Privacy Policy

1Who We Are

YesterGames OÜ is a small games company registered in Estonia. We decide what happens to the data described here, which makes us what the law calls the "controller". In this policy, "we" and "us" mean YesterGames OÜ.

Registry code

16614767

Registered address

Veskiposti 2-1002, 10138 Tallinn, Estonia

Contact email

hi@yester.games

We're small enough that the law doesn't require us to have a data protection officer, so we don't have one. Any question about your data can go to the email above and a real person will answer.

2What This Policy Covers

This policy covers the website at yester.games, the Public Beta sign-up page at try.yester.games, emails you send us, and donations you make to us. It's written to meet both the EU's data protection law (the GDPR) and the UK's version of it (the UK GDPR and the Data Protection Act 2018), so it applies to you whether you're in the EU or the UK.

It doesn't cover the Yester Games app itself. The app will get its own privacy notice when the Public Beta opens, and you'll see it before you start playing. It also doesn't cover other companies' sites we link to, such as Substack, Instagram and PayPal. They have their own policies.

3What We Collect

We collect only what the site needs to work and what you choose to give us. We never ask about things like your health, religion or politics, and we don't buy information about you from anyone.

• When you sign up for the Public Beta. Your name and your email address. We also note the time you signed up, the page you signed up from, and the short description your browser sends of itself (its "user agent"), which tells us roughly which browser and kind of device you used.
• When you email us. Your email address, your name if you give it, and whatever you write.
• When you visit the site. Our web host keeps the usual server logs: your IP address, the time of each request, the pages you asked for, and your browser's description of itself. We run no analytics, advertising or tracking of any kind.
• When you support us. Donations happen on PayPal's pages, not ours. PayPal tells us your name, your email address and the amount. We never see your card or bank details.

4Why We Use It

The law says we need a good reason, called a "legal basis", for each thing we do with your data. Here they are:

• To email you about the Public Beta. We use your name and email address to tell you when the beta opens, to send your invitation, and to send updates about the beta. We do this because you asked us to when you signed up. That's your consent (Article 6(1)(a) of the EU and UK GDPR). You can take it back at any time, for free, by writing to hi@yester.games or by using the unsubscribe link in any email we send. Emails we sent before you did stay lawful.
• To keep the list tidy. We check each new sign-up against the list so the same address isn't added twice. Same reason as above.
• To reply to you. When you email us, we use your details to answer. That's in our legitimate interest (Article 6(1)(f)): people who write to us expect a reply. If your email is about making a deal with us, it's also a step towards a contract (Article 6(1)(b)).
• To keep the site safe and working. Server logs help us spot abuse, fix faults and fend off attacks. That's our legitimate interest in running a secure, reliable site. We don't use the logs to work out who you are.
• To keep our books straight. We keep the record PayPal gives us of each donation because Estonian accounting law says we must. That's a legal obligation (Article 6(1)(c)).

Where we rely on a legitimate interest, we've checked that it doesn't outweigh your rights. In each case it's something you'd expect and it barely affects you. You can object at any time; see Section 8.

We don't make automated decisions about you, and we don't build profiles of you.

5Who We Share It With

We don't sell your data, rent it out, or share it for advertising. We share it only with the companies we need to run the site, and they're bound by contracts that limit what they can do with it:

• Google Cloud. Your sign-up details and our email live in our private Google space. Google stores and processes them only on our instructions and can't use them for anything of its own.
• Our web host, which serves the site and keeps the server logs described above.
• PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A.), which handles donations under its own privacy statement, as a controller in its own right.

We'd also hand over data if the law made us, for example to a court or an authority with a lawful demand, or if we needed to protect our rights or someone's safety. If YesterGames were ever sold or merged, the list would go to the new owner under this same policy, and we'd tell you first.

6Data That Leaves the EU or UK

We're in Estonia, inside the EU. Some of the companies above, in particular Google LLC and PayPal's US business, process data in the United States.

Data protection law allows this when the data is properly protected on the way. For data from the EU, we rely on the EU-US Data Privacy Framework for companies certified under it, and otherwise on the European Commission's standard contract terms. For data from the UK, we rely on the UK Extension to that framework, and otherwise on the UK's international data transfer addendum. Google is certified under the framework, including the UK Extension. Ask us at hi@yester.games if you'd like a copy of the safeguards that apply to your data.

UK law treats the EU as a safe destination for data, so data about UK users that we hold in Estonia is covered by the UK's adequacy regulations for the European Economic Area.

7How Long We Keep It

• The Public Beta list. Until you unsubscribe or ask us to delete you, and in any case no later than twelve months after the Public Beta ends. Then we delete your row.
• Emails you send us. For as long as we need them to deal with your message, and up to two years after the conversation ends, unless we need them longer for a legal reason.
• Donation records. Seven years from the end of the financial year of the donation, which is what Estonian accounting law requires.
• Server logs. Our web host keeps them for a short rolling period, normally no more than thirty days, then overwrites them.

When one of these periods ends, we delete the data or strip it of anything that could identify you.

8Your Rights

Under both the EU GDPR and the UK GDPR you can:

• See the data we hold about you and get a copy of it;
• Fix anything that's wrong or incomplete;
• Delete your data, for example by asking us to take you off the Public Beta list;
• Pause our use of it while we sort out a question about it;
• Take it with you, in a common file format, to another service;
• Object to anything we do on the basis of a legitimate interest, and to any marketing, at any time;
• Take back your consent at any time where consent is our reason, without affecting what was done before.

To use any of these, email hi@yester.games from the address you signed up with, or tell us how we can check that you're you. We'll answer within a month, free of charge. If a request is unusually complex, we may take up to two more months, and we'll tell you why.

You can also complain to a data protection authority. Ours is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), www.aki.ee. You can also go to the authority in the EU country where you live or work or, if you're in the UK, to the Information Commissioner's Office, ico.org.uk. We'd be grateful for the chance to put things right directly first.

9If You're in the UK

The UK GDPR and the Data Protection Act 2018 apply to your data in the same way the EU GDPR applies to people in the EU. You have the same rights, listed in Section 8, and the Information Commissioner's Office is your authority.

We're based in Estonia and have no office in the UK. We haven't appointed a UK representative, because what we do with UK users' data is occasional, small and low-risk, and the UK GDPR doesn't require a representative in that case (Article 27(2)). If that changes, we'll appoint one and name them here.

10Cookies and Tracking

Our pages set no cookies and store nothing in your browser. We use no analytics, advertising or social-media tracking. That's why there's no cookie banner. If we ever add a tool that needs to store something on your device for anything other than making the site work, we'll ask you first and update this policy.

The sites we link to, including Substack, Instagram and PayPal, set their own cookies once you're on their pages, under their own policies.

11Children

The site and the Public Beta aren't aimed at children. We don't knowingly collect data from anyone under 16 in the EU, or under 13 in the UK, without a parent's or guardian's permission. If you think a child has signed up, email hi@yester.games and we'll delete the entry.

12How We Protect It

Every page and the sign-up form use encrypted connections (HTTPS). The sign-up list sits in a private Google Workspace account that only the people who run YesterGames can open, and the sign-up form can only add to the list, never read it. No system is perfectly secure. If we ever learned of a breach affecting your data, we'd tell you and the relevant authority, as the law requires.

13Changes to This Policy

We'll update this policy when the site or our practices change, for example when the Public Beta opens or if we start a newsletter. The "Last updated" date at the top shows the current version. If a change affects how we use data you've already given us, we'll email you before it takes effect.

14Contact Us

For anything about your personal data, write to: