Your words,
your privacy.

The legal entity responsible for your personal data under UK and EU data protection law is Seedcraft Ventures Ltd, a company registered in Scotland, trading as Escapage. If Escapage is ever incorporated as its own entity, we'll update this document and notify active users before the change takes effect.

We try to collect as little as possible, and only what's needed to make Escapage work. Here's everything:

What we don't collect: we don't track you across other websites, we don't use advertising cookies, we don't fingerprint your device, and we don't ask for your phone number.

We use the information we collect to:

• Run the service. Show you your boards, sync them across devices, and keep your account secure.
• Connect creators. Display public boards, deliver community notes, and run challenges.
• Keep things working. Fix bugs, prevent spam and abuse, and improve features based on what's actually being used.
• Talk to you when we must. Important account notices, security alerts, or material changes to this policy. No marketing spam.
• Meet legal obligations. Respond to lawful requests, resolve disputes, and enforce our terms.

Under the UK GDPR and EU GDPR, we rely on the following lawful bases:

• Contract. Running your account, showing you your boards, processing support payments, necessary to deliver the service you signed up for.
• Legitimate interests. Basic logging, spam prevention, and security monitoring. We've weighed this against your privacy and kept collection minimal.
• Consent. Where we ask for something optional, like subscribing to updates, we only act on it if you say yes. You can withdraw consent at any time.
• Legal obligation. When we have to respond to a lawful request from a court or regulator.

We don't sell your data. We don't rent it. We share personal data only with a small set of infrastructure providers that help us run Escapage, each bound by a data processing agreement.

We may also disclose information if required by law or to protect the rights, safety, or property of Escapage or its users. If we're ever compelled to hand something over, we will push back where we lawfully can and notify the person affected where we're allowed to.

If we add a new infrastructure vendor, we'll update this list before that vendor starts handling your data.

Escapage has a global audience. If you're writing from outside the UK or EU, your data will be transferred to and stored on servers located in the European Union (via Supabase) and may be processed by vendors operating in other jurisdictions.

When personal data leaves the UK or EEA, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or an equivalent safeguard to ensure your data keeps the same level of protection wherever it goes.

Your account and content stick around for as long as your account is active. If you delete your account, we delete your personal data within 30 days, with the exception of:

• Backups. Encrypted backups may retain your data for up to 60 days before rotation.
• Financial records. We keep records of any payments for as long as UK tax law requires (currently six years).
• Public community content. Things like public challenge entries or notes you left on someone else's board may remain visible, anonymised, to preserve the record. You can ask us to remove these by email.

Technical logs are rotated out automatically, typically within 30 days.

We take reasonable technical and organisational measures to protect your data: encryption in transit (TLS), encryption at rest for sensitive fields, hashed passwords, and access controls on our infrastructure.

No system is perfectly secure. If we discover a breach affecting your personal data, we will notify the relevant supervisory authority within 72 hours (as UK GDPR requires) and, where the risk is significant, we will notify you directly as soon as we reasonably can.

Depending on where you live, you have a set of rights over the personal data we hold about you. We honour these globally where we reasonably can.

To exercise any of these, write to contact@escapage.ink. We'll respond within 30 days with no charge and no need to justify your request.

Escapage is not intended for children under 16. We don't knowingly collect personal data from anyone under that age. If you're a parent or guardian and believe your child has created an account, please get in touch.

We use a small number of cookies to keep you signed in, remember your preferences, and measure basic site performance. We don't use advertising cookies, cross-site trackers, or third-party analytics tools that build profiles on you.

You can block or delete cookies through your browser settings. If you do, some parts of Escapage may stop working properly.

When we make material changes, we'll notify active users by email or in-app before the change takes effect. If Escapage is ever incorporated separately, or if Seedcraft Ventures Ltd is acquired or restructured, we will tell you before any personal data moves and give you the chance to delete your account first.

This policy is governed by the laws of Scotland. Any disputes shall be subject to the exclusive jurisdiction of the Scottish courts, without prejudice to your rights as a consumer under the laws of your own country.