Privacy, Its a big deal huh

One Big Sip (“One Big Sip”, “we”, “us”) is an independent game studio. We run onebigsip.com and make games, including We Steal From Old People: The Game.

Under data protection laws such as the EU and UK General Data Protection Regulation (GDPR), One Big Sip is the controller of the personal information described in this policy. That means we decide how and why it’s used. The exception is where we say another company, such as Valve, is responsible.

How to reach us:

• Email: contact@onebigsip.com (put “Privacy” in the subject line)

This policy applies to:

• our website, onebigsip.com, and all of its pages;
• emails and other messages you send us, including bug reports;
• personal information we receive about players of our games through Steam; and
• our official community spaces, such as our Discord server and our X account, to the extent we can see or receive information there.

It doesn’t cover how other companies handle your information on their own services, including Valve (Steam), Discord and X. Those companies are responsible for their own processing under their own privacy policies (see section 7).

onebigsip.com is a static website. It has no accounts, no sign-up forms, no ads and no tracking cookies.

Server logs. Like nearly every website, our site is delivered by a hosting and content delivery provider. When your browser requests a page, the provider automatically records standard technical information in its server logs:

• your IP address;
• your browser’s user agent, which usually shows your browser, operating system and device type;
• the page or file requested (the URL);
• the date and time of the request; and
• the page that linked you to us (the referrer), if your browser sends one.

These logs are used to deliver the site, keep it secure (for example, to detect and block attacks or abuse) and diagnose problems. We don’t use them to build profiles of visitors or to track you across other sites.

Website analytics. We use Vercel Web Analytics to see how many people visit our pages. It records the page you viewed, the site that sent you, your country and your type of device and browser. It doesn’t set cookies and doesn’t collect anything that identifies you: visitors are told apart only by a temporary code that is reset every 24 hours and can’t be traced back to you. We only ever see totals.

Things that stay in your browser. Our interactive toys remember small things, like your mute setting and your juice box sips, using your browser’s local storage. That information stays on your device and is never sent to us. See section 8 for the full list.

Bug report builder. Our Support page has a tool that helps you write a bug report. It runs entirely in your browser and opens a pre-filled draft email in your own email app. Nothing you type into it leaves your device unless you choose to send that email. If you do send it, we receive it as described in section 3.2.

When you email us at contact@onebigsip.com or any other One Big Sip address, whether it’s a bug report, a press request, a business inquiry or anything else, we receive:

• your email address, plus your name if it’s part of your email account or signature;
• the contents of your message;
• anything you choose to include or attach, such as system specifications, screenshots or log files; and
• standard email details, such as the date and time you sent it.

We use this to reply to you, fix whatever went wrong and improve our games. Please only send what we need. There’s never a reason to send us a password or payment details.

We Steal From Old People: The Game is sold and distributed through Steam, which is operated by Valve Corporation.

Valve handles your account and purchases. When you create a Steam account, wishlist a game, buy a game or pay for anything on Steam, Valve collects and processes that information under the Steam Privacy Policy (opens in a new tab). We don’t receive your payment details or your Steam account’s email address.

Reports we get from Steam. Through Steamworks, Valve’s platform for developers, Valve gives us reports about our games. These are aggregated statistics that don’t identify you, such as:

• numbers of wishlists, sales, refunds and players, broken down by region;
• store page traffic, including roughly where visits came from; and
• overall usage figures, such as playtime.

Steam features in the game. If a game uses Steamworks features such as achievements, stats, leaderboards or Steam Cloud saves, Steam links the related game data to your Steam ID so those features work. Examples include the achievements you’ve unlocked, your leaderboard scores and your save files. Some of this data, like leaderboard entries and achievement stats, may be available to us through Steamworks. Leaderboard entries may also be visible to other players next to your Steam profile name. Steam Cloud saves are stored by Valve so you can pick up where you left off on another computer.

