Privacy Policy

Last updated: 25 September 2026

This policy covers the game Aura Falls and the online service behind it, both made by 4FingerStudios. It is written to be read rather than to be survived, and it describes what actually happens, which you can check against the service's source if you want to.

If you have a question about any of it, write to spooky@4fingerstudios.com.

The short version

You can play without an account. If you sign in, we store the handful of things needed to know who you are and what you own. We do not store your IP address, we do not record your voice, we do not run advertising or analytics trackers, and we never see your payment details.

What we collect, and why

If you never sign in, we collect nothing. The game runs, you can play on your own, and nothing about you reaches us.

If you sign in, we store:

• Your account identity. Your Discord user id, your Discord username and a reference to your avatar image. We take these from Discord when you sign in and refresh them each time, because you can change your name there and the game should not show a stale one. We never see your Discord password, your email address or anything else on your Discord account.
• An account record. An identifier of our own, the date you first signed in and the date we last saw you.
• A sign-in token. A random string that keeps you signed in, with the date it was issued and the date it expires. It is stored on your own computer in the operating system's protected storage, and on our side only as a record that it is valid.
• What you own and how you look. The items in your bag and your storage, the cosmetics you have equipped, and the colours and options you have chosen for your character.
• Your progress. Your experience, your level and your in-game currency.
• Your scores. Your times, placements, waves survived and defeats on the leaderboards, along with a record of the run each score came from so we can tell a real score from a claimed one.
• Reports. If you report a problem or another player, we store what you sent, who sent it, who it was about if it was about somebody, and which session it came from.

We collect these because the game cannot work otherwise: an account you can return to, items that are still yours tomorrow, and leaderboards that are not trivially faked all require us to remember something.

What we do not collect

• Your IP address. Our service does not record it.
• Your voice. In-game voice chat travels directly between players. It never reaches our servers and is never recorded or stored by us.
• Payment details. Purchases are handled entirely by Steam. We never see your card, your address or your billing information.
• Analytics, advertising or tracking. There are none in the game.
• Anything about what you do offline. The single-player game does not report on itself.

Playing with other people

Aura Falls connects players directly to each other. Two consequences worth being clear about:

• The other players in your game can see your IP address, because that is how a direct connection works. This is true of most online games that do not route everything through a server. When a direct connection is not possible, traffic passes through a relay we run instead, which forwards it without reading it.
• Other players see your name, your level and your cosmetics, because that is the point of playing together.

Traffic between players is encrypted.

Who else is involved

• Discord handles signing in. When you choose to sign in, you are sent to Discord, you approve the connection there, and Discord tells us your id, username and avatar. Their own privacy policy governs what they do.
• Cloudflare hosts our service. As part of delivering requests they process standard connection information on our behalf, under their own terms.
• Valve operates Steam, through which the game is sold and downloaded.

We do not sell, rent or share your information with anyone else, and we do not use it for advertising.

How long we keep it

• Your account and what you own: for as long as you have an account.
• Sign-in tokens: until they expire, which is ninety days, or until you sign out.
• Join tickets, the short-lived passes that prove who you are to the players in your game: fifteen minutes.
• Reports: up to two years, so a pattern of behaviour can be seen.
• Records of item movements, kept to stop abuse: seven days.

Your choices

• You can play without signing in. Nothing is stored about you if you do.
• You can sign out at any time, which invalidates the token on our side.
• You can ask for a copy of everything we hold about you, and we will send it to you.
• You can ask us to delete your account, and we will delete it and everything attached to it. Leaderboard entries are removed with it.
• You can ask us to correct anything that is wrong.

Write to spooky@4fingerstudios.com for any of these. We will answer within thirty days. If you are in the UK, the EU or another place with a data protection authority and you think we have handled this badly, you have the right to complain to them.

Children

The game is not directed at children under 13, and you must meet Discord's and Steam's own minimum age requirements to use those services. We do not knowingly collect information from children under 13. If you believe a child has given us information, write to us and we will delete it.

Changes

If we change what we collect, we will update this page and change the date at the top. Substantial changes will also be announced on the game's Steam page.