Privacy Policy

Effective: July 8, 2026 · Last updated: September 21, 2026

Who we are

Varjosoft Oy (Y-tunnus: 3360588-2), Topeliuksenkatu, 00260 Helsinki, Finland. Managing Director: Hannu Varjoranta. Contact: privacy@varjosoft.com

What we collect

We collect only what you give us or what is technically necessary to serve the site.

• Contact form submissions: your email address and any message you choose to write. We also store which intent you selected (advisory, investor, Spegling, etc.) if you clicked one.
• Server logs: IP address, request path, timestamp, user agent. These are standard web server logs retained for security and debugging. They are not linked to your identity.
• Browser storage: the Dots chat widget uses your browser's localStorage to work. It keeps how long you have been reading (so it knows when it is ready) and a random ID it generates in your browser (so a return visit can continue a conversation). This is first-party functional storage. It holds no name, email, or other identifying detail, and it is never sent to a third party.
• Varjocraft: guest worlds are linked to a random, signed browser cookie. If you create an optional account, we store the username, a salted password hash, account sessions, and the worlds you claim. We also store saved worlds and any feedback you choose to send.
• Varjocraft play metrics: we record a small allowlist of events: whether a new or returning world became ready, Play was pressed, active play reached one or five minutes, or a startup, save, graphics, or other game error occurred. Each event includes the realm, game version, time, and a random page-session ID. An error event also includes one short technical line of at most 300 characters: the error type, its message with any web address removed, and the game source file and line where it happened. The ID exists only for that open page and is not retained in the browser or linked across visits, accounts, or browser identities. Raw IP addresses are not stored in the analytics table.

What we do not collect

• We do not use advertising, third-party analytics, or cross-site tracking cookies. Varjocraft uses only the first-party cookies needed to keep guest worlds separate and optional accounts signed in.
• We do not use third-party analytics (no Google Analytics, no tracking pixels).
• We do not load external resources that track you (fonts are self-hosted).
• We do not fingerprint your browser or device.
• We do not sell, share, or trade your data with anyone.

How we use your data

• Email addresses are used to respond to your inquiry or to answer a Spegling access request if you made one. Nothing else.
• Server logs are used for security monitoring and debugging. They are not analyzed for marketing purposes.
• localStorage data is used by the Dots widget to gate itself on real reading time and to keep continuity across pages and return visits. It stays in your browser until you ask Dots a question; the ask sends the visitor ID and accumulated reading time along with it, as described below.
• Varjocraft account and world data is used to save your game and, if you create an account, let you continue it on another device.
• Varjocraft play metrics are used only to understand whether the game loads and runs reliably and how many page sessions progress from a ready world into active play. They are not used for advertising or profiling.

Legal basis (GDPR)

• Contact form: performance of a contract or pre-contractual measures (Art. 6(1)(b)). You are requesting us to respond to your inquiry.
• Server logs: legitimate interest (Art. 6(1)(f)). Security and availability of the service.
• The Dots widget: legitimate interest (Art. 6(1)(f)). We run a small on-site chat widget and keep the questions asked of it so we can operate and improve it. The browser storage it uses is functional. We set no tracking cookies and do not profile you; you can decline by not using the widget and clearing your browser storage.
• Varjocraft gameplay and accounts: performance of a contract or pre-contractual measures (Art. 6(1)(b)). We process the functional data needed to provide the saved game and optional account you request.
• Varjocraft play metrics: legitimate interest (Art. 6(1)(f)). We need a minimal view of whether the game starts, retains active play, and encounters operational failures. Metrics are limited to one page session, contain no persistent visitor or account identifier, and are not used for marketing.

The Dots widget

Dots is the small chat widget in the corner of the site. When you send it a question, we store the following on our server so it can answer, keep context within a short conversation, and so we can see how it is used:

• The question you asked and the answer that was generated.
• Which page you asked it from.
• A one-way hash of your IP address. The raw IP is not stored, and we do not derive or store your location from it.
• The random visitor ID your browser generated, which is what groups a short conversation together.
• How long you had been reading before you asked, plus basic operational metrics (which model answered, token counts, cost, and response time).