Reviews and discussions. Reviews and forum posts on our Steam pages are public on Steam. We can read them and may reply.

Crash reports and analytics. We Steal From Old People: The Game does not send crash reports, diagnostics or gameplay analytics to us or to any analytics provider. The only game data we see is what Steam provides, as described above. If we ever add crash reporting or analytics to a game, we’ll update this policy before that version is released. The update will explain what’s collected, whether it’s linked to your Steam ID, who processes it, how long it’s kept and how to turn it off.

Asking for help with a game. If you email us about a game, section 3.2 applies.

We run an official Discord server and an X account. Discord and X are operated by their own companies, which collect and process your information under their own privacy policies.

When you join our Discord server, follow or mention us on X, or message us on either platform, we and our moderators can see what those platforms show us. That includes your username, profile picture, public profile information, and the messages and content you post or send to us. We use this to run and moderate our community, answer questions, and collect feedback and bug reports.

These platforms may also give us aggregated statistics, such as how many people joined our server or saw a post.

To be clear, we don’t:

• use advertising networks, tracking pixels, session recording, browser fingerprinting, or analytics that use cookies or build a profile of you (such as Google Analytics);
• embed third-party content that could track you, such as social media widgets or video players (the X and Discord buttons on our site are plain links);
• load fonts, code or other files from third-party servers. Our fonts and code, including the Three.js library behind our 3D toys, are hosted with the rest of our site, so loading a page doesn’t send your information to Google Fonts or any third-party content network; or
• knowingly collect sensitive information, such as health data or precise location.

We use the information described above only to:

• Run the website: deliver pages, keep the site working and fix technical problems.
• Keep things secure: detect, prevent and respond to abuse, attacks, fraud and security incidents.
• Help you: respond to your emails and messages, and troubleshoot bug reports.
• Make our games better: fix bugs, improve features and balance, and understand how our games are doing through Steam’s reports.
• Run our community: host and moderate our Discord server and X account.
• Comply with the law: meet legal, tax and accounting obligations, respond to lawful requests, and establish or defend legal claims.

We don’t use your information for advertising. We don’t sell it. We don’t use it to make automated decisions that have legal or similarly significant effects on you.

If you’re in the European Economic Area (EEA) or the United Kingdom, the GDPR and UK GDPR require us to explain the legal basis for each use of your personal information.

• Legitimate interests (Article 6(1)(f)). We rely on our legitimate interests in running a secure, working website, answering people who contact us, supporting and improving our games, and running our community. This covers server logs, cookieless website analytics, support emails, Steam reports and community moderation. We collect very little and don’t use it for advertising or profiling, so we believe this balance is fair to you. You can object at any time (see section 12.1).
• Contract (Article 6(1)(b)). Where processing is needed to provide a game feature or support you’ve asked for in connection with a game you own, such as Steam Cloud saves or achievements.
• Legal obligation (Article 6(1)(c)). Where we must keep or disclose information to comply with the law.
• Consent (Article 6(1)(a)). If we ever ask for your consent for a specific purpose, we’ll rely on it only for that purpose. You can withdraw it at any time. Withdrawing doesn’t affect anything we did before you withdrew.

Local storage. The toy settings listed in section 8 never leave your device and are used only to provide features you choose to use. We treat them as strictly necessary under EU and UK rules on storing information on devices (the ePrivacy Directive and the UK’s PECR), which is why we don’t show a consent banner.

Do you have to give us information? No. You can browse the whole site without giving us anything beyond the technical information every browser sends. If you’d like a reply to an email, we’ll need your email address.

