Privacy Policy

Effective Date: May 22, 2026 Last Updated: May 30, 2026 Version: 1.2

This Privacy Policy explains how Hareloom Studios ("Hareloom", "we", "us", "our") collects, uses, discloses, and protects information when you use hareloomstudios.com and our other sites and products (the "Services"). It is written to align with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), British Columbia's Personal Information Protection Act (PIPA), and, for Quebec residents, Quebec's Law 25. The Services are operated from Canada and are not directed at the European Union or the United Kingdom; if you contact us or subscribe from outside Canada you do so voluntarily, and we will honour reasonable access and deletion requests regardless of where you live. By using the Services, you consent to the practices described here. If you do not agree, do not use the Services.

This Policy is incorporated into and subject to our Terms of Service.

1. Who we are

Hareloom Studios is an independent studio based in Vancouver, British Columbia, Canada. For privacy matters, contact hello@hareloomstudios.com. Hareloom is the organization responsible for personal information under its control.

2. Information we collect

We collect only what we need, and only when you give it to us or it is necessary to operate the Services.

• Contact form. Your name, email address, chosen subject, and message, so we can read and reply.
• Download events. When you download a file, we record non-identifying technical details: the product, version, platform, approximate country, browser/user-agent type, and referring page. We do not store your full IP address.
• Anti-spam / bot protection. When you submit a form, Cloudflare Turnstile processes a short-lived challenge token to confirm you are human.
• Operational logs. Our hosting and infrastructure providers automatically process standard technical data (such as truncated/derived request metadata) for security, abuse prevention, and reliability.

We do not require accounts, and we do not knowingly collect special-category sensitive information. We do not sell your personal information, and we never will.

3. How we use information

We use the information above only to:

• respond to your messages and provide what you requested;
• understand which products and downloads are popular, in aggregate;
• operate, secure, debug, and improve the Services and prevent abuse;
• comply with legal obligations and enforce our Terms.

We do not use your information for automated decision-making that produces legal or similarly significant effects, and we do not use it for third-party advertising.

4. Legal basis and consent

We process personal information on the basis of your consent (which you may withdraw at any time, subject to legal or contractual limits) and our legitimate operational interests in running and securing the Services. Submitting a form or subscribing constitutes consent for that specific purpose.

5. Service providers (processors)

We rely on a small set of trusted providers, each receiving only what it needs:

• Supabase — stores contact messages and download events (database).
• Resend — delivers transactional email (for example, our reply to your contact message).
• Cloudflare — serves installer downloads (R2 storage) and provides bot protection (Turnstile).
• Vercel — hosts the site and provides privacy-friendly, cookieless aggregate analytics.

These providers may process and store data on servers located outside British Columbia, including in the United States and other countries. By using the Services you acknowledge that your information may be processed in those jurisdictions and may be accessible to courts, law enforcement, and authorities there. We take reasonable steps to use providers that offer appropriate safeguards.

6. Retention

We keep personal information only as long as needed for the purpose collected: contact messages while we handle and reasonably follow up on your inquiry; download events in aggregate for as long as useful for analytics. We delete or de-identify information when it is no longer needed, or upon a valid request, subject to legal retention requirements.

7. Your rights and choices

Subject to applicable law, you may:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Withdraw consent or request deletion of your information.
• Complain to the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner for British Columbia.

To exercise any of these, email hello@hareloomstudios.com. We will respond within a reasonable time as required by law. We may need to verify your identity before acting.

8. Security

We use reasonable administrative, technical, and physical safeguards appropriate to the sensitivity of the information, including transport encryption (HTTPS), access controls, and reputable infrastructure providers. No method of transmission or storage is perfectly secure, however, and we cannot guarantee absolute security. You use the Services at your own risk as described in our Terms.

9. Children

The Services are not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will delete it.

10. Third-party links

The Services may link to sites we do not operate (including thrallcraft.com and external sites). We are not responsible for the privacy practices of those sites. Review their policies separately.

11. Changes to this Policy

We may update this Policy. The "Last Updated" date reflects the latest revision; material changes will be noted on the site. Continued use after changes take effect constitutes acceptance.

12. Contact

Questions, requests, or complaints about privacy: hello@hareloomstudios.com, Hareloom Studios, Vancouver, British Columbia, Canada.