Privacy & cookies

Who we are

Sheepula — sheepula.com. Contact: daniel@sheepula.com. The legal operator's full name and address are still to be confirmed. The website is separate from the game. No accounts, leaderboards or advertising trackers.

What we collect

Grown-ups can request merch updates. We store your email, interest (plush, vinyl figure or both), optional favourite character, day/night mode, consent and consent time, signup time, a record ID and the website source. We also store a random confirmation token and when we sent, you confirmed or you unsubscribed. The form is for people aged 18+ or a parent/guardian, not for children to submit their own details.

The necessary spam check uses a hidden form field and validation, not a third-party CAPTCHA. Hosting may process IP addresses and basic request information for delivery and security. The hosting log details still need confirmation.

Why

We use double opt-in: after signup we email you a confirmation link, and you only get merch updates after clicking it. Confirmation emails come from Daniel from Sheepula (daniel@sheepula.com), sent through our email provider Resend, which processes your email address on our behalf. With your separate signup consent, we use your details to send requested merch updates. Necessary storage remembers your display preference and cookie choices. Statistics and marketing are optional and off by default. No statistics software or marketing pixels are installed today, even if you accept those categories. Hosting security and delivery are separate operational purposes whose legal basis must be reviewed.

How long

Cookie choices expire after 12 calendar months or a consent-version change. Day/night preference stays until you clear it. Signups that are never confirmed are deleted after 30 days. Retention for confirmed signups and hosting logs is not yet defined. These periods must be agreed and implemented before launch.

Your rights

You can withdraw signup consent at any time with the unsubscribe link in every email or by emailing us, without affecting earlier lawful processing. Ask for access, correction, deletion, restriction or portability where applicable, or object where processing relies on legitimate interests. You can change optional cookie permissions using Cookie settings. You may complain to Sweden's Integritetsskyddsmyndigheten (IMY), or your local data protection authority. Exercising your rights does not require an account.

Cookies

The public site currently sets no browser cookies or sessionStorage entries. It uses localStorage:

• sheepula-mode: necessary day/night preference.
• sheepula-cookie-consent: necessary category choices, version and timestamp, valid for 12 months.

Images, first-party gameplay videos and the Creepster/Patrick Hand fonts are delivered through the site's asset service. Fonts no longer contact Google Fonts. Signup goes to a same-origin form handler, then to Lovable Cloud privately, and the confirmation email is sent via Resend; no database request runs just from visiting the page. No third-party video embeds, analytics SDKs, advertising pixels or cross-site tracking are installed. Preview editor/development requests are not visitor analytics. Platform-level production analytics and hosting logs still need verification before launch.