We share personal information only in these situations:

• Service providers. These companies help us run things and process information on our behalf, under contracts that limit what they can do with it. Right now they are Vercel, which hosts our website and provides our website analytics, and our email provider.
• Legal reasons. When we believe in good faith that disclosure is required by law, a court order or other legal process, or is needed to protect the rights, property or safety of One Big Sip, our players or others, or to investigate fraud or security issues.
• Business transfers. If One Big Sip is involved in a merger, acquisition, financing, reorganization, bankruptcy or sale of all or part of its assets, personal information may be transferred as part of that transaction. The recipient will have to respect this policy, or we’ll tell you about any changes (for example, with a notice on this site).
• With your permission. When you ask us to share something or agree to it.

We don’t sell your personal information, and we don’t “share” it for cross-context behavioral advertising, as those terms are defined in the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). We also don’t process personal information for targeted advertising or profiling as defined in other US state privacy laws.

Our site links to other services, such as Steam (to wishlist or buy our games), Discord and X. When you click one of these links, you leave onebigsip.com and the other service’s privacy policy applies. The service you visit may receive standard information from your browser, such as your IP address and the page you came from.

• Steam (Valve)Steam Privacy Policy (opens in a new tab)
• DiscordDiscord Privacy Policy (opens in a new tab)
• XX Privacy Policy (opens in a new tab)

We aren’t responsible for how those services handle your information, so it’s worth checking their privacy settings too.

We don’t set any cookies.

Local storage. Our interactive toys use your browser’s local storage to remember a few small things between visits. Local storage isn’t a cookie, but privacy laws treat it in a similar way, so here is the complete list. Every key starts with obs:.

About these values:

• They’re saved when you use the related toy or setting, and they stay on your device.
• They’re never sent to us or anyone else, and we can’t see them.
• They contain no personal details, only settings and numbers.
• They last until you clear them. You can delete them at any time by clearing site data for onebigsip.com in your browser settings. Private or incognito windows usually discard them when you close the window.
• If you clear them, the toys still work. They just forget your sips.

We keep personal information only as long as we need it for the purposes in this policy:

• Server logs: kept by our hosting provider for a limited period, in line with its standard log retention, and then deleted, unless we need them longer to investigate a specific security incident.
• Emails and bug reports: kept while we’re helping you and for a limited period after our last exchange, so we have context if the problem comes back. After that we delete them.
• Steam data: aggregated reports that don’t identify you may be kept as business records. Data linked to your Steam ID for game features is held by Valve under its own policies.
• Community content: stays on Discord or X until you delete it or a moderator removes it, subject to those platforms’ own retention rules.
• Local storage: stays on your device until you clear it.

We may keep information longer if the law requires it, or if we need it to establish, exercise or defend legal claims.

The best protection is not collecting things in the first place. Our site has no accounts, no passwords and no forms that send us data.

For the information we do hold, we use reasonable safeguards. The site is served over encrypted HTTPS connections. Access to our email and platform accounts is limited to the people who need it and protected with two-factor authentication where it’s available.

No system is perfectly secure, so we can’t guarantee absolute security. If a breach affects your personal information, we’ll notify you and the relevant authorities where the law requires it.

Our service providers may process information in the United States and other countries. These countries may have different data protection laws from the country where you live.

When we transfer personal information out of the EEA or the UK, we rely on an appropriate safeguard. That may be an adequacy decision (including the EU–US Data Privacy Framework and its UK Extension, where a provider is certified) or the European Commission’s Standard Contractual Clauses, with the UK Addendum where relevant. You can contact us for a copy of the relevant safeguards.

You have choices about your information wherever you live. Even where a particular law doesn’t apply to us, we’ll generally honor requests to access, correct or delete your personal information.

Some things are out of our reach:

• We can’t see or delete what’s in your browser’s local storage, but you can (see section 8).
• We can’t change or delete data held by Valve, Discord or X. Use their privacy tools or contact them directly.

Under the GDPR and UK GDPR, you have the right to:

• access the personal information we hold about you and get a copy of it;
• correct information that’s inaccurate or incomplete;
• delete your information (sometimes called the “right to be forgotten”);
• restrict how we use your information;
• data portability, meaning you can get information you gave us in a structured, machine-readable format or have it sent to someone else;
• withdraw consent at any time, where we rely on consent; and
• not be subject to decisions based solely on automated processing that significantly affect you. We don’t make any such decisions.

