Privacy policy
What we collect, why, and what you can do about it.
Last updated 1 October 2026
1. Who we are
Yearworm is run by Orbisa Consulting Limited, trading as Yearworm, a company registered in England and Wales (company number 09141266), registered office 35a Cologne Road, London, SW11 2AH. We are the “controller” of your personal information under UK data protection law. Contact us at support@yearworm.com with any privacy question.
2. The short version
- You can play the free version without telling us who you are.
- If you join the waiting list or buy the full game, we hold your email address.
- Your card details go to Stripe, not to us.
- We don’t use advertising or analytics trackers, and we don’t sell your information.
3. What we collect and why
| Information | Why we use it | Our legal basis |
|---|---|---|
| Email address, when you log in, join the waiting list or buy | To log you in, tell you when the full game is ready (waiting list), send receipts and renewal reminders, and answer you | Contract (providing the game); consent (waiting list) |
| Name, if you give one at checkout | To identify your account and payment | Contract |
| Payment details: handled by Stripe. We receive your name, email, a customer and subscription reference, and whether your subscription is active. We never see your full card number. | To take payment, run your subscription, issue refunds and keep financial records | Contract; legal obligation (tax and accounting) |
| Device information: a random device ID and the device type (for example “iPhone”), plus when it was last used | To enforce the three-device limit and show you or us which devices are logged in | Contract; our legitimate interest in preventing account sharing |
| Account status: whether you’re a member, when you joined, and, if you cancel, when your subscription ended | To give you access, manage cancellations and understand how many people subscribe and stay | Contract; our legitimate interest in running the business |
| Technical logs: your IP address and browser details, held by our hosting provider when you visit | To keep the service secure and working | Legitimate interest |
If you contact us, we keep your message and our reply so we can help you.
4. Information stored on your own device
Yearworm stores small items in your browser’s local storage, not cookies. They are needed for the game to work: your login, your device ID, your game in progress, player names, your Spotify or Apple Music choice, which pack options you picked, the songs you’ve heard in the free version, and the daily free-play counts. They stay on your device, and clearing your browser data removes them. We don’t use advertising or analytics cookies, so there’s no cookie banner.
5. Who we share it with
We use these companies to run Yearworm. They handle your information only as we instruct, or under their own privacy policies where noted:
- Stripe takes your payments and manages subscriptions. For payments, Stripe also acts as an independent controller under its own privacy policy.
- Netlify hosts the site and stores our member records (email, name, device list, subscription status) and the waiting list.
- jsDelivr, a content network, serves the small library that draws the QR code, so your IP address is visible to it when the game loads.
- Spotify and Apple Music: when you tap a song, you leave Yearworm and your device connects to them. We don’t send them anything about you, and their own privacy policies apply.
- Our accountants and other professional advisers, where we need them, and the authorities if the law requires.
We never sell your personal information or use it for advertising.
6. Sending information abroad
Some of these companies, including Stripe and Netlify, process information outside the UK, for example in the United States. Where they do, they rely on approved safeguards such as the UK’s data transfer mechanisms or standard contractual clauses.
7. How long we keep it
- Waiting list: until we tell you the full game is ready, or you ask us to remove you.
- Member record (email, name, devices): while your subscription is active. When it ends we remove your access.
- Record that you were a subscriber (email, name, join and end dates): kept so we can see how many people join and leave, until you ask us to delete it.
- Payment and invoice records: up to six years after the payment, which is how long the law and our accountants require us to keep financial records.
- Hosting logs: for the period our hosting provider keeps them, normally a few weeks.
8. Your rights
Under UK data protection law you can ask us to: tell you what we hold about you; correct it; delete it; restrict or object to how we use it; and give you a copy in a portable format. You can withdraw your consent, for example to the waiting list, at any time. We’ll answer within one month. Some information, such as payment records, we have to keep by law.
To use any of these rights, email support@yearworm.com from the address you used with Yearworm. If you’re unhappy with how we’ve handled your information, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We’d appreciate the chance to put it right first.
9. Children
Yearworm isn’t aimed at children under 13, and we don’t knowingly collect their information. Subscriptions are for adults. If you think a child has given us their details, tell us and we’ll delete them.
10. Changes
If we change this policy, we’ll post the new version here with its date, and email subscribers about any change that matters to them.