Privacy Policy
Last updated: 10 July 2026.
The short version
Pugamochi asks for as little information as possible.
We use your email address so you can sign in. We save your pug, scrapbook, collection, submitted adventures, and settings so the game works.
We do not sell your information. We do not use advertising. We do not use analytics to track you around the internet.
If you submit an adventure and it is approved, the story and image may appear in other players’ scrapbooks. Your email address will not be shown to them, though our moderators can see it while they review your submission.
If you support the work through Ko-fi, Ko-fi may send us information such as your name or display name, email address, payment amount, currency, payment type, transaction/message ID, and whether the payment relates to monthly support. We use this to record supporter status and keep basic records. We do not receive your card or bank details.
You can ask us to correct or delete your personal information by contacting us at pugamochi@drmsite.com.
1. Important information and who we are
Purpose of this privacy policy
This privacy policy gives you information about how Pugamochi collects and uses your personal data through your use of our website and game (the “Game”), including any data you provide when you adopt a pug, play, or submit an adventure.
Controller
DRMSite Ltd (company number 17151917, whose registered office is at 40 Elm Close, Witchford, Ely, CB6 2JH) is the controller and responsible for your personal data (collectively referred to as “Pugamochi”, “we”, “us” or “our” in this privacy policy).
If you have any questions about this privacy policy, including any requests to exercise your legal rights (section 9), please contact us using the contact details set out in section 10.
2. The types of personal data we collect about you
Personal data means any information about an individual from which that person can be identified. We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:
- Account Data includes the email address you use to sign in. Your password is handled by Firebase Authentication and is never stored by us in readable form.
- Pug & Play Data includes your pug’s name and appearance, its stats, your journal/scrapbook entries, items you have collected, and your focus-timer (Pug-modoro) activity.
- Contribution Data includes any adventure you choose to submit to the community library — a title, a story, and an optional image.
- Supporter Data includes information Ko-fi sends us when you support the work — such as your name or display name, email address, payment amount, currency, payment type, a transaction/message ID, and whether the payment relates to monthly support — which we use to record your supporter status and the date your supporter extras run until. We do not receive or store your card or bank details.
- Technical Data includes internet protocol (IP) address and device/browser signals processed by Firebase App Check and Google reCAPTCHA to tell genuine app traffic from automated abuse.
Data we do not intentionally collect
We do not intentionally collect precise location data, phone numbers, date of birth, health information, school information, or other special category data.
3. How is your personal data collected?
We use different methods to collect data from and about you, including:
- Your interactions with us. You give us personal data by using the Game — when you adopt a pug and create an account, name and design your pug, submit an adventure, or contact us.
- Automated technologies. As you use the Game, Firebase App Check and reCAPTCHA automatically collect Technical Data to keep the service secure. We do not use advertising or analytics cookies. Security services such as Firebase App Check and reCAPTCHA may use technical signals, cookies, or similar technologies to help protect the app from abuse.
- Ko-fi. If you support the work, Ko-fi sends us a notification about your payment (see “Supporter Data” above for what this includes) so we can record your supporter status. We do not receive your card or bank details.
4. How we use your personal data
Legal basis
The law requires us to have a legal basis for collecting and using your personal data. We rely on one or more of the following:
- Performance of a contract with you — where we need to provide the Game you have signed up for.
- Legitimate interests — where it is necessary to run and secure the Game, moderate submitted content, and record supporter status, provided your rights do not override those interests.
- Legal obligation — where we must process data to comply with the law.
- Consent — where you have actively agreed, for example when you choose to submit an adventure for possible sharing.
Purposes for which we will use your personal data
| Purpose / Use | Type of data | Legal basis |
|---|---|---|
| To create and manage your account | (a) Account |
(a) Performance of a contract with you (b) Necessary for our legitimate interests |
| To run the Game — save your pug, its stats, your scrapbook, your collection and your focus-timer activity | (a) Account (b) Pug & Play |
Performance of a contract with you |
| To run the community library — to review adventures you submit and, if approved, share them with other players | (a) Contribution (b) Account |
(a) Consent (you choose to submit) (b) Necessary for our legitimate interests (to moderate and run the shared library) |
| To record and reflect your Pugamochi Supporter status | (a) Supporter (b) Account |
(a) Performance of a contract with you (b) Necessary for our legitimate interests |
| To administer and protect the Game (including abuse prevention, troubleshooting, testing, maintenance, support and hosting) | (a) Account (b) Technical |
(a) Necessary for our legitimate interests (to run and secure
the service and prevent fraud) (b) Necessary to comply with a legal obligation |
| To manage our relationship with you, including notifying you of changes to our terms or this policy and dealing with your queries | (a) Account |
(a) Performance of a contract with you (b) Necessary to comply with a legal obligation (c) Necessary for our legitimate interests |
Marketing
We do not carry out any direct marketing, advertising, or profiling, and we do not send notifications to draw you back into the Game. Time away from Pugamochi is part of the game.
