What to put in a privacy policy for your indie game

This guide is general information, not legal advice. A privacy policy is a statement you are held to, so have a lawyer or privacy professional review yours before launch, especially if children may play your game.

A privacy policy is a plain description of what your game and website do with people's data. Stores, advertising networks, and the laws covered in our COPPA and GDPR guide all expect one as soon as you collect anything: an account, an email address, an analytics event, a crash report, or an ad identifier. Even a small offline game can need one if it includes a third-party SDK that phones home.

The most important rule is that the policy has to be true. A short honest policy beats a long one copied from somewhere else, because the risk comes from saying one thing and doing another. Work through the COPPA and GDPR checklist first, since it produces the list of facts the policy is built from.

Before you write: collect your facts

• Every kind of data your game and site collect, and why. This is the inventory from step 2 of the checklist.
• Every third-party SDK, plugin, and service in your build, and what each one collects and shares. Analytics, ads, crash reporting, social login, and your engine's telemetry all count.
• Where the data is stored, and who can see it.
• How long you keep each kind of data.
• Who your game is for, and whether children under 13 may play it.
• An email address that someone reads, for privacy questions.

The sections to include

1. Who you are and how to reach you

Your studio name, where you operate, and a contact address. People need somewhere to send questions and requests, and the laws expect you to be reachable.

2. What you collect

List each kind of data in plain words: "your email address if you create an account", "your IP address, which our servers receive when you connect", "how far you get in each level". Say what you do not collect when that is a selling point, such as "we do not collect your name, location, or contacts". Describe each item so a player or a parent could understand it.

3. Why you collect it, and the legal basis

Say what each kind of data is used for, such as running the game, fixing crashes, or improving levels. If you serve players in the EU or UK, the law asks you to name a lawful basis for each use, such as providing the service you promised, your legitimate interests, or the person's consent. Keep this short and specific.

4. Who you share it with

Name the kinds of services that receive data, and ideally the services themselves: your analytics provider, your hosting provider, your email provider, your payment processor. Say whether you ever sell data. For most indie games the honest answer is that you do not, and saying so clearly helps.

5. Cookies and similar technologies

If your site or web game sets cookies, uses local storage for anything other than keeping the game working, or loads analytics or ad scripts, say so, and explain how people can accept or decline. See the guide to cookie consent for web games.

6. Children

State who the game is for. If it is not aimed at children, say you do not knowingly collect personal information from children under 13 and explain what happens if you learn that you have. If it is aimed at children, the policy needs more: what you collect from them, how a parent can give consent, how a parent can review or delete data, and who to contact. This section is the one to have a lawyer check.

7. How long you keep data

Give a time or a rule for each kind of data, such as "crash reports are deleted after 90 days" or "account data is deleted when you delete your account". Then make sure you actually do it.

8. People's rights, and how to use them

Explain how someone can see, correct, export, or delete their data, and how to object to its use. Name the contact address and say how quickly you will reply. For EU and UK players the answer must arrive within one month. A simple, tested process matters more than long wording.

9. Security

One or two honest sentences: you use HTTPS, you hash passwords, you limit who can reach the data. Do not promise that data is "completely secure".

10. International transfers

If your servers or vendors are in another country from your players, say so. For EU and UK players, check how data transferred outside those regions is protected, usually through the safeguards your vendor describes in its data processing agreement.

11. Changes and the date

Put the date at the top, say how you will tell people about changes, and keep older versions. If a change affects children's data or how you use data, treat it as more than a note at the bottom of the page.

Writing it well

• Use plain language and short sentences. The regulators' own guidance asks for text that your audience can understand, and that includes parents reading on a phone.
• Describe your game, not a template. Generators and examples are a starting point. Delete every sentence that does not apply and add the ones that do.
• Update it whenever you change what you collect. Adding an SDK, an account system, or a new platform is the moment to reread it.
• Match your store forms. The answers you give in Steamworks, on itch.io, and in ad network settings should say the same thing as your policy.

Where to publish it

• On a stable page of your own website, with a plain address you can put anywhere.
• Linked from your store pages, such as the privacy policy field on Steam or the description on itch.io.
• Inside the game, from settings or the main menu, so players find it where they play.
• In the footer of your website and next to any form that collects an email address or other data.

When you need more than a policy

A policy describes what you do. It does not replace what the laws require you to do, such as getting parental consent for children under 13 or asking for consent before non-essential cookies. Use the checklist for those steps, and have it reviewed by a professional if your game is for children. For a store page that links your policy and gets the rest right, see the store page checklist.