Your right to object. You can object at any time to our use of your information based on legitimate interests. If you do, we’ll stop, unless we have compelling legitimate grounds that override your interests or we need the information for legal claims.

Your right to complain. You can lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work, or where you believe a violation took place. In the UK, that’s the Information Commissioner’s Office (ICO) (opens in a new tab). In the EEA, you can find your authority on the European Data Protection Board’s website (opens in a new tab). We’d be grateful for the chance to sort things out first, so please feel free to contact us.

If you’re a California resident, the CCPA (as amended by the CPRA) gives you the right to:

• know what personal information we collect, use and disclose, and access the specific pieces we hold about you;
• delete personal information we’ve collected from you;
• correct inaccurate personal information;
• opt out of the sale or sharing of your personal information (we don’t sell or share it);
• limit the use of sensitive personal information (we don’t use it in ways that trigger this right); and
• not be discriminated against for exercising any of these rights.

What we collect, in CCPA terms:

We also disclose information as described in section 6 (for legal reasons, business transfers or with your permission). For how long we keep each category, see section 9.

We don’t intentionally collect sensitive personal information. If you include some in an email, we’ll use it only to help you. Where we hold de-identified or aggregated information, such as Steam’s reports, we keep it in that form and don’t try to re-identify anyone. We don’t sell or share personal information, and we have no actual knowledge of selling or sharing the personal information of consumers under 16.

“Shine the Light.” We don’t disclose personal information to third parties for their own direct marketing purposes.

Residents of other US states with comprehensive privacy laws (such as Colorado, Connecticut, Oregon, Texas and Virginia) have similar rights. Depending on your state, these may include the right to:

• confirm whether we process your personal information, and access it;
• correct inaccuracies;
• delete it;
• get a portable copy; and
• opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects. We don’t do any of these.

Appeals. If we decline your request, you can appeal by replying to our decision with “Appeal” in the subject line. We’ll respond within the time the law requires. If you’re unhappy with the outcome, you can contact your state’s Attorney General.

Email contact@onebigsip.com with “Privacy request” in the subject line. Tell us what you’d like us to do and which email address or username you’ve used with us.

• Verification. To protect your information, we’ll verify your request before acting on it, usually by confirming that it comes from the email address we have on file. We’ll ask only for what we need, and we’ll use it only to verify your request.
• Authorized agents. You can ask someone else to make a request for you. We may ask for proof that they’re authorized, such as your signed permission, and we may still need to verify your identity directly.
• Timing. We’ll respond within one month under the GDPR and UK GDPR, or within 45 days under US state laws. For complex requests we may extend this as the law allows, and we’ll tell you if we do.
• Cost. Requests are free. We may decline, or charge a reasonable fee, only if a request is clearly unfounded or excessive, as the law allows.

Our website and games aren’t directed at children. We Steal From Old People: The Game is a satirical game with mature content. Our site isn’t directed at children under 13, or under 16 in the EEA and UK, and we don’t knowingly collect personal information from them.

If you believe a child has sent us personal information, please contact us at contact@onebigsip.com and we’ll delete it.

Do Not Track. We don’t track you across websites, so there’s nothing for a Do Not Track signal to switch off. Our site behaves the same whether or not your browser sends one.

Global Privacy Control (GPC). We treat a GPC signal as a valid request to opt out of the sale or sharing of your personal information, as laws like the CCPA require. Because we don’t sell or share personal information, that request is already honored for everyone, with or without the signal.

We may update this policy when our website, our games or the law changes, for example if we add a feature or a game starts collecting new information. When we do, we’ll change the “Last updated” date at the top. If a change is significant, we’ll make it obvious, for example with a notice on this site before the change takes effect. Earlier versions are available on request.