Privacy Policy - 1,000,000 Lentils & Ashes

Last updated: 13 November 2026
Policy version: 1.0

1. General information

This Privacy Policy describes the processing of data in connection with the use of 1,000,000 Lentils & Ashes for Windows and macOS, distributed through Steam. It covers game features, local saves and Steam Cloud, Unity Analytics, Unity Diagnostics, and contact with the publisher.

The controller of personal data processed by the game publisher is Miłosz Tyralik, a sole proprietor who creates games under the Whipbyte brand.

Address for service: ul. Zachodnia 9, Kraków, Poland
Privacy contact: whipbyte@gmail.com

We do not process all data associated with the use of Steam. Valve processes its users' data under the terms of the separate Steam Privacy Policy.

2. What data do we process?

2.1. Unity Analytics - optional gameplay analytics

After the player has given voluntary consent, we use Unity Analytics to analyze gameplay and improve the game. Depending on the game version and active features, our custom analytics events may relate to:

Events may include numerical progress values, gameplay duration, the application version, and technical categories associated with game features. Information about DLC access is not information about a purchase. The game may only recognize that a given user is entitled to the add-on.

In addition to gameplay parameters, the Unity Analytics SDK may automatically process an installation identifier, SDK user, session, and event identifiers, timestamps, platform, application version, and application, project, and build identifiers. The service may also process an IP address when establishing a connection. Depending on the event, platform, and availability of SDK data, it may include the operating system version, system locale, device model and identifier, processor and graphics hardware information, memory capacity, screen dimensions and DPI, and battery level. These data may make it possible to associate events with a particular installation of the game and may constitute personal data.

We do not intentionally add the player's name, email address, SteamID, Steam account name, save contents, or private file paths to our custom analytics events.

The data are used to assess the pace of progression, the clarity of the rules, the use of game mechanics, the stability of selected features, and the further development of the game.

Unity information about Analytics privacy.

2.2. Unity Diagnostics - error diagnostics

In versions of the game in which Unity Diagnostics is enabled, the service helps identify crashes, exceptions, and stability issues. Depending on the platform, type of issue, and game configuration, reports may include:

The scope of the data depends on the Diagnostics settings in the particular version of the application. Unity Diagnostics operates independently of the optional Unity Analytics service. Disabling gameplay analytics in the settings does not automatically disable diagnostics.

We do not use Diagnostics to intentionally collect save contents, private messages, or information identifying a Steam account.

The game also stores local technical logs that help diagnose startup, display, and save issues. Our custom startup entry includes the image and screen dimensions, DPI, display mode, interface scale, game language, game version, and information about the scene having loaded. It does not include full paths to data or save files. If a save or load error occurs, the game code may record the type of operation and error. The game's custom entries are stored locally. The engine and SDKs may create additional entries. The scope of any data included in a report sent to Unity depends on the build, Diagnostics configuration, and type of issue.

Unity information about Diagnostics privacy.

2.3. Local data and Steam Cloud

The game stores a game save on the device. It includes sorting progress, the number of errors, gameplay duration, the use of automation, the player's position, camera orientation, and a local game identifier. The save includes a primary file. When saving, the game may create a temporary file, a backup for recovering progress, and an archive of earlier files when a new game is started. The game also stores settings, tutorial state, the Analytics decision, the accepted policy version, and technical markers that limit repeated events. Saves and settings may remain on the device even without consent to Analytics.

The Unity Analytics SDK may separately buffer events locally before sending them and may store technical identifiers and the state of a deletion request. The Analytics cache is separate from the game save and local technical logs.

The game supports Steam Cloud. When synchronization is available and enabled, save files covered by the Steam Cloud configuration for the relevant platform may be uploaded to Steam servers and synchronized between the user's devices. Synchronization can be managed in the Steam client settings. If the client displays a Steam Cloud option in the game's properties, it can also be managed there.

Withdrawing consent to Unity Analytics or requesting the deletion of Analytics data does not delete local game saves or save files stored in Steam Cloud.

2.4. Steam platform features

The game uses Steam features such as game distribution, achievements, entitlement checks for the optional Sort Gun DLC, and save synchronization through Steam Cloud. When Steam is available, the game sends player statistics to the Steam client, including the total number of sorted items, the total number of sorting errors, and whether automation has been used. These are Steam Stats and are distinct from achievements. The game reads achievement status and reports achievement unlocks through Steamworks. The Steam client may synchronize these statistics and achievements with Valve's service. Steam also handles DLC entitlement checks. These features operate independently of consent to Unity Analytics. To the extent required for their operation, Steam may process account identifiers and data concerning statistics, entitlements, achievements, and save files.

Purchases, payments, Steam accounts, and the storage of Steam Cloud files are handled by Valve under the terms of the Steam Privacy Policy. We do not receive the user's payment data through Unity Analytics or confirmation that a particular DLC entitlement resulted from a separate purchase transaction.

Steam Privacy Policy.

3. Purposes and legal bases for processing

Optional gameplay analytics. We analyze how the game is used, its balance, and player progress in order to improve the product. The legal basis for processing personal data in Unity Analytics is Article 6(1)(a) of the GDPR, consent. Refusing consent does not restrict access to the game.

Technical diagnostics. The purpose is to detect and fix errors and to ensure that the software operates correctly and securely. The intended legal basis is Article 6(1)(f) of the GDPR, the controller's legitimate interests, which include the stability and security of the game, where applicable after the required legitimate interests assessment has been carried out. The data subject has the right to object under the conditions set out in Article 21 of the GDPR.

Provision of game features. To the extent that the publisher itself processes personal data necessary to handle saves, DLC entitlements, and achievements, the legal basis may be Article 6(1)(b) of the GDPR, performance of a contract. Data processed independently by Valve are subject to the separate legal bases described by Valve.

