Privacy

Who looks after your data

Tingle Press Ltd, the publisher of Dreamscape Code, is the controller of the personal data this site collects. It is a private limited company registered in England and Wales (company number 16075152, registered office 66 Moyser Road, London SW16 6SQ, England). You can reach us about privacy at hello@dreamscapecode.com.

What we keep, feature by feature

Your name in the Code (Your Earth). The name exactly as you typed it, how it is spelled in the Code’s signs, the Earth number it was given, and when. We also keep a one-way fingerprint (a hash) of your private delete link, never the link itself. There is no account and no email address. Anyone with your card’s link can see it; the card is hidden from search engines. We keep it until you delete it, or until the site closes. We keep the name as typed so it can be spelled again if the rules of the script change before the names unseal.

Email sign-ups. We run our own mailing list; no marketing company holds it. We keep your email address, which page you signed up on, the exact consent wording you saw and any boxes you ticked, and when you confirmed. When you sign up, we email you to ask you to confirm (never more than three times in a week, however often the address is typed in); until you press the button on that page, you get nothing else from us. Our emails are plain text, with no tracking pixels and no tracked links, so we don’t know whether you open them. If you never confirm, we delete your address 30 days after our last confirmation email. When you unsubscribe, we keep a note that you did, and when, for 30 days, then delete your address.

Payments (the Guest Book and Support the site). Stripe handles the payment: you type your card details on Stripe’s page, and we never see or store your card number. We keep a record of the order: what you bought, the amount, its status, Stripe’s reference numbers, the email address you gave Stripe (for receipts, delivery and refunds) and, for the Guest Book, the name you asked us to print. We keep order records for six years, because UK tax law requires it. A Guest Book name becomes public when it is delivered, because being printed is the point.

Puzzles. We do not keep your answers or how many tries you made. We count only how many correct answers each puzzle has had.

The Seal Log, the puzzles and the Cellar. Each night’s line, puzzle, hint and clue opens at 19:00 in your own time, so your browser tells us its time zone name (for example, Europe/London) when it asks for them or sends an answer. We use it for that one answer and do not store it.

Things kept only in your browser. Your theme choice (day, night or automatic) and your Ridge marks stay in your own browser’s storage. They are never sent to us, and clearing your browser’s site data removes them.

Keeping the site safe. To stop floods of automated requests, we count requests per visitor for short windows. We do this with a salted, one-way scramble of your IP address, never the address itself, and delete these counts within a day. Cloudflare’s bot check (Turnstile) looks at technical signals from your browser to tell people from bots; it does not track you across other sites for advertising.

Visitor statistics. If we switch on Plausible Analytics, it counts page visits without cookies and without identifying you. We send it only the page’s path, never anything after a “?” in the address, so a private link such as your delete link never reaches it. If it is off, we collect no statistics at all.

Accounts and members’ spaces

Accounts. Reading needs no account. If you make one, we keep your email address encrypted and apart from everything else, the public half of your passkeys (never your fingerprint or face), your sign-in sessions for 30 days, your settings, and your Earth number, Door and rank. Your Room’s Register of Crossings lists everything, with a way to download or delete each part.

The Dining Room and the Margins. What you post, the marks you give (such as Heard), and who you have muted (they are never told). Posts are public to readers at the right chapter, signed with your Earth number or display name, never your real name. They stay until you delete them or your account; if you delete your account, your posts stay in their conversations unsigned, with their text replaced.

Screening. Before a post appears, it is checked against a short list of terms we review, and for words that can mean someone is at risk. If we switch on Microsoft’s Azure AI Content Safety, the text is also sent to it for a check and not kept by Microsoft. These checks can only hold a post for a person to read; they never decide anything.

World Files, Statements, art, translations and fan worlds. What you submit, the licence you accepted and when, and what a moderator decided. Images are stripped of hidden data (such as where a photo was taken and on which device) before we store them, checked against lists of known child-abuse images, and kept private until a person approves them.

Reports and moderation. If you report something, we keep what you told us. If you report without an account and leave an email address, we keep it encrypted and delete it when we close the report. We never tell anyone who reported them. Decisions about your content or account, strikes and appeals are kept for three years, as UK online-safety law requires, without your name once your account is deleted.

The Chart and the Hearth. Your journal is encrypted in your browser before it is sent, with a key we never see, so we cannot read, search or analyse it. We hold only the scrambled text and a locked copy of the key. You can export or delete it at any time, or keep it only on your device (the default if you are 16 or 17). We never connect it to sleep trackers or wearables. Anything you choose to share to the shared hearth is a separate copy that a person reads first and you can withdraw.

Letters left at the desk. A person reads every letter within 12 hours, so they are not end-to-end encrypted; the page says so before you write. We keep letters and our replies for 12 months.

Age checks. Where the law asks us to check a poster’s age, a specialist provider does the check and tells us only whether you passed and how you were checked. We never receive or keep your images or documents.

The Wardens’ draw. If you enter, we keep your entry and publish only an anonymous entry number, so anyone can check the draw.

Why we are allowed to use it

• Your email address: your consent, which you can withdraw at any time.
• Orders: to carry out the purchase you asked for, and to meet our legal duty to keep tax records.
• Your Earth: to provide the name card you asked for (our legitimate interest in running the feature you chose to use).
• Safety counts and the bot check: our legitimate interest in keeping the site working and safe for everyone.

Who helps us process it

• Microsoft Azure: hosting and the database, in the UK South region.
• Cloudflare: domain name service, security and the Turnstile bot check.
• Stripe: payments.
• Microsoft Azure Communication Services: sending our emails (confirmation links, sign-in links, receipts and the newsletter). Microsoft keeps this data in the UK and the European Union.
• Plausible Analytics: cookieless visitor counts, only if switched on.
• Microsoft Azure AI Content Safety: an automatic check of posted text for a person to review, only if switched on.
• An age-assurance provider (Yoti or k-ID): age checks for posting where the law requires them, only once switched on.
• Google Fonts: the site’s typefaces are downloaded once, when the site is built. Your browser never contacts Google when you visit.

Some of these companies may process data outside the UK, under safeguards approved by UK law. We do not sell or rent personal data to anyone, and we never use it for advertising.

Deleting your Earth, and unsubscribing

Your Earth. When you seal your name, you are shown a private delete link once. Open it and press the button to delete your card for good. Its Earth number is never given to anyone else. If you have lost the link, write to hello@dreamscapecode.com with your card’s address and we will help.

Emails. Every newsletter has an unsubscribe link at the bottom: open it and press the button. You can also write to hello@dreamscapecode.com.

Your rights

You can ask us for a copy of the personal data we hold about you, and ask us to correct it, delete it, limit how we use it, or move it elsewhere. You can object to how we use it, and withdraw consent at any time. Write to hello@dreamscapecode.com; we will reply within one month.

If you are unhappy with how we have handled your data, you can complain to the UK’s Information Commissioner’s Office at ico.org.uk. We would like the chance to put it right first.

Younger visitors

Our terms say the site is for people aged 16 and over, but we assume younger people visit too, so the site is private by default for everyone: no public profiles, no direct messages, no location, no ages and no profiling.

If you are under 18, please don’t put your full name in the Code: a first name or a nickname works just as well.

Members aged 16 or 17 get extra protections: their posts are read by a moderator first for 30 days, posting pauses between 10pm and 7am their time, and the Chart stays on their own device unless they choose otherwise.

Changes to this page

If we change how we use personal data, we will update this page and its date first. If a change matters to people on our email list, we will tell them by email.