PRIVACY POLICY

1. Who we are

This website and the game DEFLEKT are published by Mayd It LLC, a limited liability company registered in the State of Washington, United States (UBI 606 247 926). Mayd-It Games is the studio brand we release games under; it is a brand of Mayd It LLC, not a separate company.

Mayd It LLC is the party responsible for the personal data described in this policy. For any privacy question, complaint, or deletion request, write to bmay@mayd-it.com. A real person reads that inbox and we aim to answer privacy requests within 7 calendar days.

This policy covers three separate things, and they are genuinely separate: this website (deflekt.games.mayd-it.com), our internal YouTube publishing tool, and the DEFLEKT leaderboards. Each gets its own section below.

2. YouTube API Services

We run an in-house tool called DEFLEKT Marketing Machine. It cuts short clips of our own gameplay footage and uploads them to the one YouTube channel we own. This tool uses YouTube API Services.

Because it uses YouTube API Services, two other documents apply on top of this one:

• The YouTube Terms of Service, at https://www.youtube.com/t/terms. By using this API Client you agree to be bound by the YouTube Terms of Service.
• The Google Privacy Policy, at https://policies.google.com/privacy, which governs what Google itself does with data. Nothing in our policy changes or overrides Google's.

Revoking our access to your Google account

Access granted to our tool can be revoked at any time from the Google security settings page: https://myaccount.google.com/permissions (the same page is also reachable at https://security.google.com/settings/security/permissions). Removing our app there immediately invalidates the tokens we hold, and the tool can no longer upload anything. In practice the only Google account our tool has ever been granted access to is our own studio account.

What the tool accesses

• One YouTube channel, which we own. Nothing else.
• One permission scope: https://www.googleapis.com/auth/youtube.upload. That is upload-only. We deliberately did not request any broader scope.
• One API endpoint: videos.insert. That is the call that uploads a video.
• It reads nothing. The tool does not list, search, download, or analyse videos, channels, comments, playlists, subscribers, or viewer data. There is no analytics or reporting call anywhere in it.

What it stores, and where

The only thing the tool stores is the channel owner's own OAuth tokens (an access token and a refresh token). They are written into a local configuration file on the studio owner's own Windows PC, in his own office.

The tool itself has no backend server, no database, no cloud storage and no analytics pipeline. It runs entirely on that one PC: nothing it touches is uploaded to any system Mayd It LLC operates, and it never sends YouTube API Data anywhere except back to YouTube. It stores no YouTube API Data of any kind and no data about any viewer, subscriber, or other person.

This is a statement about the marketing tool, not about every system we run. Our websites are hosted by Netlify, and mayd-it.com additionally runs a private staff-login function described in the mayd-it.com privacy policy. Neither has any connection to the tool described here, and neither ever receives YouTube API Data.

How we use, process and share that information

• Use: the tokens are used for one purpose only, which is to prove to Google that we are allowed to upload a video to our own channel.
• Processing: the tool reads the token from disk, sends it to Google as an authorization header, and writes the refreshed token back to disk. That is the whole of it.
• Sharing: the tokens are sent to Google / YouTube, and to nobody else, because Google is the party they authenticate us to. They are not shared with any other third party, any contractor, any advertiser, or any data broker.
• We do not sell, rent, trade, or transfer this information; we do not use it for advertising or ad targeting; we do not use it to build profiles of anyone; and we do not use it to train machine-learning models.

Limited Use

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Retention and deletion of data

• YouTube API Data: none is retained, because none is ever obtained. There is nothing to expire. Were we ever to store authorized data, it would be deleted or refreshed within 30 days, as YouTube's developer policies require.
• OAuth tokens are kept only for as long as the tool is in use. They are deleted by revoking access at the Google security settings page linked above, and by clearing them from the local configuration file. Both are done by the channel owner on his own machine, and either one stops the tool working.
• Deletion requests. Anyone may ask us to delete data we hold about them by emailing bmay@mayd-it.com. We will action it within 7 calendar days and confirm by reply. You do not need an account, and you do not need to explain why.

There are no third-party users, and no third-party content

This tool is a first-party publishing tool for Mayd It LLC. It is not a product, not a service, not licensed, sold, or made available to anyone outside the company, and it has no user base beyond the one person who owns the channel. It therefore handles no third-party user information at all.

The tool does not allow any third party to serve content or advertisements through it, and it displays no advertising itself.

How the clips are made, and what we disclose on them

For transparency, since the videos say so themselves: the gameplay in our clips is played by an automated AI test pilot, captured on our own machine, and cut automatically. Nothing publishes without a human reviewing it and clicking approve. Every caption and video description carries this line: "Gameplay by our AI test pilot. DEFLEKT is made by one human + a lot of AI."

