Apartment Chaos Privacy Policy

Last updated: October 10, 2026
Game: Apartment Chaos (Windows and macOS, distributed on Steam)
Controller: Furkan Alniak, sole proprietor, trading as Creatorium Labs, Vestre Teglgade 2F, 1. th., 2450 Copenhagen, Denmark
Contact: info@creatorium.org
Türkçe: Gizlilik Politikası

This policy explains what information Apartment Chaos collects, why, where it goes, how long we keep it and what you can do about it. We wrote it in plain language. "We", "us" or "Creatorium Labs" means the controller named above. "The game" means Apartment Chaos and the online services we run for it (room servers, the account and coin service, reports and support).

We do not sell your personal information, we do not show ads, and we do not use your data to build advertising profiles. The game contains no third-party analytics or advertising SDK, and we do not use Unity's cloud services (Unity Gaming Services, Unity Analytics or Unity Ads).

Summary

To play online we use your Steam identity (Steam ID and Steam name) and pass your voice and text chat to the players in your room. Voice and chat are relayed in real time and never recorded or stored.
To keep your coins and items we keep a small account on our server.
To keep matches fair we store player reports, moderation decisions and short records of players who leave matches early.
Usage statistics are off unless you turn them on.
Crash reports are sent automatically, with personal details removed.
Our game servers are in the European Union (Finland and Germany).

Legal bases

Under the EU General Data Protection Regulation (GDPR) we rely on:

Contract (Art. 6(1)(b)): to provide the game you chose to play: online rooms, voice and text chat, your coin and item account, purchases, friend invites, Steam Cloud saves.
Legitimate interests (Art. 6(1)(f)): to keep the game secure, fair and working: crash reports, abuse limits, player reports, moderation, penalties for leaving matches, feedback, fraud and refund checks, backups. We have weighed these interests against your rights and keep the data to the minimum we need.
Consent (Art. 6(1)(a)): for optional usage statistics. You can withdraw consent at any time in the game's settings.
Legal obligation (Art. 6(1)(c)): for purchase and accounting records we must keep by law.

Players in Turkey: see "Players in Turkey (KVKK)" below.

What we collect and why

Steam identity and your name

When you play with Steam running, the game uses your Steam ID and your Steam name. If you type a different display name, we use that instead. Without Steam the game creates a random player ID on your computer.

Your display name and player ID are sent to the room server when you join and are visible to the other players in your room. Your player ID contains your Steam ID, which is public on Steam anyway.
Your Steam avatar is shown only on your own screen.

Voice chat

Voice chat is push-to-talk by default (you can switch to open mic or turn it off). When you talk, your voice is encoded on your computer and relayed in real time through our own room server only to the players who are allowed to hear it (for example nearby players, your team at night, or other ghosts). Volume and the effect of walls are applied on each player's computer. No outside voice service is involved.

We do not record, store or analyse voice. The server passes each piece of audio on and forgets it. You can mute any player on your own computer; your mutes are stored only on your computer and nobody is told.

Text chat

Messages (up to 120 characters) are relayed by the room server only to the players allowed to read them. We do not log or store chat messages. Please do not share personal information in chat: other players can read it.

Developer visits

Our developer can join a room as an invisible spectator, for example to check a problem or a report, and can choose to become visible and say hello. A spectator sees the room as any player would and hears only the room's open voice, never a team's private channel or the ghosts' channel. Nothing is recorded.

Your account, coins and items

When you first start the game online, it creates an account on our server with a random account ID and a secret. We store only a hash of the secret, never the secret itself. The account holds your coins, owned items, experience and level, daily and weekly goals, the date it was created, the time it was last used, a list of recent operations (to prevent double spending) and the player ID and display name most recently seen with it. If you buy coins, we also store your Steam ID on the account. If you redeem a gift code, we keep a one-way hash of your player ID with the code so it cannot be used twice.

Your profile (name, appearance, items, custom game modes, achievement progress, and the account ID and secret) is also saved on your computer and, if Steam Cloud is on, in Steam Cloud, so it follows you between computers.

Changes our team makes to an account (for example a refund correction) are logged with the reason.

