Your data is yours.

What this covers

Kerrberry Systems LLC, based in the United States, runs two things:

• The consultancy site at kerrberry.com: informational pages, blog posts, and a contact form.
• Double Skunk online services at doubleskunk.kerrberry.com: the game site plus the backend that powers leaderboards, weekly challenges, and ranked play in the Double Skunk game on Steam.

This policy covers kerrberry.com and all of its subdomains, including doubleskunk.kerrberry.com. If you only ever visit the consulting site, the game sections do not apply to you.

Questions about the consulting site go to hello@kerrberry.com. Questions about Double Skunk go to doubleskunk@kerrberry.com, the same address shown inside the game.

What we collect

Contact form (consulting)

When you fill out the form at /contact, we record:

• Your name and email (required).
• Optional fields you choose to fill in: company, project type, description, budget range.
• An internal status and notes that our team uses to track your inquiry.

Double Skunk: what the game sends

Everything online in Double Skunk is opt-in. If you never open the Online Hub, or you decline the stats-sharing prompt, the game sends nothing to our server. The full game is playable with zero data leaving your device, and solo campaign saves stay on your machine. Online match play itself also does not touch our server: card moves travel peer to peer over Steam's networking. Only the submissions below reach our infrastructure, and only after you opt in:

• A Steam session ticket when the game signs in, along with the game version. The ticket is an opaque Steam credential; we validate it and do not store it.
• Ranked match results: pegs scored, turns played, win or loss, final scores on both sides, how the match ended, the match type and how many games it was a best of, its duration, the game version that submitted it, and the Steam ID of the player you faced. A submission therefore carries your opponent's Steam ID as well as your own identity. Your rating before and after the match is stored with each result.
• Weekly challenge scores: which challenge and week you played, the seed and rules version that define that week's fixed match, your score, your total pegs, how many hands you played, and the game version that submitted it. The server also records when you submitted and how many tries you used.
• Leaderboard requests: when the game centers the leaderboard on your own entry, the request includes your own Steam ID.

Requests from the game also carry the game engine's default identifier, which names the engine version and your operating system, for example "GodotEngine/4.6 (macOS)". It ends up in the request records described under operational logs below.

Double Skunk: what our server derives from Steam

The game never sends these directly. Our server works them out from Steam when you sign in:

• Your Steam ID, derived by validating your session ticket with Steam's Partner API. It is a pseudonymous identifier: it names your Steam account, not you.
• Your Steam display name, pulled from Steam's Partner API and refreshed each session. You control it on Steam's side, and it is what appears on the leaderboard.
• Your rating, which we compute from your match results.

Playtest signups

If you sign up for the Double Skunk playtest on the website, we record your email address, your browser's user agent, and a scrambled fingerprint of your IP address that cannot be turned back into the address, used only to catch duplicate signups. We keep signups until the playtest program ends or you ask us to remove yours.

In-game feedback

Double Skunk has a "Send feedback" form, in both the demo and the full game. Sending it is the opt-in: nothing goes anywhere until you press send. A submission carries exactly what the form shows: your message, an optional contact line if you would like a reply (an email address, a Discord handle, whatever you type), and the game version, platform, language, which screen you sent it from, and whether it came from the demo or the full game, so we can make sense of the report. You do not need to be signed in, and the message is not linked to your Steam account. Each submission also carries a scrambled fingerprint of your IP address, of the same kind described under playtest signups, used only to keep one address from flooding the form; it is removed automatically after 90 days.

Player name reports

Double Skunk shows other players' names on its leaderboards and in online play, so the game lets you report a name. Nothing is sent until you send the report. A report carries your Steam ID, the Steam ID of the player you reported, their name as you saw it, the reason you picked, an optional note, and the game version, platform, language and screen it was sent from. A person reads every report. If a name breaks the rules, we hide it from other players. We keep a list of the Steam IDs whose names are hidden, and the game downloads that list so it can hide those names wherever it shows them. The list holds no names.

