Last updated: 30 September 2026
THE STILL ROOM is run by Barton Technology Ltd, trading as Nutty Orange (company number 03930086). We are the data controller for the information below. Registered office: 20 Market Place, Kingston Upon Thames, KT1 1JP. Correspondence: Suite 652, 124 City Road, London, EC1V 2NX. Email: help@nuttyorange.com.
Your account: your email address and, if you set one, a password (stored only as a secure hash). We need these to sign you in and keep your game yours. Lawful basis: performing our contract with you.
If you join someone else's game: you give your email address and a name, and confirm the email with a one-time code we send you. We collect your email to run the game: to sign you in, to keep your place on the host's game pass (a pass holds a group of up to 6 people, and the host who paid can see a hidden version of your address, such as j***@gmail.com, and the name you played under, and can remove you from it) and to let you replay with the same group. Lawful basis: performing the contract with the host who bought the game, and our legitimate interest in stopping one pass being shared with more people than it covers. We don't use your email to market to you unless you tick the box on the join screen (below).
News of new games (only if you tick the box): the join screen has a “Send me news of new games” box, and it is not ticked unless you tick it. If you tick it, we record that you agreed, and when, and add your email address to our games mailing list (from Nutty Orange, who make THE STILL ROOM). Lawful basis: your consent, which you can withdraw at any time using the unsubscribe link in any of those emails, or by emailing help@nuttyorange.com. If you don't tick it, we don't market to you, and joining works exactly the same.
Your purchase: your name, email, country, what you bought, the price and the payment reference. Card details go straight to Stripe and never reach us. We keep purchase records to give you access, handle refunds and meet tax law. Lawful basis: contract, and legal obligation.
Your game: the group you play in, the display name you choose, and your progress, so everyone in the group sees the same house and you can carry on later. Lawful basis: contract. We also look at how games play in aggregate (for example, how long groups spend on each puzzle, where they ask for hints or give up, and which wrong answers they try) so we can make the puzzles and hints fairer. That uses the game's own record with anonymous game ids, never your name or email, and needs no cookies. Lawful basis: our legitimate interest in improving the game.
Basic security logs: IP address and browser details on requests, briefly, to stop abuse and keep the site working. Lawful basis: our legitimate interest in running a secure service.
Your review: if you rate the game when you finish, we store your stars and anything you write, with details of the game (group size, hints, time, scares on or off), to improve it. It stays private unless you tick “Can we quote you?”, and even then we only publish your words, stars, the name you give and your town (if given) after reading them. Lawful basis: our legitimate interest in improving the game, and your consent for anything we publish.
Problem reports: if you use “Report a problem” in the game, we store what you write with your account, the game's state at that moment (where you are, what you carry, progress), your device type, browser and screen size, and any recent error on the page, so we can reproduce and fix it. We only reply, by email, if you tick “I'd like a reply”. Lawful basis: our legitimate interest in fixing the game. Kept for 12 months.
We email you about your purchase and your sign-in, plus at most one email the day after your first game asking how it went. That follow-up can also include offers on Nutty Orange's other games, so it carries an unsubscribe link. If you use it, we keep your email address on a suppression list (so we don't email you that kind of message again) until you ask us to remove it. Sign-in and purchase emails aren't affected.
Emails about our other games: when you buy, the checkout tells you we'll also email you about our other games (from Nutty Orange, who make THE STILL ROOM), and gives you a “Don't email me about other games” box. If you leave it unticked, we add your email address to our games mailing list and record that you bought and when. If you tick it, we don't. Lawful basis: the “soft opt-in” in the UK Privacy and Electronic Communications Regulations, which lets a business email its own customers about similar products provided they were given a simple way to refuse. Every one of those emails has a one-click unsubscribe link, or email help@nuttyorange.com, and we stop. If you had already unsubscribed from our emails, buying does not sign you back up. We don't send marketing to anyone else unless they have separately agreed to it.
