Last updated: 25 September 2026
THE STILL ROOM is run by Barton Technology Ltd, trading as Nutty Orange (company number 03930086). We are the data controller for the information below. Registered office: 20 Market Place, Kingston Upon Thames, KT1 1JP. Correspondence: Suite 652, 124 City Road, London, EC1V 2NX. Email: help@nuttyorange.com.
Your account: your email address and, if you set one, a password (stored only as a secure hash). We need these to sign you in and keep your game yours. Lawful basis: performing our contract with you.
Your purchase: your name, email, country, what you bought, the price and the payment reference. Card details go straight to Stripe and never reach us. We keep purchase records to give you access, handle refunds and meet tax law. Lawful basis: contract, and legal obligation.
Your game: the group you play in, the display name you choose, and your progress, so everyone in the group sees the same house and you can carry on later. Lawful basis: contract.
Basic security logs: IP address and browser details on requests, briefly, to stop abuse and keep the site working. Lawful basis: our legitimate interest in running a secure service.
Your review: if you rate the game when you finish, we store your stars and anything you write, with details of the game (group size, hints, time, scares on or off), to improve it. It stays private unless you tick “Can we quote you?”, and even then we only publish your words, stars, the name you give and your town (if given) after reading them. Lawful basis: our legitimate interest in improving the game, and your consent for anything we publish.
We email you about your purchase and your sign-in, plus at most one email the day after your first game asking how it went.
Emails about our other games: when you buy, the checkout tells you we'll also email you about our other games (from Nutty Orange, who make THE STILL ROOM), and gives you a “Don't email me about other games” box. If you leave it unticked, we add your email address to our games mailing list and record that you bought and when. If you tick it, we don't. Lawful basis: the “soft opt-in” in the UK Privacy and Electronic Communications Regulations, which lets a business email its own customers about similar products provided they were given a simple way to refuse. Every one of those emails has a one-click unsubscribe link, or email help@nuttyorange.com, and we stop. If you had already unsubscribed from our emails, buying does not sign you back up. We don't send marketing to anyone else unless they have separately agreed to it.
Supabase (accounts and game data, stored in London), Vercel (hosting), Stripe (payments), Emailit (sign-in and receipt emails), Sentry (error reports when something on the site breaks: the page, browser and technical details of the error, not your name or email), Google Analytics and Meta (see below) and our own email platform for purchase records and the games mailing list. Each processes data only on our instructions. Where a provider is based outside the UK, appropriate transfer safeguards apply. We never sell your data.
Game progress: 12 months after your access ends. Your account: until you ask us to delete it. Purchase records: 6 years, because tax law requires it. Security logs: up to 30 days.
Under UK GDPR you can ask for a copy of your data, have it corrected or deleted, restrict or object to how we use it, and receive it in a portable form. Email help@nuttyorange.com from the address on your account and we will reply within one month. You can also complain to the Information Commissioner's Office at ico.org.uk.
Strictly necessary cookies and browser storage keep you signed in, keep the site secure and remember your cookie choice. They are always on.
Analytics: we use Google Analytics 4 to understand how people find the game, how many buy it and how the game plays (for example, where groups ask for hints), so we can improve it. With your consent it sets cookies that recognise a returning browser. If you decline, we use Google's Consent Mode: Google receives only cookieless signals with no identifier, which it models in aggregate. When you buy, the checkout sends the purchase (order reference, product and price, not your name, email or card) to Google Analytics, so we can see which campaign led to the sale. Where you arrived from an ad or link carrying campaign tags, we keep those tags with your order for the same reason. Lawful basis: consent for analytics cookies; legitimate interest for the cookieless and purchase signals. Google processes this data in the US under appropriate safeguards.
Advertising and remarketing (only if you say yes): advertising cookies let us measure whether our ads work and show you THE STILL ROOM ads on other websites and apps after you have visited, which is commonly called remarketing. We currently use Meta (Facebook and Instagram) for this, and may add Google Ads and similar advertising platforms, which will be listed here as they are adopted. With your consent, information about your visit (such as the pages you viewed, whether you clicked to buy, an advertising identifier and your approximate location) is shared with those platforms so they can measure our campaigns and build audiences. Nothing advertising-related runs until you choose, and analytics consent is never treated as advertising consent.
When you buy, the checkout also tells Meta a purchase was made (the order reference, price and currency, plus your email address in hashed form and, where present, the ad-click identifier), so we can tell which ad led to the sale. Where you have not consented to advertising cookies, no advertising cookie is read or set to do this. Lawful basis: consent for advertising cookies; legitimate interest for measuring whether our paid ads lead to sales. These platforms act as independent or joint controllers for that advertising activity, so their own privacy policies also apply, and they may process data outside the UK under appropriate safeguards.
You can review or change your choice at any time: Cookie settings.