THE SMALL PRINT

Privacy Policy

Last updated: 4 November 2026

This policy covers the game Aura Falls and the online service behind it, both made by 4FingerStudios. It is written to be read rather than to be survived, and it describes what actually happens, which you can check against the service's source if you want to.

If you have a question about any of it, write to spooky@4fingerstudios.com.

The short version

When you start the game on a computer it signs you in through Steam, and on an iPhone or iPad through Game Center, with nothing to click. On an Android phone you sign in with your itch.io account. There is no separate account to make. From then on we store the handful of things needed to know who you are and what you own. Our service does not store your IP address, we do not run advertising or analytics trackers, and we never see your payment details. The game only uses your microphone while you are speaking through the in-game megaphone, and what you say is never recorded.

What we collect, and why

When you start the game, it signs you in. On a computer it asks Steam who you are, and on an iPhone or iPad it asks Game Center. On an Android phone the game opens an itch.io sign-in page in your browser, and once you have signed in there, itch.io tells us who you are. Either way the game exchanges that for a session; there is no separate account to make. A small number of testers sign in through Discord instead, using an account we set up for them.

Once you are signed in, we store:

• Your account identity. Your Steam ID and Steam display name, your itch.io user ID, or your Game Center player ID and Game Center nickname, depending on how you signed in (or, for testers, your Discord ID). When you first sign in with itch.io, your in-game name is taken from your itch.io display name, or your username if you have not set one. Steam and Game Center names are refreshed each time the game starts, because you can change them there and the game should not show a stale one. We never see your password, your email address, your Steam library or anything else in your Steam, itch.io or Apple account.
• Older Android accounts. Until November 2026 the Android version signed in through Google Play Games. If you signed in that way, we still hold the Google Play Games player ID and Google account ID we received then. They are no longer used to sign anybody in, and deleting your account removes them.
• An account record. An identifier of our own, the date you first signed in and the date we last saw you.
• A sign-in token. A random string that keeps you signed in, with the date it was issued and the date it expires. It is stored on your own device in its protected storage, and on our side only as a record that it is valid.
• What you own and how you look. The items in your bag and your storage, the cosmetics you have equipped, and the colours and options you have chosen for your character.
• Your progress. Your experience, your level and your in-game currency.
• Your scores. Your times, placements, waves survived and defeats on the leaderboards, along with a record of the run each score came from so we can tell a real score from a claimed one.
• Reports. If you report a problem or another player, we store what you sent, who sent it, who it was about if it was about somebody, and which session it came from.

We collect these because the game cannot work otherwise: an account you can return to, items that are still yours tomorrow, and leaderboards that are not trivially faked all require us to remember something.

Your microphone

The hub has a megaphone, and only while you are standing at it does the game open your microphone. What you say is compressed and sent live, over the game's own connection, to the other players in the same game, who hear it through the loudspeakers around the island. It is played as it arrives and then thrown away: it is not recorded, not stored on our servers or on anyone's device, and not used for anything else. The moment you step away from the megaphone the microphone is closed.

On a phone the game asks for permission to use the microphone the first time you take the megaphone, and the rest of the game works the same if you say no. Anyone can turn megaphone voices off for themselves in the audio settings.

What we do not collect

• Your IP address. Our service does not record it.
• Recordings of your voice. Megaphone audio is passed on live and never kept.
• Payment details. Purchases are handled entirely by Steam, itch.io or the app store you got the game from. We never see your card, your address or your billing information.
• Analytics, advertising or tracking. There are none in the game.

Playing with other people

A couple of things worth being clear about:

• On a computer, your connection is carried by Valve's network. Players reach each other by their Steam identity, and Valve's relay carries the traffic between you, so other players do not see your IP address.
• On a phone, players connect directly. Your phone talks straight to the player hosting the game, or to one of our game servers, so the host's device necessarily receives your IP address in order to send you the game. This is how most online games work.
• Other players see your name, your level and your cosmetics, because that is the point of playing together.

Traffic between players is encrypted.

Who else is involved

• Valve operates Steam, which both sells the game and signs you in on a computer. When the game starts it asks Steam who you are, and Steam tells us your Steam ID and display name. Their own privacy policy governs what they do.
• itch.io sells the Android version and signs you in on it. When you sign in, itch.io tells us your itch.io user ID, username and display name and whether you own the game, and nothing else. Their own privacy policy governs what they do.
• Apple runs the App Store and Game Center, which distribute the iPhone and iPad version and sign you in on it. Apple tells us your Game Center player ID and nickname. Their own privacy policy governs what they do.
• Cloudflare hosts our service, and delivers the game files a phone downloads the first time it starts. As part of delivering requests they, and the server those files come from, process standard connection information on our behalf.

We do not sell, rent or share your information with anyone else, and we do not use it for advertising.

Playtest sign-ups

If you sign up for a playtest on our website, we store your name, your email address and your answers to the form's questions. We use them only to invite you to that playtest, to contact you about it and to choose who takes part. To send the invite you asked for, your email goes to Apple (TestFlight) or Valve (Steam), depending on the platform you signed up for. For Android, we email you an itch.io download key ourselves. Sign-ups are deleted when the playtest is over, or sooner if you write and ask.

How long we keep it

• Your account and what you own: for as long as you have an account.
• Sign-in tokens: until they expire, which is ninety days, or until you sign out.
• Join tickets, the short-lived passes that prove who you are to the players in your game: fifteen minutes.
• Reports: up to two years, so a pattern of behaviour can be seen.
• Records of item movements, kept to stop abuse: seven days.

Your choices

• You can sign out, which invalidates the token on our side. On a computer or an iPhone, starting the game again signs you back in. On Android you sign in with itch.io again.
• You can ask for a copy of everything we hold about you, and we will send it to you.
• You can delete your account, and everything attached to it, on our website: delete your account, where you sign in with the account you play with and confirm. Leaderboard entries are removed with it. If you can no longer sign in, you can ask us to do it by email.
• You can ask us to correct anything that is wrong.

Write to spooky@4fingerstudios.com for any of these. We will answer within thirty days. If you are in the UK, the EU or another place with a data protection authority and you think we have handled this badly, you have the right to complain to them.

Children

The game is not directed at children under 13, and you must meet the minimum age requirements of Steam, itch.io or the App Store, whichever you got it from, to use it. We do not knowingly collect information from children under 13. If you believe a child has given us information, write to us and we will delete it.

Changes

If we change what we collect, we will update this page and change the date at the top. Substantial changes will also be announced on the game's store pages.