Grumpy Giraffe Games LLC
Effective 8/1/2026 · Last updated 8/1/2026
This policy explains what information Pact or Peril (the "Game") collects, why we collect it, and what you can do about it. The Game is operated by Grumpy Giraffe Games LLC, a Nevada limited liability company ("we," "us").
The short version: we run our own game servers, and the Game contains no advertising networks and no third-party analytics or tracking SDKs. We collect the minimum needed to run your account, match you into games, keep ranked play fair, and process purchases. Some of that necessarily passes through the platform you play on, our hosting provider, and our payment processors — section 5 names them. We do not sell your personal information.
Pact or Peril is intended for players aged 13 and older. It is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, contact us at the address below and we will delete the account and its associated data.
Account details. If you register directly, we collect your email address and a salted, hashed password. We never store your password in readable form.
Signing in through a platform. If you sign in through Steam, we receive your Steam ID and the display name on your Steam account. If you sign in with Google, we receive your Google account identifier and, where you permit it, your name and email address. We never receive your password for those services, and we do not receive your friends list, your library, or your payment details.
(Apple and Google Play Games sign-in are not available yet. If we add them, we will update this policy before they go live.)
Profile information. Your chosen display name, avatar selection, and any preferences you set.
Settings, saved through Steam. In the Steam version, your settings are mirrored to Steam Cloud so they follow you to another PC. Valve stores that copy; your installation identifier is deliberately excluded from it.
Custom maps. If you publish a map through the Steam Workshop, the map and its title are published publicly, under your own Steam account, and are governed by Steam's terms as well as ours. You can unpublish it from Steam at any time.
Support correspondence. Messages you send us, including the email address you send them from.
Reports and block lists. If you report another player, we receive what you typed, who you reported, and the screenshot and match details attached to the report. We also store the list of players you have blocked, so that list still applies the next time you play. Muting is temporary — it lasts only for the match you are in and is not stored.
Installation identifier. The first time you sign in, the Game creates a random identifier and saves it on that computer. It is not derived from your hardware, your Steam account, or anything else about you — it is a freshly generated random value, and it stays on that machine (we deliberately keep it out of Steam Cloud so it never follows you to another PC). When you sign in, the Game sends that value to our server, which immediately converts it into a one-way keyed digest and stores only the digest — the original value is never kept on our servers and cannot be recovered from the digest. Alongside it we record the platform (for example "desktop" or "android") and the operating system name.
We use this for exactly one purpose: to notice when several accounts sign in from the same installation, which is how we detect a player evading a fair-play restriction by making a new account. It is not an advertising identifier, it is not used to build a profile of you, it is not used for tracking outside the Game, and we never share it or sell it. What happens when a link is found is described under Automated fair-play review holds.
Clearing the Game's local data removes the identifier; a new random one is created the next time you sign in.
Device and connection data. Device or computer model, operating system version, Game version, language, and IP address. On Steam, the platform also tells the Game a coarse region (for example North America or Europe) — we do not look up your location ourselves and we never store a precise one. We use this to connect you to a nearby game server and to detect abuse. When you host an online lobby, that coarse region is shown to other players in the lobby browser so they can pick a game near them.
Diagnostic and crash reports. If the Game closes unexpectedly, the next time you launch it we offer to send a crash report — you decide whether to send it. We also collect a report when you submit a bug report or report another player. Depending on the kind of report it can include: a screenshot of the Game window taken at the moment you opened the report, the last part of the Game's own log file, your display name and account identifier, your Steam ID if you signed in through Steam, and details of the match you were in. The Game also submits a short automatic diagnostic when a connection fails or a lobby nobody can join is detected — these never include a screenshot, and you can switch them off in Settings. Where these reports go is described in Who we share it with.
If you are in the European Economic Area or the United Kingdom, our legal bases are performance of a contract (running your account and matches), legitimate interests (security, abuse prevention, and improving the Game), legal obligation (financial records), and consent where we ask for it.
One part of the Game makes an automated decision about you. If a new account signs in on an installation that was already linked to an account which later received a fair-play restriction, our system automatically opens a review hold on the new account. While a hold is open, ranked play is unavailable. Casual and single-player are unaffected, and nothing else about your account changes.
