Privacy

Last updated 16 October 2026

Who is responsible

This site is operated by Frost Interactive LLC, trading as Sigma Labs, the developer of MOGGED. Frost Interactive LLC is the data controller.

The way to reach the controller about anything on this page is the contact form. If you need a postal address for a formal data request, ask through the form and it will be provided to you directly.

What is collected, and when

If you use the contact form

You choose to give us a name (optional), an email address, and a message. We use them for exactly one purpose: to read your message and reply to you. We do not add you to a mailing list, and we do not use your address for anything else.

Your message is delivered two ways: by email to us, and as a notification in a private Discord channel that only we can read. Both contain the same thing, which is what you typed.

To stop the form being abused to flood that channel, the number of submissions from your IP address is counted for five minutes and then discarded. The address itself is not stored with your message and is not used for anything else.

If you report a site issue

The report form sends what you typed, plus the address of the page you were on and what your browser says about itself: its version string, your window and screen size, and your language setting. Without those a report about a broken page is rarely possible to act on. An email address is optional there, and is only used to reply to you.

Reports go the same two ways as a contact message, by email and into the same private channel, under the same five-minute count against abuse.

If you just read the site

The site is static, has no database and no accounts, and stores nothing about you personally. Two things are counted, both in aggregate:

Page views. We use Cloudflare Web Analytics. It is cookieless: it does not store anything in your browser, does not fingerprint your device, and cannot follow you to other websites. It reports totals such as how many people visited a page and which site they arrived from. There is no way for us to single you out in it, which is also why you are not asked to accept cookies.

Link clicks. When you press an outbound link, such as Wishlist on Steam or one of the social buttons, the site adds one to a counter for that link. The counter records the link and the date, and nothing else. No identifier, no address, nothing tied to you.

If you play the game

The game has no account with us. By itself it sends us three kinds of thing. You can switch off the first two.

Crash reports. When something goes wrong: an error, a freeze, or the game falling over. We use Sentry for that. A report holds three kinds of thing:

• What broke. The error, and the line of our code it came from.
• What it was running on. Your operating system, graphics card, memory, screen mode, and which version and language of the game you were playing.
• What the game was doing. A short trail of the last few steps it took and the last lines it wrote to its log: which area you were in, which day of the run, how many people were in your crew, how the run ended. Your Windows user folder and any Steam ID are taken out of that text before it is sent.

The same switch covers two small notes Sentry sends even when nothing breaks. One says a play session started and whether it ended cleanly, so we can tell what share of sessions crash. The other, about one time in ten, says how long the game took to start or to load an area. Neither holds anything a crash report does not.

Here is what none of it holds, apart from the save report below: your name, your Steam name, your crew's names, anything you typed, anything anyone said in voice or text chat, your save file, and your IP address. We switched the address off at both ends, in the game itself and in Sentry's own settings, so it is neither sent nor stored.

A save that will not load. The same switch covers one more report. If one of your saves will not open, the game sends us the broken save file and its log files, so we can find out why and help you get it back. Every Steam ID in the save is swapped for a plain number first, and your Windows user folder is taken out. A save holds your crew's characters, your run, and any name you typed for your company in the game. It goes to the same private Discord channel as bug reports, with the same short code in place of your Steam account.

Reports and notes do carry an id for the installation. It is worked out on your machine and stays the same between launches, so that we can tell one computer crashing ten times from ten computers crashing once. It is not your Steam account, it is not joined up with anything else, and outside our crash list it means nothing.