Handling requests and exercising user rights. We process information provided when contacting us in order to respond, handle a request, or comply with legal obligations. Depending on the purpose, the legal basis is Article 6(1)(c) of the GDPR for compliance with a legal obligation or Article 6(1)(f) of the GDPR for the legitimate interest in conducting correspondence and handling requests.

4. Consent to Unity Analytics

When the game is launched for the first time, it provides information about optional analytics and allows the player to decline. The acceptance option is available in a build with an approved version of the policy and a configured public policy URL, when Analytics is available. Declining does not affect sorting, saves, achievements, access to the game, or the operation of the DLC.

The decision can be managed under Settings → Privacy and Data. Accepting again is subject to the conditions described above and to the restriction that applies while the deletion request described in Section 8 is being submitted. We do not activate optional gameplay analytics until consent has been given. After consent is withdrawn, we stop collecting new Analytics events. Events recorded and buffered while consent was previously in effect may still be handled in accordance with the SDK's mechanisms.

Withdrawing consent does not affect the lawfulness of processing carried out before its withdrawal. Withdrawing consent is not the same as requesting the deletion of data collected previously. Deletion is a separate function described in Section 8.

5. Recipients of data

In connection with the features described above, we use the following service providers:

On the publisher's side, access to the data is limited to persons who need it for the purposes described. Service providers may use their own subprocessors in accordance with their data processing terms.

Unity Privacy Policy · Unity Data Processing Addendum (DPA) · Steam Privacy Policy.

6. Transfers of data outside the European Economic Area

Unity, Valve, Google, and their subprocessors may process data using infrastructure located outside the European Economic Area (EEA). This applies in particular to the cross-border operation of cloud and communication services.

Where the transfer of data subject to the GDPR requires additional safeguards, appropriate legal mechanisms are used, such as adequacy decisions or standard contractual clauses, depending on the recipient and the circumstances of the transfer. Information about Unity's arrangements is included in its DPA. The controller may be contacted for further information about transfers.

7. Data retention periods

Unity Analytics. According to Unity's documentation, raw analytics events are normally retained for 13 months. Some metrics, aggregated data, and user profiles are subject to different rules and may be retained until deleted. These periods may depend on the type of data and the service settings.

Unity Diagnostics. The default retention period for personal data in the new Unity Diagnostics service is 90 days.

Game saves. Local files remain on the device until they are deleted or replaced. Files synchronized with Steam Cloud are retained in accordance with Valve's rules and the user's account settings. They are not deleted by the Unity Analytics data deletion function.

Privacy preferences. The local Analytics decision is stored in order to preserve the user's choice and properly handle privacy-related requests.

Correspondence. We retain data from messages and requests for as long as necessary to handle the matter and, where required, to comply with legal obligations or to establish, pursue, and defend legal claims.

Unity Analytics retention documentation · Unity Diagnostics privacy documentation.

8. Data deletion

Unity Analytics. In the game, the user can go to Settings → Privacy and Data → Request deletion of analytics data. After confirmation, the game disables Analytics and submits a technical request to the Unity Analytics SDK. The request may be sent to Unity while analytics is disabled. It contains technical SDK user, installation, and request identifiers, a timestamp, and technical information about the game version. The SDK clears its local event buffer and may retry sending the request when the connection is restored, including after the game is restarted. Re-enabling Analytics is blocked until the request has been submitted to the SDK. Once it has been submitted, re-enabling Analytics may interrupt the pending handling of the request. Information that the request has been submitted to the SDK does not confirm that the data have been immediately deleted from Unity's servers. If a problem occurs, the user may contact the publisher.

Unity Diagnostics. Requests to access or delete diagnostic reports are handled separately. If the identifier is available, the user may copy the Installation ID under Settings → Privacy and Data, then privately send it to whipbyte@gmail.com, specifying the type of request. The publisher handles the matter using the appropriate Unity Dashboard tools or Unity support.

Local saves and Steam Cloud. A request to delete Analytics or Diagnostics data does not automatically delete game progress, local save files, game settings, achievements, DLC entitlements, or Steam Cloud files. Deleting a local save and managing data stored by Steam are separate actions. For data managed by Valve, Valve's rules and tools apply.

9. User rights

To the extent provided for by applicable law, the data subject may have the rights to:

To exercise these rights, the user may write to whipbyte@gmail.com. An installation identifier may be needed to locate the data. We do not request data beyond what is necessary to handle and verify the request.

The user may lodge a complaint with the competent supervisory authority. In Poland, this is the President of the Personal Data Protection Office: https://uodo.gov.pl/.

10. Automated decision-making

Data processed by the publisher as part of the analytics and diagnostic features described above are not used to make decisions about players based solely on automated processing that would produce legal effects or similarly significantly affect them.

Gameplay data analysis is used to assess functionality and improve the game.

11. Data security

We limit the scope of our custom analytics events to information needed to assess how the game operates. We do not intentionally add direct Steam account identifiers or private contact details to them. We use the security mechanisms offered by service providers and restrict access to data on the publisher's side.

Technical identifiers, session data, and error reports may constitute personal data within the meaning of the GDPR, even if they do not contain the player's name.

12. Changes to this policy

This policy may be updated in response to changes to the game, the services used, or applicable law. In builds with a configured public policy URL, the current version will be available at the address provided in the game's privacy settings. We will state the effective date of the revised document.

If a material change to the scope of optional analytics requires renewed consent, the game will request it before the relevant collection of data resumes.

Data controller: Miłosz Tyralik, sole proprietorship, Whipbyte
Address for service: ul. Zachodnia 9, Kraków, Poland
Contact: whipbyte@gmail.com
Effective date: 13 November 2026
Version: 1.0