Operational logs

Our servers receive a small number of operational signals:

• Your IP address is visible to our server while you are connected, as it is to any website you visit. We use it for two things. The main one is abuse prevention, which mostly means rate limiting: counters that cap how often a single connection can hit the server, held in memory and gone within hours. The scrambled fingerprints mentioned under playtest signups and in-game feedback exist for the same reason. The other is counting: the daily-changing identifiers on request records and page visit records let us count how many different people used the site on a given day. None of these can be turned back into your address. We do not store the address itself and we do not use it to identify you.
• Request records (route, status code, response time, browser user agent) kept for 90 days for performance monitoring and then deleted. Each record carries a rotating identifier derived from your IP rather than the address itself. The identifier changes daily, so records from different days cannot be linked together or back to you.
• Page visit records for the Double Skunk site (page, referring site, campaign tags, browser user agent, and your browser's language setting), kept for 90 days. They also cover dev log and update pages, and a click on a Steam link on the site, which passes through our server on its way to the Steam store. Each record carries a daily-changing identifier made from your IP address with a secret value that changes at midnight UTC and is never stored, so it cannot be turned back into your address, and records from different days cannot be linked. No IP address is attached.
• Security audit records: when certain account or security events happen, the server writes a record of it. Today those events are deleting your online data, two reports of the same match disagreeing, the server refusing a submission (for example a weekly challenge score from a game version it no longer accepts), a moderator hiding or unhiding a player name, a failed sign-in, and a connection hitting a rate limit. Records about an account include the Steam IDs involved. Records about a connection, such as a failed sign-in, include a scrambled fingerprint of its IP address, of the kind described under playtest signups. A record can hold both, for example when a signed-in player sends name reports too quickly. Kept for 90 days.

What stays on your device

Two of these hold another player's identifier on your own disk, which is why they get a mention:

• A queue of match submissions that have not been delivered yet, each including your opponent's Steam ID. Capped at 50 entries and 14 days, and wiped if you opt out of online stats or delete your online data.
• A resume snapshot for your current online match, holding the other player's Steam ID and Steam name so a crashed match can be rejoined. It expires after 7 days.
• A short local diagnostic log of your own submissions, containing your own Steam ID. It never leaves your machine.

Solo campaign saves, settings, and progress are local files and are never uploaded.

What goes to Steam, not to us

When you host an online lobby, your Steam name is written into Steam lobby metadata and Steam Rich Presence. That is how other Steam players see who is hosting. It is a disclosure to Valve and to other players, not to Kerrberry, and it is governed by Steam's privacy policy.

Crash reports

The game ships with a crash reporting library (Sentry). It is off by default and sends nothing unless you turn it on, under Settings, in the Profile pane, as "Crash reports". Your consent is what allows a report to be sent, and a report only ever comes from an installed release build, never from the editor or a test run. If you turn the setting back off, any queued and future reports are dropped.

When you have it on, a crash report contains a stack trace, a short trail of the screens you moved through before the crash, the context of the run that crashed (the seed, the board index, your Long Tally position, and the names of any powerups in play), the release version, and the game's log file.

A crash report carries no account identifier. We keep the client IP address and your operating-system username out of it, we do not attach a screenshot, and your Steam ID is stripped from the log file, along with any absolute file path that holds your account name, any private-lobby join code, and any hand-edited server address. A test in the game's source scans for these, so a new identifier cannot slip in unnoticed. Sentry also has IP-address storage turned off at the project level, so its ingest does not keep the address a report was sent from.

How we use it

Briefly: we use the data to do what you came here to do.

• Contact form submissions are used to reply to your inquiry and to track our pipeline. We do not add you to any marketing list.
• Double Skunk identity and match data is used to authenticate your client, record your match and challenge results, compute your rating, and display leaderboards. That is what the online features are.
• In-game feedback is read by a human and used to fix bugs and improve the game. If you left a contact line, we use it only to reply about your message.
• Player name reports are read by a person and used only to decide whether to hide a name.
• IP addresses are used for abuse prevention (rate limiting, and spotting repeat abuse through the hashed values described above) and, in their daily-changing form, to count how many different people visit the site each day.
• Crash reports, for players who turn them on, are used for debugging and nothing else.

No advertising, no data brokers, no resale, no profiling, and no automated decision-making beyond computing a rating from match results.

Who else sees it

Short list. The fewer hands data passes through, the less can go wrong with it.

• Steam (Valve Corporation), for Double Skunk only. The game uses Steam's Partner API to validate that your authentication ticket is genuine; that call sends Steam our publisher key and the ticket and gets back your Steam ID and display name. See Steam's privacy policy.
• Our hosting provider (Fly.io) operates the infrastructure everything runs on. Like any host, they can see the traffic that reaches their servers, including your IP address, and they keep their own logs independently of our application, under Fly.io's privacy policy.
• Sentry receives a crash report only when a player has turned crash reporting on and the game crashes. IP-address storage is disabled at the Sentry project level, so its ingest does not retain the sender's IP address.
• No advertisers, no analytics resellers, no third-party trackers. The site does not embed Google Analytics, Facebook Pixel, or similar.