The visible text of the page you are on is sent to the AI provider so the answer can be grounded in what you are reading. It is used only to generate the reply and is not stored. Dots itself has no login or account; Varjocraft separately offers an optional game account. You can clear your browser storage for this domain at any time, and you can ask us to delete the questions tied to your activity by contacting privacy@varjosoft.com.

AI-generated content

Dots and Spegling chat responses are generated by artificial intelligence. They may be inaccurate, incomplete, or inappropriate. Spegling does not provide professional advice (legal, financial, medical, or otherwise). Varjosoft Oy is not liable for actions taken based on AI-generated responses.

Your questions are not used to train AI models by Varjosoft or any AI provider. They are stored so the widget can keep context and so we can operate and improve it, and are processed by our AI provider solely to generate the reply.

Data retention

• Contact form submissions: retained for 24 months after last interaction, then deleted.
• Server logs: retained for 90 days.
• Dots questions and answers: retained while the widget is in active development. You can request deletion of records tied to your activity at any time.
• Varjocraft play metrics: retained for 90 days, then deleted automatically.
• Varjocraft worlds, accounts, and feedback: retained while the game is active or until you ask us to delete data associated with your browser or account.

Where your data is stored

All data is stored on servers in the EU, primarily in Finland. We currently use Hetzner (Helsinki) and may use OVH (EU data centers) or UpCloud (Helsinki) as the project grows.

International data transfers

Questions you ask the Dots widget, and the page text sent with them, are answered by Nebius Token Factory and processed within the EU. We do not send your Dots questions to providers outside the EU/EEA. We may use other AI providers (including ones based in the United States) for our own internal benchmarking and research, using our own test material rather than visitor questions.

Your rights

Depending on the processing and its legal basis, the GDPR gives you the right to:

• Access the data we hold about you
• Correct inaccurate data
• Request deletion of your data
• Restrict processing
• Data portability
• Object to processing
• Withdraw consent at any time (without affecting the lawfulness of prior processing)
• Lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi)

To exercise any of these rights, contact privacy@varjosoft.com. We will respond within 30 days.

Children

The main Varjosoft site, Dots, and the Spegling chat are intended for users aged 16 and older. Varjocraft is a family game that children can play as guests without giving a name or email. Its optional account asks only for a username and password; a parent or guardian should create and manage an account used by a child. We do not ask a child for their age, real name, email address, or location. If you believe a child has put personal data in a username or feedback message, contact privacy@varjosoft.com and we will delete it.

AI processing

Dots and Spegling use large language models to generate chat responses. Our primary AI provider is Nebius Token Factory, which processes visitor questions on EU-hosted endpoints. We use Nebius because it allows us to keep AI processing within the EU.

We may use additional model providers (including Anthropic, OpenAI, and Perplexity) for our own benchmarking and research. Questions asked of the Dots widget are not sent to them; they are answered by Nebius in the EU. We do not attach personal identifiers (name, email, raw IP address) to any AI request, with any provider. Anything you type into a question is sent as written.

Spegling is in an active research and development phase. We aim to use EU-based models and processing wherever possible. This section will be updated with more specific details as development proceeds.

Third parties and data processors

Infrastructure:

• Hetzner Online GmbH (Helsinki, Finland) — primary server hosting
• OVH (EU data centers) — potential additional hosting
• UpCloud (Helsinki, Finland) — potential additional hosting
• Let's Encrypt — TLS certificates
• DB-IP — IP geolocation database (CC BY 4.0). Downloaded and queried locally on our server. No visitor data is sent to DB-IP.

AI providers (data processors):

• Nebius Token Factory (EU data centers) — answers the Dots widget; the only provider that processes visitor questions
• Anthropic (Claude API), OpenAI, Perplexity — used for our own benchmarking and research, not for processing visitor questions

We do not attach personal identifiers to AI requests, and no provider uses your data for model training. Nebius, the only provider that processes visitor questions, incorporates its Data Processing Agreement into its terms of service.

Changes

This project is in active development. This policy will be updated as the product matures. We may add or remove providers, but the core commitment remains: EU-based processing where possible, no personal identifiers sent to AI providers, no data sold or traded. The effective date at the top will change with each update. No retroactive changes to how existing data is used.

Contact

Varjosoft Oy
Topeliuksenkatu, 00260 Helsinki, Finland
Y-tunnus: 3360588-2
Email: privacy@varjosoft.com