ticket with Steam's Partner API. It is a pseudonymous identifier: it names your Steam account, not you.
• Your Steam display name, pulled from Steam's Partner API and refreshed each session. You control it on Steam's side, and it is what appears on the leaderboard.
• Your rating, which we compute from your match results.

Playtest signups

If you sign up for the Double Skunk playtest on the website, we record your email address, your browser's user agent, and a scrambled fingerprint of your IP address that cannot be turned back into the address, used only to catch duplicate signups. We keep signups until the playtest program ends or you ask us to remove yours.

Operational logs

Our servers receive a small number of operational signals:

• Your IP address is visible to our server while you are connected, as it is to any website you visit. We use it only for abuse prevention. Mostly that means rate limiting: counters that cap how often a single connection can hit the server, held in memory and gone within hours. Where this page mentions a scrambled or rotating form of your IP, those exist for the same reason, and none of them can be turned back into your address. We do not store the address itself and we do not use it to identify you.
• Request records (route, status code, response time, browser user agent) kept for 90 days for performance monitoring and then deleted. Each record carries a rotating identifier derived from your IP rather than the address itself. The identifier changes daily, so records from different days cannot be linked together or back to you.
• Page visit records for the Double Skunk site (page, referring site, campaign tags, browser user agent), with no IP address attached, kept for 90 days.
• Security audit records: when an account-level event happens (today that means deleting your online data, or two reports of the same match disagreeing), the server writes a record of it that includes your Steam ID. Kept for 90 days.

What stays on your device

Two of these hold another player's identifier on your own disk, which is why they get a mention:

• A queue of match submissions that have not been delivered yet, each including your opponent's Steam ID. Capped at 50 entries and 14 days, and wiped if you opt out of online stats or delete your online data.
• A resume snapshot for your current online match, holding the other player's Steam ID and Steam name so a crashed match can be rejoined. It expires after 7 days.
• A short local diagnostic log of your own submissions, containing your own Steam ID. It never leaves your machine.

Solo campaign saves, settings, and progress are local files and are never uploaded.

What goes to Steam, not to us

When you host an online lobby, your Steam name is written into Steam lobby metadata and Steam Rich Presence. That is how other Steam players see who is hosting. It is a disclosure to Valve and to other players, not to Kerrberry, and it is governed by Steam's privacy policy.

Crash reports

The game ships with a crash reporting library (Sentry). It is off by default and sends nothing unless you turn it on, under Settings, in the Profile pane, as "Crash reports". Your consent is what allows a report to be sent, and a report only ever comes from an installed release build, never from the editor or a test run. If you turn the setting back off, any queued and future reports are dropped.

When you have it on, a crash report contains a stack trace, a short trail of the screens you moved through before the crash, the context of the run that crashed (the seed, the board index, your Long Tally position, and the names of any powerups in play), the release version, and the game's log file.

A crash report carries no account identifier. We keep the client IP address and your operating-system username out of it, we do not attach a screenshot, and your Steam ID is stripped from the log file, along with any absolute file path that holds your account name, any private-lobby join code, and any hand-edited server address. A test in the game's source scans for these, so a new identifier cannot slip in unnoticed. Sentry also has IP-address storage turned off at the project level, so its ingest does not keep the address a report was sent from.

How we use it

Briefly: we use the data to do what you came here to do.

• Contact form submissions are used to reply to your inquiry and to track our pipeline. We do not add you to any marketing list.
• Double Skunk identity and match data is used to authenticate your client, record your match and challenge results, compute your rating, and display leaderboards. That is what the online features are.
• IP addresses are used for abuse prevention: rate limiting, and spotting repeat abuse through the hashed values described above.
• Crash reports, for players who turn them on, are used for debugging and nothing else.

No advertising, no data brokers, no resale, no profiling, and no automated decision-making beyond computing a rating from match results.

Who else sees it

Short list. The fewer hands data passes through, the less can go wrong with it.

• Steam (Valve Corporation), for Double Skunk only. The game uses Steam's Partner API to validate that your authentication ticket is genuine; that call sends Steam our publisher key and the ticket and gets back your Steam ID and display name. See Steam's privacy policy.
• Our hosting provider (Fly.io) operates the infrastructure everything runs on. Like any host, they can see the traffic that reaches their servers, including your IP address, and they keep their own logs independently of our application, under Fly.io's privacy policy.
• Sentry receives a crash report only when a player has turned crash reporting on and the game crashes. IP-address storage is disabled at the Sentry project level, so its ingest does not retain the sender's IP address.
• No advertisers, no analytics resellers, no third-party trackers. The site does not embed Google Analytics, Facebook Pixel, or similar.

Your rights

You can see what we have on you, and you can make us delete it. Concretely:

Right to erasure

For Double Skunk, erasure is self-serve inside the game: open Settings, then Saves & Data, then "Delete my online data." That action calls DELETE /api/v1/ds/profiles/<your-steam-id> and immediately soft-deletes your player record, anonymizes your match history (the matches themselves stay, so your opponents' stats remain correct), hard-deletes your rating history and challenge scores, and signs out your active session. You will no longer appear in any leaderboard. The deletion itself leaves one audit record holding your Steam ID and the display name your account had at that moment, so we can show the erasure happened; it is removed after 90 days like every other audit record.

For contact form data, email hello@kerrberry.com from the address you used and ask us to delete your submission. We will.

Right to access

Email the address for the surface you used (doubleskunk@kerrberry.com for the game, hello@kerrberry.com for consulting) and we will send back what we hold within a reasonable window, usually a few business days. Your Double Skunk profile is also available at GET doubleskunk.kerrberry.com/api/v1/ds/profiles/<your-steam-id> and is publicly readable by anyone who knows your Steam ID.

Everything else

Correction, objection, and any other request: email the same addresses. If you are in the UK or EU and think we have handled your data badly, you also have the right to complain to your local data protection authority (in the UK, the ICO).

How long we keep things

• Contact form submissions stay until your project closes or you ask us to delete them.
• Playtest signups stay until the playtest program ends or you ask us to remove yours.
• Double Skunk player records are kept for the life of your account or until you delete them. Match records are kept so that stats stay consistent, with your side anonymized if you delete your data.
• Your rating history is kept for 90 days, then pruned automatically.
• Weekly challenge scores are kept for the life of your account and deleted when you delete your online data.
• Security audit records are kept for 90 days, then pruned automatically.
• Request records and Double Skunk page visit records are kept for 90 days, then pruned automatically.
• Sign-in session records are deleted 90 days after the session expires. The sessions themselves last 24 hours.

Cookies and tracking

In normal browsing we set one cookie: an encrypted Phoenix session cookie. It does two jobs. It keeps admins logged in to the back-office, and it carries a copy of your IP address that our interactive pages read for the rate limiting described above. The cookie is encrypted so nobody else can read what is in it, it expires after 7 days, and we do not use it to track you.

One additional, opt-in cookie (request_logger) is set only when an authenticated admin activates the LiveDashboard's request-logging feature. Regular visitors never receive this cookie. We do not use tracking cookies or third-party advertising pixels.

Legal basis and cross-border data

Kerrberry Systems LLC is based in the United States, and data is processed on infrastructure that may be outside the UK and the European Economic Area.

If UK or EU data protection law applies to you, our legal bases are: your consent for the contact form, for playtest signups, for Double Skunk online stats sharing (opt-in in the game), and for crash reports when you turn them on (also an in-game toggle); and our legitimate interest in running the service securely for rate limiting and the operational logs above. The right-of-erasure controls above satisfy GDPR Article 17 and UK GDPR equivalents.

Children

Double Skunk is not directed at children under 13, and the consulting site is not either. Online identity in the game comes from Steam, and Steam's own terms govern who can hold a Steam account.

Changes to this policy

If we make a material change to this policy, we will post it here and update the date at the top of the page.