Some games offer a microphone or camera feature, always off unless you tick it on the setup screen before you play — see docs/camera-and-microphone.md in our codebase for the underlying design rules. Nothing you say or film is ever recorded, uploaded or stored by us. If a game listens for sound, your browser measures loudness on your own device and never keeps the audio itself. If a game uses your camera for a photo feature (for example, a group photo at the end of THE STILL ROOM), the photo is taken and edited entirely on your own device using your browser's own tools, and never touches our servers. In THE STILL ROOM, if you have switched the camera on, one moment in the nursery mirror also shows your own live camera picture inside the mirror's glass for a couple of seconds: it is drawn and analysed on your device only (to work out where you are in the picture), is never recorded, saved or sent anywhere, and the camera is switched off again straight afterwards. Where a game builds a group picture from more than one player's device, each player's photo travels directly, phone to phone, over an encrypted peer-to-peer connection (a standard called WebRTC) — our server only helps the devices find each other and cannot see or keep the photo. Once the picture is made, each device deletes the others' photos. You choose whether to save or share the finished picture yourself; we never see it unless you choose to send it to us. You can switch either feature off again at any time from inside the game, and every game works fully with both switched off. Lawful basis: your explicit consent, given on the setup screen before either feature is used, which you can withdraw at any time by switching it back off.
Supabase (accounts and game data, stored in London), Vercel (hosting), Stripe (payments), Emailit (sign-in and receipt emails), Cloudflare (the Turnstile bot check on sign-in and guest joining), Sentry (error reports when something on the site breaks: the page, browser and technical details of the error, not your name or email), Google Analytics, PostHog, Rybbit and Meta (see below) and our own email platform for purchase records and the games mailing list. Each processes data only on our instructions. Where a provider is based outside the UK, appropriate transfer safeguards apply. We never sell your data.
Game progress: 12 months after your access ends. Your account: until you ask us to delete it. Purchase records: 6 years, because tax law requires it. Security logs: up to 30 days.
Under UK GDPR you can ask for a copy of your data, have it corrected or deleted, restrict or object to how we use it, and receive it in a portable form. Email help@nuttyorange.com from the address on your account and we will reply within one month. You can also complain to the Information Commissioner's Office at ico.org.uk.
Strictly necessary cookies and browser storage keep you signed in, keep the site secure and remember your cookie choice. They are always on. This includes Cloudflare Turnstile, which checks that a real person (not a script) is signing in or joining a game: when you use those forms it runs a short check in your browser and Cloudflare receives technical details of your browser and connection (such as your IP address) for that check only, not for advertising. Lawful basis: legitimate interest in keeping accounts and games safe from automated abuse.
Analytics: we use Google Analytics 4 to understand how people find the game, how many buy it and how the game plays (for example, where groups ask for hints), so we can improve it. With your consent it sets cookies that recognise a returning browser. If you decline, we use Google's Consent Mode: Google receives only cookieless signals with no identifier, which it models in aggregate. When you buy, the checkout sends the purchase (order reference, product and price, not your name, email or card) to Google Analytics, so we can see which campaign led to the sale. Where you arrived from an ad or link carrying campaign tags, we keep those tags with your order for the same reason. Lawful basis: consent for analytics cookies; legitimate interest for the cookieless and purchase signals. Google processes this data in the US under appropriate safeguards.
Heatmaps and session recordings (analytics consent only): we use PostHog (EU servers) to see how visitors use the site and the checkout: where people click and scroll, and anonymised recordings of visits, so we can fix confusing pages and test improvements. Everything typed into forms is masked and never recorded, and the admin and sign-in pages are never recorded. It only runs if you accept analytics cookies, and you can withdraw that at any time below.
Rybbit (analytics consent only): a privacy-focused analytics tool that counts visits and pages viewed so we can see how the site is used. It runs only if you accept analytics cookies.
Advertising and remarketing (only if you say yes): advertising cookies let us measure whether our ads work and show you THE STILL ROOM ads on other websites and apps after you have visited, which is commonly called remarketing. We currently use Meta (Facebook and Instagram) for this, and may add Google Ads and similar advertising platforms, which will be listed here as they are adopted. With your consent, information about your visit (such as the pages you viewed, whether you clicked to buy, an advertising identifier and your approximate location) is shared with those platforms so they can measure our campaigns and build audiences. Nothing advertising-related runs until you choose, and analytics consent is never treated as advertising consent.
When you buy, the checkout also tells Meta a purchase was made (the order reference, price and currency, plus your email address in hashed form and, where present, the ad-click identifier), so we can tell which ad led to the sale. Where you have not consented to advertising cookies, no advertising cookie is read or set to do this. Lawful basis: consent for advertising cookies; legitimate interest for measuring whether our paid ads lead to sales. These platforms act as independent or joint controllers for that advertising activity, so their own privacy policies also apply, and they may process data outside the UK under appropriate safeguards.
You can review or change your choice at any time: Cookie settings.