Privacy Policy

Last updated: 10 July 2026.

1. Important information and who we are

Purpose of this privacy policy

This privacy policy gives you information about how Pugamochi collects and uses your personal data through your use of our website and game (the “Game”), including any data you provide when you adopt a pug, play, or submit an adventure.

Controller

DRMSite Ltd (company number 17151917, whose registered office is at 40 Elm Close, Witchford, Ely, CB6 2JH) is the controller and responsible for your personal data (collectively referred to as “Pugamochi”, “we”, “us” or “our” in this privacy policy).

If you have any questions about this privacy policy, including any requests to exercise your legal rights (section 9), please contact us using the contact details set out in section 10.

2. The types of personal data we collect about you

Personal data means any information about an individual from which that person can be identified. We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

• Account Data includes the email address you use to sign in. Your password is handled by Firebase Authentication and is never stored by us in readable form.
• Pug & Play Data includes your pug’s name and appearance, its stats, your journal/scrapbook entries, items you have collected, and your focus-timer (Pug-modoro) activity.
• Contribution Data includes any adventure you choose to submit to the community library — a title, a story, and an optional image.
• Supporter Data includes information Ko-fi sends us when you support the work — such as your name or display name, email address, payment amount, currency, payment type, a transaction/message ID, and whether the payment relates to monthly support — which we use to record your supporter status and the date your supporter extras run until. We do not receive or store your card or bank details.
• Technical Data includes internet protocol (IP) address and device/browser signals processed by Firebase App Check and Google reCAPTCHA to tell genuine app traffic from automated abuse.

Data we do not intentionally collect

We do not intentionally collect precise location data, phone numbers, date of birth, health information, school information, or other special category data.

3. How is your personal data collected?

We use different methods to collect data from and about you, including:

• Your interactions with us. You give us personal data by using the Game — when you adopt a pug and create an account, name and design your pug, submit an adventure, or contact us.
• Automated technologies. As you use the Game, Firebase App Check and reCAPTCHA automatically collect Technical Data to keep the service secure. We do not use advertising or analytics cookies. Security services such as Firebase App Check and reCAPTCHA may use technical signals, cookies, or similar technologies to help protect the app from abuse.
• Ko-fi. If you support the work, Ko-fi sends us a notification about your payment (see “Supporter Data” above for what this includes) so we can record your supporter status. We do not receive your card or bank details.

4. How we use your personal data

Legal basis

The law requires us to have a legal basis for collecting and using your personal data. We rely on one or more of the following:

• Performance of a contract with you — where we need to provide the Game you have signed up for.
• Legitimate interests — where it is necessary to run and secure the Game, moderate submitted content, and record supporter status, provided your rights do not override those interests.
• Legal obligation — where we must process data to comply with the law.
• Consent — where you have actively agreed, for example when you choose to submit an adventure for possible sharing.

Purposes for which we will use your personal data

Marketing

We do not carry out any direct marketing, advertising, or profiling, and we do not send notifications to draw you back into the Game. Time away from Pugamochi is part of the game.

5. Disclosures of your personal data

We may share your personal data where necessary with third parties who provide services to us, namely Firebase (Google) for authentication, database, file storage, hosting and running our backend functions, and Ko-fi (Ko-fi Labs Ltd) for handling supporter payments.

Community sharing. If you submit an adventure and it is approved by a moderator, the adventure content you provided (its title, story and image) may be shown to other players in their own scrapbooks. Your email address is never shown to other players, and it is never published alongside an approved adventure. Our moderators can see the email address of the account that submitted an adventure while it is waiting to be reviewed, so that they can recognise repeat submissions, follow up with you about your adventure where necessary, and act on misuse. Please do not include real names, addresses, school or workplace names, identifiable photos, or other personal or identifying information in a submitted adventure. Our Safety & Moderation policy explains how submitted adventures are reviewed and how to report content.

We may also share your personal data with third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. We require all third parties to respect the security of your personal data, to treat it in accordance with the law, and to process it only on our instructions and for specified purposes.

6. International transfers

Some of our service providers are based outside the UK, so their processing of your personal data may involve a transfer of data outside the UK. Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is in place:

• we only transfer your personal data to countries that have been deemed by the UK to provide an adequate level of protection; or
• we use specific contracts approved for use in the UK which give personal data the same protection it has in the UK (the International Data Transfer Agreement, or the International Data Transfer Addendum to the European Commission’s standard contractual clauses).

7. Data security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. Sign-in credentials are handled by Firebase Authentication (we never store your password), and Firebase App Check helps ensure that only our genuine app can reach our backend. We limit access to your personal data to those who have a genuine need to know, and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator where we are legally required to do so.

8. Data retention

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including to satisfy any legal, accounting or reporting requirements. In particular:

• Account and Pug & Play Data is retained for as long as you maintain an active account. If you ask us to delete your account, this data is deleted within 30 days, where technically practical.
• Backups and security logs may persist for up to 90 days before being overwritten.
• Pending or rejected adventure submissions are deleted after a short period (typically within 7–30 days).
• Approved community adventures may remain part of the Community Library after your account is deleted, in a form that is not linked to your identity (see also our Terms of Use).
• Supporter and payment records may be retained for up to 6 years where we need them to meet accounting or legal requirements.

You can delete your account yourself, at any time, from Settings → Delete my account. You will be asked to confirm your password, because it cannot be undone. This immediately and permanently removes your account, your pug, your scrapbook, your collection, any unpublished submissions, and any photographs you have uploaded. If you would like a copy of your data first, use Settings → Download my data before you delete.

Approved community adventures you contributed are kept, but the link between them and you is severed, so nothing identifies you as their author. We also keep limited records where we must for legal, safety, moderation, or accounting reasons — for example abuse reports you filed and payment records — with your identity removed from them. In some circumstances we may retain personal data for longer, for example where there is a complaint or a reasonable prospect of litigation.

If you would rather we did it for you, or you can no longer sign in, contact us at pugamochi@drmsite.com.

9. Your legal rights

Under data protection law you have a number of rights in relation to your personal data. You have the right to:

• Request access to your personal data (a “subject access request”), so you can receive a copy of the data we hold about you and check we are processing it lawfully.
• Request correction of incomplete or inaccurate data. You can update some data (such as your pug’s name and appearance) directly in the Game’s Settings.
• Request erasure of your personal data where there is no good reason for us to continue processing it. You can delete your account yourself at any time from Settings → Delete my account (see section 8 on retention).
• Object to processing where we are relying on a legitimate interest as the basis for that use of your data.
• Request the transfer of your personal data to you or a third party in a structured, commonly used, machine-readable format.
• Request restriction of processing of your personal data in certain circumstances.

You can exercise your rights to access and portability yourself at any time: go to Settings → Your data and choose Download my data to receive a copy of everything we hold about your account in a structured, machine-readable JSON file. To exercise any of your other rights, please contact us using the details in section 10.

No fee usually required

You will not usually have to pay a fee to exercise your rights. However, we may charge a reasonable fee, or refuse to comply, if your request is clearly unfounded, repetitive or excessive.

Time limit to respond

We try to respond to all legitimate requests within one month. Occasionally it may take longer if your request is particularly complex or you have made a number of requests; if so, we will notify you and keep you updated.

10. Contact details

If you have any questions about this privacy policy, or you want to exercise your legal rights, please contact us at pugamochi@drmsite.com.

11. Complaints

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK regulator for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.

12. Children

Pugamochi is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, please contact us and we will delete it.

13. Changes to this privacy policy

We keep our privacy policy under regular review. If we make material changes, we will update the date at the top of this page. Please keep us informed if your personal data changes, for example a new email address.