We have deliberately limited what the automation is allowed to do:
The message shown in-game is deliberately vague, because spelling out exactly what was matched would tell a determined ban evader how to work around it. This section is where we describe the logic instead.
Our legal basis for these checks is our legitimate interest in keeping ranked play fair for everyone. You have the right to ask a human to look at a hold, to have it explained, and to contest it — see Your choices and rights.
Pact or Peril offers optional in-app purchases of virtual currency and items. We never receive or store your full card number, CVV, or bank details. Payments are handled by the platform or payment processor you buy through:
We receive an order identifier, the item purchased, the amount and currency, and the status of the payment, which we keep as a business record.
Virtual currency and items have no monetary value outside the Game, cannot be exchanged for cash, and are licensed rather than sold to you. Details are in our Terms of Service.
We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We disclose information only to:
| Data | Retention |
|---|---|
| Account and profile data | While your account is active, plus 30 days after deletion |
| Match results and rankings | While your account is active — they make up your career stats and your place on the leaderboards |
| Replays of online matches | 90 days, unless you have given the replay a share code, or a moderator has preserved it for an open investigation |
| Preset phrases and emotes sent in a match | Stored inside that match's replay, and kept for as long as that replay is |
| Link between your account and an installation | Deleted after 90 days with no sign-in from that installation |
| Fair-play review cases that were cleared, monitored, or released automatically | Deleted 90 days after the case closes |
| Confirmed fair-play cases and the restrictions that follow from them | Kept as part of our enforcement record |
| Bug reports, crash reports, automatic network diagnostics, and player reports | Kept in our private moderation channel — and, for player reports, in our moderation queue — for as long as we need them to investigate |
| Purchase and tax records | As required by law, typically seven years |
Two narrow exceptions to the 90-day installation rule: if a review concluded that a computer is genuinely shared, we keep that link so the same computer does not flag you again; and a link tied to a confirmed evasion case is kept for up to a further 180 days after that case is decided.
You can review and update your profile in the Game's settings at any time. You may also ask us to:
Send requests to the email address below. We will verify that the request comes from the account holder and respond within the time required by applicable law, generally 30 to 45 days. We will not treat you differently for exercising these rights. If you are in the EEA or UK, you may also lodge a complaint with your local data protection authority.
Full instructions are on the Account Deletion page, which you can reach without having the Game installed. In short: email us at the address below from your account's email address, with Account deletion in the subject and your display name in the message. You can also start the request in the Game — Settings → Account → Delete Account — which opens the same page.
Deletion removes your profile, career statistics, rank, match history, inventory, and any unspent virtual currency, which is forfeited and not refundable. We complete it within 30 days and email you when it is done.
A narrow set of records survives deletion because the law requires it, or because removing it would let a banned player start over: purchase and tax records, confirmed fair-play cases and the restrictions that followed, the fair-play installation identifier used to detect ban evasion, and player reports that are part of a moderation record. The retention table in section 6 gives the periods.
We use encryption in transit (TLS) for sign-in, your account and profile data, purchases, and everything else the Game exchanges with our web services, along with hashed password storage, access controls, and restricted administrative access. One exception: the live gameplay connection to our match servers is not encrypted. That link carries the moves in your match, the display names of the players in it, and the preset phrases they send — it does not carry your email address, your password, or any payment detail. No system is perfectly secure, and we cannot guarantee absolute security. If a breach affects your personal information, we will notify you and any required regulator as the law requires.
We operate from the United States, and our servers and service providers may be located in the United States and other countries. If you play from outside the United States, your information will be transferred to and processed in the United States, which may have different data protection laws than your country. Where required, we rely on Standard Contractual Clauses or another lawful transfer mechanism.
We may update this policy as the Game changes. When we make a material change, we will update the "Last updated" date above and notify you in the Game or by email before the change takes effect. Continuing to play after a change means you accept the updated policy.
Grumpy Giraffe Games LLC
732 S 6th ST, STE N
Las Vegas, Nevada 89101
Email: support@grumpygiraffe.net
© Grumpy Giraffe Games LLC. Pact or Peril is a trademark of Grumpy Giraffe Games LLC.