Privacy notice
Last updated 20 August 2026. Changed: named the email provider, and added how long an unconfirmed address is kept.
Short version: I collect your email address so I can tell you about the game. I don't sell it, share it, or do anything else with it. You can have it deleted the same day you ask.
Who's responsible
Second Chance Game is the data controller for this site — a sole developer based in England. Contact: [email protected].
What I collect, and why
| What | Why | Lawful basis |
|---|---|---|
| Your email address | To send you updates about Second Chance and the demo when it exists | Consent |
| Signup time, and the exact consent wording you were shown | So I can prove what you agreed to, if I'm ever asked | Legal obligation |
| Which video or link brought you here | To know which videos are worth making | Legitimate interests |
| Your country (2-letter code) and browser user-agent | Rough audience picture. No city, no precise location. | Legitimate interests |
| A one-way hash of your IP address | Spam and abuse prevention on a public form | Legitimate interests |
Your email address is encrypted where it's stored. It is held in the database as ciphertext (AES-256-GCM), and the key is not in the database — it lives separately, as a platform secret. So a stolen copy of the database is a list of unreadable blocks rather than a list of people. Alongside it I keep a keyed one-way fingerprint of the address, which is what lets the site notice you're already signed up without having to decrypt anything to find out.
Your IP address is never stored. It's combined with a secret and the current month and put through a one-way hash, so I can spot a flood of signups from one place without being able to work out where you are. When the month changes the old hashes stop matching anything, so even that link fades on its own.
Cookies
This site sets no cookies and uses no cookie-based analytics. That's why there's no cookie banner. The devlog player on the front page is a still image and a button until you press it — nothing is requested from YouTube before that, not even the thumbnail, which is served from this site. If you do press play the video loads from YouTube at that point and Google's privacy policy applies to it — nothing from YouTube loads until you choose to play it.
Who else sees it
- Cloudflare — hosts this site and the database.
- Cloudflare Turnstile — the spam check on the signup form. It is there to tell a person from a bot and nothing else; it sets no cookie and does not track you across sites, which is why there is still no cookie banner on this page.
- Resend (Resend, Inc., United States) — delivers the confirmation email and any update I send after it. Resend receives your address in order to hand that specific message to your mail provider, and for no other reason: nobody is added to a marketing audience, no contact list is kept there, and no address is ever uploaded in bulk. The unsubscribe link in every email is mine and removes you from my database directly — it is not a third party's preference centre.
All of them are processors acting on my instructions. Nobody else gets your address, and it is never sold, rented, swapped or handed to advertisers. Where processing happens outside the UK it's covered by the providers' standard data-protection terms.
How long it's kept
- Your email address — until you unsubscribe or ask me to delete it. If you've not opened anything for two years I'll ask whether you still want to be on the list, and delete you if you don't reply.
- Unsubscribed addresses — deleted within 30 days, leaving only a one-way hash so you can't be accidentally added back.
- An address that never confirms — if you don't click the link in the confirmation email you are not on the list, and the unconfirmed record is deleted after 30 days. Nothing is ever sent to it in the meantime beyond that one confirmation.
- An address signed up before email was switched on — deleted after 90 days. While the mailing system was being built the site accepted signups but sent nothing at all, so those records were never asked to confirm and the 30-day clock above could never start for them. Rather than keep them indefinitely they get their own limit, and they are never sent a confirmation out of the blue months later.
- Visit and click records — 14 months.
Your rights
Under UK GDPR you can ask me to give you a copy of your data, correct it, delete it, restrict what I do with it, or object to it. You can withdraw consent at any time — that doesn't undo anything already done, but it stops everything from that point. There's no automated decision-making or profiling here.
Email [email protected] and I'll deal with it within a month, usually the same day. There's only me, so it comes straight to me.
Complaints
If you think I've handled your data badly, please tell me first and I'll try to put it right. You also have the right to complain to the Information Commissioner's Office — ico.org.uk, or 0303 123 1113.
Age
Second Chance is made for adults, and the mailing list is for people aged 18 or over. If you're under 18, please don't sign up. If you have and you'd like to be removed, email me and I'll delete it straight away, no questions.
Changes
If I change anything meaningful here I'll update the date at the top and say so in the next email rather than quietly editing the page.
← Back to Oakhaven