Purchases

If coin purchases are available, they are handled entirely by Steam's own payment system. We never see your card or payment details. To complete an order, our server asks Steam for your wallet currency and country (used only to pick the price) and then stores an order record: order ID, account, Steam ID, pack, number of coins, amount, currency, status, dates and Steam's transaction ID. We check Steam's reports regularly to process refunds.

Fair play: reports, moderation and leaving matches

Player reports: when you report a player we store the time, your player ID and name, the reported player's ID and name, the reason, your optional note (up to 300 characters), the room code, the game version and whether a match was running. The reported player is not told who reported them.
Moderation: bans, mutes and waiting penalties are stored against a player ID with their end time, reason and who set them.
Leaving matches: if you leave online matches early, we record when it happened and how many matches you finished since, to apply increasing waiting penalties. These records stop counting after a time window (currently 24 hours, never more than 7 days).
Kicks from a room are kept only in memory until the room closes.

Feedback

If you send feedback from the pause menu, we store the topic, your message (up to 2,000 characters), your player ID and name, game version, platform, language, the room you were in and, if you leave the option on, a screenshot of your game screen at that moment (it may show other players' names or chat). You see the screenshot before sending and can switch it off.

Crash and error reports

When the game crashes or hits a serious error, it sends a report so we can fix it: the error message and stack trace, game version, operating system, graphics card, graphics setting, the scene, whether a match was running and how long the game had been running. Before sending, the game removes personal details such as folder paths with your user name, e-mail addresses, IP addresses, Steam IDs, your player name and your computer's name; the server repeats this cleaning and does not store the sender's IP address with the report. You can start the game with -nocrashreport to switch this off.

Optional usage statistics

Off by default. If you agree (on the first-launch card or in Settings > Privacy), the game sends anonymous events to our own server: a random installation ID, a session ID, version, platform, language and events from a fixed list, such as "app opened", "menu button clicked", tutorial steps, "match started" (game mode and your team), "meeting reached", "vote cast", "match ended" (won or lost, minutes), "match left" and "pack bought". These contain no name, no Steam ID, no account ID and nothing you type. Until you agree, events stay on your computer (up to 300) and are deleted if you say no or turn the option off. To stop sending, turn off Settings > Privacy > Send anonymous usage data.

Friends, invites and online status

While you are in the menus or a lobby, the game tells our server every 20 seconds that you are online, with your player ID, name and the IDs of players you recently played with, so they can see you and invite you. Invites (including the room code and the room password, if there is one) are held for 45 seconds and online status for 75 seconds, in memory only. The main menu shows how many people are online; our server answers that with totals only.

Steam features: the game sets Steam Rich Presence so your Steam friends see where you are (menu, lobby, a match by day or by night) and how many players are in your room. It also gives Steam the room's join details (room code and, if set, password) so a friend can click "Join game"; Steam makes these available to your Steam friends. Achievements are stored by Steam.

IP addresses and server logs

Your IP address is used to connect you to a room and to limit abuse (for example how many requests one address can send). These limits are kept in memory only. Our web service writes an access log line for each request; if your request reaches us directly rather than through Cloudflare, that line contains your IP address. Room servers write technical logs that can include player names (for example when a cheat is detected). All of these logs are rotated automatically by size (at most 30 MB per service) and are therefore kept only for a short time.

Match statistics

Room servers record match results for balancing (roles, teams and outcomes). These records contain no names and no player or Steam IDs. To avoid giving the same player the same role again and again, room servers keep the last 6 roles played per display name (at most 3,000 names; the oldest drop out).

Discord

The main menu has a button to our Discord community. To show a current invite, the game asks Discord's public server widget (discord.com) for an invite link. That request goes from your computer to Discord, so Discord sees your IP address as it would for any website visit; the game sends Discord no other data. If you open the link, Discord's privacy policy applies.

Data stored only on your computer

Settings, key bindings, your profile, achievement progress, your last 20 matches and up to 30 recent players (IDs and names, for the "recent players" list), your local mutes, the selected microphone, the queued usage events (only while you have not agreed) and caches. You can delete them by uninstalling the game and removing its data folder.