The link in each video description points back to this website and carries UTM tags (utm_source, utm_medium, utm_campaign) so we can tell which clip sent someone here. UTM tags are plain text in the URL. They contain nothing about you, they identify the clip and not the visitor, and we do not combine them with anything.

3. This website

deflekt.games.mayd-it.com is a set of static pages hosted by Netlify (Netlify, Inc., United States). Here is everything it does.

Two optional forms

The home page has two forms. Both are entirely optional and neither is required to read anything or download anything:

• The feedback form collects a fun rating, free-text answers about what you liked and what could be better, whether you would buy the game, and an optional email address if you want a reply or a launch heads-up.
• The launch notification form in the wishlist pop-up collects an email address, so we can tell you once when the Steam page opens.

Both forms are handled by Netlify Forms, which means the submission is stored on Netlify's servers in the United States and shown to us in Netlify's dashboard. We use what you send to fix the game, to reply to you, and to send the single launch email if you asked for it. We do not sell it, do not pass it to advertisers, and do not add you to any other mailing list. Ask us to delete your submission and we will, within 7 days.

Both forms carry an invisible honeypot field to catch spam bots. It is not a tracker and it collects nothing about you.

Google Fonts

Most pages on this site, including this one, load their typefaces from Google Fonts. That means your browser fetches files from fonts.googleapis.com and fonts.gstatic.com, and as part of any such request Google receives your IP address and your browser's user-agent string. That is a transfer of data to Google and we would rather tell you than not. What Google does with it is governed by the Google Privacy Policy. We receive nothing back from it. The how-to-play page loads no webfonts at all.

Cookies and anything stored on your device

This website sets no cookies. It stores nothing in your browser's local storage or session storage, and it reads nothing already there. There are no advertising pixels, no session recording, no social media trackers, and no third-party embeds or iframes. There is no cookie banner because there is nothing to consent to.

No analytics

We run no analytics of any kind on this site. No Google Analytics, no tag manager, no Plausible, Fathom, Matomo, Hotjar, Clarity, or anything similar. We genuinely do not know how many people visit, beyond what our host's ordinary logs show us.

Server logs

Like every website, this one has to receive your request in order to answer it. Netlify, as our host, processes your IP address and request details to deliver the page and keeps standard server logs for security and reliability. We do not build reports from them or connect them to anything else.

4. The DEFLEKT leaderboards

The leaderboards page shows public Steam persona names, scores, and run stats for the top players of DEFLEKT. Those come from Steam's own leaderboard service.

• Your browser never talks to Steam. A small server-side function on our host calls Steam, and strips out the Steam IDs before sending anything to your browser. What reaches the page is rank, public persona name, score, and run details such as level, ship and time.
• The data is served from the United States and refreshes automatically.
• Opt out at any time. Email bmay@mayd-it.com and your entry will display as Anonymous within 30 days, usually much faster.

Scores reach those leaderboards through Steam when you play the game. Valve Corporation's handling of your Steam account is governed by Valve's own privacy policy, not by ours.

5. Who else receives data, in full

The complete list of third parties involved in anything described above:

• Netlify, Inc. (United States) — hosts this website and stores form submissions.
• Google LLC (United States) — serves the webfonts, and is the destination for our own video uploads and the OAuth tokens that authorize them.
• Valve Corporation (United States) — operates Steam and the leaderboard data we display.

That is the entire list. We use no advertising networks, no data brokers, no customer data platforms, and no marketing automation.

6. Children

This site and our tool are not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has sent us an email address through one of our forms, tell us at bmay@mayd-it.com and we will delete it.

7. Where data is processed

Mayd It LLC is in the United States, and all of the services above process data in the United States. If you are in the European Economic Area, the United Kingdom, or elsewhere outside the US, using this site means your data is handled in the US. The only routine transfer that happens without you doing anything is the Google Fonts request described in section 3; you can prevent it by blocking those domains in your browser, and the site still works, just in a fallback typeface.

8. Your choices

• Do not fill in the forms. Then we hold nothing about you at all.
• Ask for a copy of anything we hold about you, or ask us to correct it.
• Ask us to delete it. No account, no justification needed, done within 7 days.
• Opt out of the leaderboard as described in section 4.
• Revoke our Google access at https://myaccount.google.com/permissions.

All of these go to the same place: bmay@mayd-it.com.

9. Changes to this policy

If we change what we collect or how we handle it, we will change this page and move the "last updated" date at the top. Material changes will also be noted in the summary box, so you do not have to re-read the whole thing to find out what moved. This page is linked from the footer of every page on this site, so it stays easy to find.

10. Contact

Privacy questions, complaints, and requests, including anything about our use of YouTube API Services:

Mayd It LLC
Washington State, United States · UBI 606 247 926
bmay@mayd-it.com

See also our Terms of Service.