5. Disclosures of your personal data
We may share your personal data where necessary with third parties who provide services to us, namely Firebase (Google) for authentication, database, file storage, hosting and running our backend functions, and Ko-fi (Ko-fi Labs Ltd) for handling supporter payments.
Community sharing. If you submit an adventure and it is approved by a moderator, the adventure content you provided (its title, story and image) may be shown to other players in their own scrapbooks. Your email address is never shown to other players, and it is never published alongside an approved adventure. Our moderators can see the email address of the account that submitted an adventure while it is waiting to be reviewed, so that they can recognise repeat submissions, follow up with you about your adventure where necessary, and act on misuse. Please do not include real names, addresses, school or workplace names, identifiable photos, or other personal or identifying information in a submitted adventure. Our Safety & Moderation policy explains how submitted adventures are reviewed and how to report content.
We may also share your personal data with third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. We require all third parties to respect the security of your personal data, to treat it in accordance with the law, and to process it only on our instructions and for specified purposes.
6. International transfers
Some of our service providers are based outside the UK, so their processing of your personal data may involve a transfer of data outside the UK. Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is in place:
- we only transfer your personal data to countries that have been deemed by the UK to provide an adequate level of protection; or
- we use specific contracts approved for use in the UK which give personal data the same protection it has in the UK (the International Data Transfer Agreement, or the International Data Transfer Addendum to the European Commission’s standard contractual clauses).
7. Data security
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. Sign-in credentials are handled by Firebase Authentication (we never store your password), and Firebase App Check helps ensure that only our genuine app can reach our backend. We limit access to your personal data to those who have a genuine need to know, and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator where we are legally required to do so.
8. Data retention
We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including to satisfy any legal, accounting or reporting requirements. In particular:
- Account and Pug & Play Data is retained for as long as you maintain an active account. If you ask us to delete your account, this data is deleted within 30 days, where technically practical.
- Backups and security logs may persist for up to 90 days before being overwritten.
- Pending or rejected adventure submissions are deleted after a short period (typically within 7–30 days).
- Approved community adventures may remain part of the Community Library after your account is deleted, in a form that is not linked to your identity (see also our Terms of Use).
- Supporter and payment records may be retained for up to 6 years where we need them to meet accounting or legal requirements.
You can delete your account yourself, at any time, from Settings → Delete my account. You will be asked to confirm your password, because it cannot be undone. This immediately and permanently removes your account, your pug, your scrapbook, your collection, any unpublished submissions, and any photographs you have uploaded. If you would like a copy of your data first, use Settings → Download my data before you delete.
Approved community adventures you contributed are kept, but the link between them and you is severed, so nothing identifies you as their author. We also keep limited records where we must for legal, safety, moderation, or accounting reasons — for example abuse reports you filed and payment records — with your identity removed from them. In some circumstances we may retain personal data for longer, for example where there is a complaint or a reasonable prospect of litigation.
If you would rather we did it for you, or you can no longer sign in, contact us at pugamochi@drmsite.com.
9. Your legal rights
Under data protection law you have a number of rights in relation to your personal data. You have the right to:
- Request access to your personal data (a “subject access request”), so you can receive a copy of the data we hold about you and check we are processing it lawfully.
- Request correction of incomplete or inaccurate data. You can update some data (such as your pug’s name and appearance) directly in the Game’s Settings.
- Request erasure of your personal data where there is no good reason for us to continue processing it. You can delete your account yourself at any time from Settings → Delete my account (see section 8 on retention).
- Object to processing where we are relying on a legitimate interest as the basis for that use of your data.
- Request the transfer of your personal data to you or a third party in a structured, commonly used, machine-readable format.
- Request restriction of processing of your personal data in certain circumstances.
You can exercise your rights to access and portability yourself at any time: go to Settings → Your data and choose Download my data to receive a copy of everything we hold about your account in a structured, machine-readable JSON file. To exercise any of your other rights, please contact us using the details in section 10.
No fee usually required
You will not usually have to pay a fee to exercise your rights. However, we may charge a reasonable fee, or refuse to comply, if your request is clearly unfounded, repetitive or excessive.
Time limit to respond
We try to respond to all legitimate requests within one month. Occasionally it may take longer if your request is particularly complex or you have made a number of requests; if so, we will notify you and keep you updated.
10. Contact details
If you have any questions about this privacy policy, or you want to exercise your legal rights, please contact us at pugamochi@drmsite.com.
11. Complaints
You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK regulator for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.
12. Children
Pugamochi is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, please contact us and we will delete it.
13. Changes to this privacy policy
We keep our privacy policy under regular review. If we make material changes, we will update the date at the top of this page. Please keep us informed if your personal data changes, for example a new email address.