Who we share data with

We do not sell data. We share it only with:

Other players in your room: your display name, player ID, voice and chat, as described above.
Valve Corporation (Steam): identity, achievements, Steam Cloud, Rich Presence, invites and purchases. Valve is an independent controller for Steam; see Valve's privacy policy.
Hetzner Online GmbH: hosts our servers in the European Union (currently Finland; extra room servers, when needed, in Germany).
Cloudflare, Inc.: sits in front of our game service address (apartmentchaos.creatorium.org) for security and delivery and processes request data, including IP addresses.
Vercel Inc.: hosts this website.
Discord Inc.: only through the invite request and link described above.
Authorities, only when the law requires it.

International transfers

Our game servers and your account data are in the European Union. Some providers are based in the United States: Valve (an independent controller for Steam), Cloudflare and Vercel. Where personal data reaches them, the transfer is covered by the EU-US Data Privacy Framework and/or the European Commission's standard contractual clauses.

How long we keep data

Voice and text chat: not stored.
Account, coins and items: while the account is in use. Accounts with no activity for 3 years are deleted automatically, or sooner on request.
Purchase records: as long as accounting law requires (Danish law: 5 years after the end of the financial year).
Player reports, feedback and feedback screenshots: 12 months, then deleted automatically.
Crash reports: 12 months at most, then deleted automatically. They are also kept in size-limited files, so older reports may go sooner.
Usage statistics: in size-limited files where the oldest events drop out as new ones arrive, and 12 months at most.
Moderation decisions: until they expire, then removed. Permanent bans stay while they are needed.
Leaving-match records: they stop counting after the time window above (at most 7 days) and are removed when our server next processes a match of yours.
Online status and invites: 75 and 45 seconds, in memory.
Server logs: rotated automatically by size (a short time).
Backups: 7 days.

Your rights

Under the GDPR you can ask us to access, correct or delete your data, to restrict processing or object to processing based on legitimate interests, and to receive your account data in a portable form. You can withdraw consent for usage statistics at any time in the game's settings; this does not affect what was sent before.

To use these rights, write to info@creatorium.org with your in-game name and, if possible, your Steam profile link. We may ask for proof that the account is yours. We answer within one month.

You can also complain to the Danish data protection authority, Datatilsynet (datatilsynet.dk), or to the authority where you live.

Players in Turkey (KVKK)

If you live in Turkey, the Turkish Personal Data Protection Law No. 6698 (KVKK) also applies. We process your data for the purposes and on the bases described above (performance of a contract, our legitimate interests, legal obligations and, for usage statistics, your explicit consent). Your data is stored on servers in the European Union, so it is transferred abroad; we do this only for the purposes in this policy and with the safeguards described under "International transfers".

Under Article 11 of the KVKK you can ask whether we process your data, request information about it, learn the purpose and whether it is used accordingly, know who it is shared with in Turkey or abroad, ask for correction, deletion or anonymisation and for third parties to be told, object to a result that goes against you and comes only from automated processing, and claim compensation for damage caused by unlawful processing. Send your request to info@creatorium.org; we answer within 30 days. If you are not satisfied with our answer, you can complain to the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu, kvkk.gov.tr).

Children

Apartment Chaos is not directed at children under 13 and is subject to Steam's age requirements. The game has open voice and text chat with strangers. If we learn that a child below the age of digital consent in their country (13 in Denmark) has used our online services without a parent's consent, we delete their account and the related data, except what we must keep by law. If you believe this has happened, contact us.

Security

Voice and chat go only to the players allowed to receive them; the server decides, not the players' computers.
Account secrets are stored only as hashes.
Requests that carry your account secret or a room password are always encrypted (HTTPS). Other requests to our service use HTTPS too; if that address cannot be reached, requests without secrets (such as crash reports) may fall back to an unencrypted connection.
The game connection inside a room (movement, voice and chat) is not end-to-end encrypted, which is another reason not to share private information in chat.
The admin panel is not reachable from the public internet, and crash reports are cleaned of personal details.

No system is perfectly secure. If a breach affects you, we will tell you and the authorities as the law requires.

This website and cookies

This website (creatorium.org) sets no cookies and uses no analytics or tracking. Fonts are served from this website itself. Our host, Vercel, processes your IP address and basic request data to deliver the pages and protect the site.

Changes

We will update this page when the game or our practices change and change the "last updated" date above. For important changes we will also tell players in the game or on the Steam page.

Contact

Creatorium Labs (Furkan Alniak), Vestre Teglgade 2F, 1. th., 2450 Copenhagen, Denmark. info@creatorium.org