Your rights

You can see what we have on you, and you can make us delete it. Concretely:

Right to erasure

For Double Skunk, erasure is self-serve inside the game: open Settings, then Saves & Data, then "Delete my online data." That action calls DELETE /api/v1/ds/profiles/<your-steam-id> and immediately soft-deletes your player record, anonymizes your match history (the matches themselves stay, so your opponents' stats remain correct), hard-deletes your rating history and challenge scores, and signs out your active session. You will no longer appear in any leaderboard. The deletion itself leaves one audit record holding your Steam ID and the display name your account had at that moment, so we can show the erasure happened; it is removed after 90 days like every other audit record.

Feedback sent from the in-game form is not linked to your Steam account, so the in-game deletion cannot reach it. To have a feedback message removed, email doubleskunk@kerrberry.com and quote enough of it for us to find it. We will delete it.

Deleting your online data also deletes the name reports you sent. Reports other players sent about you are kept, because they belong to the player who sent them, but your Steam ID and your name are removed from them. If we had hidden your name, your Steam ID stays on the hidden list so the name stays hidden in online play.

For contact form data, email hello@kerrberry.com from the address you used and ask us to delete your submission. We will.

Right to access

Email the address for the surface you used (doubleskunk@kerrberry.com for the game, hello@kerrberry.com for consulting) and we will send back what we hold within a reasonable window, usually a few business days. Your Double Skunk profile is also available at GET doubleskunk.kerrberry.com/api/v1/ds/profiles/<your-steam-id> and is publicly readable by anyone who knows your Steam ID.

Everything else

Correction, objection, and any other request: email the same addresses. If you are in the UK or EU and think we have handled your data badly, you also have the right to complain to your local data protection authority (in the UK, the ICO).

How long we keep things

• Contact form submissions stay until your project closes or you ask us to delete them.
• Playtest signups stay until the playtest program ends or you ask us to remove yours.
• In-game feedback stays until we no longer need it or you ask us to remove yours. The scrambled IP fingerprint attached to each message is removed automatically after 90 days.
• Player name reports are deleted 180 days after we close them. A hidden name stays hidden until we lift it.
• Double Skunk player records are kept for the life of your account or until you delete them. Match records are kept so that stats stay consistent, with your side anonymized if you delete your data.
• Your rating history is kept for 90 days, then pruned automatically.
• Weekly challenge scores are kept for the life of your account and deleted when you delete your online data.
• Security audit records are kept for 90 days, then pruned automatically.
• Request records and Double Skunk page visit records are kept for 90 days, then pruned automatically. Daily totals made from them, such as how many people visited on a given day, hold no identifier of any kind and are kept.
• Sign-in session records are deleted 90 days after the session expires. The sessions themselves last 24 hours. Daily totals made from them, such as how many players signed in on a given day, hold no identifier and are kept.

Cookies and tracking

In normal browsing we set one cookie: an encrypted Phoenix session cookie. It does two jobs. It keeps admins logged in to the back-office, and it carries a copy of your IP address that our interactive pages read for the rate limiting described above. The cookie is encrypted so nobody else can read what is in it, it expires after 7 days, and we do not use it to track you.

One additional, opt-in cookie (request_logger) is set only when an authenticated admin activates the LiveDashboard's request-logging feature. Regular visitors never receive this cookie. We do not use tracking cookies or third-party advertising pixels.

Legal basis and cross-border data

Kerrberry Systems LLC is based in the United States, and data is processed on infrastructure that may be outside the UK and the European Economic Area.

If UK or EU data protection law applies to you, our legal bases are: your consent for the contact form, for playtest signups, for Double Skunk online stats sharing (opt-in in the game), for feedback you choose to send from the in-game form, and for crash reports when you turn them on (also an in-game toggle); and our legitimate interest in running the service securely for rate limiting and the operational logs above. Counting how many people use the site each day, through the daily-changing identifiers and the daily totals above, rests on our legitimate interest in understanding how the site and the game are found and used. The right-of-erasure controls above satisfy GDPR Article 17 and UK GDPR equivalents. Player name reports, and hiding a name, rest on our legitimate interest in keeping abusive names out of the game's shared spaces.

Children

Double Skunk is not directed at children under 13, and the consulting site is not either. Online identity in the game comes from Steam, and Steam's own terms govern who can hold a Steam account.

Changes to this policy

If we make a material change to this policy, we will post it here and update the date at the top of the page.