Privacy Policy

Last updated 18 September 2026

This policy covers the Whispering Nature website, our Discord server, and pre-release builds of the game. It is written to be read, not to be survived.

The short version. We collect an email address if you ask for news, and technical data from the game so we can make it run properly. We do not sell anything to anyone, we run no advertising or tracking cookies, and you can have any of it deleted by emailing [email protected].

Who is responsible

Whispering Nature is made by One Fox Studio Sàrl, a Swiss limited liability company, which is the data controller for everything described here, and can be reached at [email protected].

Because our players are in Switzerland, the EU and the UK, we apply the Swiss Federal Act on Data Protection and the GDPR together, and give everyone the stronger of the two.

The website

Newsletter sign-up

If you enter your email address to follow the game's progress, we store that address and the IP address the request came from. The IP is kept as evidence of the sign-up and to spot abuse of the form, not to profile you.

Why we may do this: Your consent, which you give by submitting the form.
How long we keep it: Until you unsubscribe or ask us to delete it. There is no fixed expiry, because a mailing list about a game in development is quiet for long stretches.
How to stop: Every email we send carries an unsubscribe link, and emailing us works just as well. Withdrawing consent costs you nothing and we do not ask why.

Cookies

We set two cookies of our own, both strictly necessary: a session cookie and a CSRF token, which exist so that forms cannot be submitted on your behalf by another site. Cloudflare, which sits in front of the site, sets its own cookies to tell browsers from bots. That is the lot. We run no analytics, advertising or cross-site tracking cookies, which is also why you are not being asked to dismiss a banner.

Bot protection and hosting

The site sits behind Cloudflare, which serves our pages and runs Cloudflare Turnstile on the newsletter form to tell people from scripts. Cloudflare necessarily sees the IP address and request headers of anyone visiting, as any host would. Some styling and icons are loaded from the cdnjs content network, which is also operated by Cloudflare.

The game

Pre-release builds send us technical data about how they ran, because a forest that stutters on your machine is invisible to us otherwise. Each play session is recorded under a randomly generated session identifier. That identifier is not an account, is not linked to your name or email, and is not reused to recognise you later.

Per session we receive:

Hardware and system details: platform, operating system, device model, CPU and core count, GPU, memory, screen resolution and the quality preset in use.
Build details: the game version and the Unity version it was built with.
Performance samples: frame rate, frame time and memory use over time.
Position traces: where your character stood and which way it faced inside the game world, sampled as you play, so we can see which paths people take and which corners nobody finds.
Gameplay events: named moments such as picking something up or entering an area.
Your IP address and the country it resolves to.

The IP address and country are the only parts of this that can point back to a person. We use them to tell sessions apart and to understand where players are, not to identify anyone.

Why we may do this: Our legitimate interest in making a game that works: fixing crashes and performance problems, and understanding how the world is actually played. We think this is a fair use of the data because it is technical, short-lived, and not tied to an identity.
How long we keep it: For as long as the build it describes is useful to us, which in practice means through development and the release it feeds into.

Automated analysis of play sessions

We pass recorded sessions — the traces, events and performance samples above — to Anthropic's Claude models to summarise what happened and point out where the level design fails. This is analysis for our own reading. It makes no decision about you, produces no profile of you, and has no legal or similar effect on you.

Our Discord server

Joining our Discord is optional, and Discord is its own company with its own privacy policy, which governs your account there. Our bot stores:

Your Discord user ID and username, when a role is assigned to you or a moderator records a warning against your account, together with the reason and who issued it.
Anything you deliberately send us through the bot's feedback commands — a bug report or a suggestion — which becomes a card on our internal development board.

Why we may do this: Our legitimate interest in running a community that is moderated and accountable, and — for feedback you choose to send — your consent in sending it.
How long we keep it: Moderation records are kept while you are a member, so that a warning still means something months later. Feedback is kept as long as it is useful to the game.

Who else sees your data

We do not sell personal data, and we do not share it for anyone else's marketing. It reaches only the companies we need to run the thing, each acting on our instructions:

Cloudflare — hosting in front of the site, bot protection, and asset delivery.
Anthropic — automated analysis of play sessions, as described above.
Discord — if you use our Discord server.
Valve — if you wishlist or buy the game on Steam, that happens entirely on Steam under Valve's terms, and we receive only Steam's own aggregate reporting.
Our email provider — to deliver the newsletter you asked for.

Some of these are outside Switzerland and the EEA. Where that is so, the transfer rests on the European Commission's and the Swiss Federal Council's adequacy decisions or on standard contractual clauses.

We may also disclose data if the law actually requires it of us.

Your rights

Wherever you are, you may ask us to:

tell you what we hold about you, and give you a copy;
correct it, if we have it wrong;
delete it;
stop using it, where we rely on legitimate interest;
withdraw a consent you gave, at any time.

Email [email protected] and we will answer within 30 days. There is no form and no fee. For a game telemetry request, tell us roughly when you played and on what machine — sessions are not tied to an identity, so that is how we find yours.

If you think we have handled your data badly, you can complain to the Swiss Federal Data Protection and Information Commissioner, or to your national supervisory authority in the EEA or UK. We would rather you told us first.

Children

The game and this site are not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has sent us something, write to us and we will remove it.

Changes

When this policy changes, the date at the top changes with it. If a change meaningfully affects what we collect or why, we will say so on the site and in the newsletter rather than hoping you re-read this page.