Gameplay stats. So we can tell whether the game is too hard, which monsters are unfair and whether multiplayer holds up, the game sends a few short notes about how it is going. One when you start the game. One when a run ends: the difficulty and, if your lobby changed its settings, what each one was set to, how big the crew was, which day you reached, how long it took and how it ended, plus counts of what you did in that campaign, such as whether you went down to the lab, how many peptides were cooked and taken, how many nights you went out, and how much you bought and sold. One when you buy something on the in-game laptop: what it was and what it cost. One when you die: what killed you and where. One when you finish or leave the tutorial: how far you got and which steps you skipped. On your first night, one each time the walkthrough moves you on to a new step: which step it is, how long you have been playing and whether you had the list folded away. One when you lose your connection or cannot host a game, with the reason. One each time you try to join someone's game: how you got there (an invite or the server browser), how long it took and whether it worked. One when a lobby or a game you were in ends: how long it lasted, how many people were in it, how it ended and where you were. One when you close the game, or at the next start if it crashed: how long it was open and the last screen you were on. And every ten minutes while the game is open, a note saying what you are doing right now, such as sitting in the menu or playing a run, so we can count how many people are playing and how many play together.

How smoothly the game runs. So we can find the places and the computers where the game stutters, it also sends a short note about how it ran, about every ten minutes while you play and each time you move to another place: where you were, how many people were in the game, how many frames per second it drew and how many were slow, how long the last loading screen took, how much memory the game was using, and your video settings (quality, resolution, frame cap, vsync and window mode). With those notes goes a short description of your computer as the game sees it: the model of the graphics card and the processor, how much memory the computer and the graphics card have, how many processor cores, the operating system and the graphics system the game runs on. That is the model, never a serial number or anything that names the machine.

Each note also says whether the game is running on Windows, a Steam Deck, Linux or a Mac. Notes about a lobby or a join carry a crew code: a scrambled form of the Steam lobby's number, the same for everyone in that game. It lets us see whether a group of friends comes back to play together again. It is made from the lobby's number, never from anyone's account, and a lobby stops existing when its game ends, so the code says nothing about who was in it.

Every item in a note is a number, the model name of a computer part, or a word picked from a fixed list inside the game, so a note cannot hold your name, your Steam name, your crew's names, anything you typed or anything anyone said. Notes carry a random id made on your machine for this alone, so that we can count players rather than notes. It is not the crash report id and it is not your Steam account. The notes go to a small database of ours, hosted by Cloudflare. A summary of the totals is posted in a private Discord channel that only we can read, and the same totals are drawn as charts on a private page that only our team can sign in to. Your IP address is used for a moment to stop anyone flooding us with fake notes, and is not stored with them. Cloudflare also tells us which country and continent the address is in. We keep the country, so we can see when each part of the world plays, and never the address.

The ban check. We can ban a Steam account from online play. Solo still works. So that a ban holds, the game asks our server whether an account is on the ban list: yours when the game starts, the host's before you join a game, and each player who joins when you host. The question is just Steam IDs. When you host, it also carries a one-time Steam ticket and the id of your lobby, and our server hands back a signed note for each player saying they were in your game. That note is what lets a crewmate report them later. Our server keeps nothing from a check, and your IP address is used for a moment to stop anyone flooding it, then dropped.

You can turn off the first two. Settings, then GAME, under Privacy: Crash Reports and Gameplay Stats. Switching off crash reports stops them on the spot, and the next launch does not start them again. Switching off gameplay stats stops them on the spot and deletes any notes still waiting on your machine to be sent. The ban check has no switch, because a ban you could switch off would not be a ban.

If you report a bug or a player from the game

Nothing here is sent unless you press Send.

Bug reports. The bug and feedback button sends what you typed, your game version, where you were (the area, the day of the run, and whether you were hosting), your language, and whether the game crashed recently. So that strangers cannot post to us in the game's name, it also sends a one-time Steam ticket, and Steam tells our server which account it came from. We do not keep that account or pass it on. The report shows a short code in its place, the same code each time, so we can tell one person sending five reports from five people sending one. If you wrote in a language other than English, the words you typed (and nothing else) go to Anthropic's Claude to be translated, so our team can read them.

If you tick Attach logs, the report also carries the game's log files from this session and the one before, the error log from any recent crash, and what your computer is: its operating system, processor, graphics card, memory and screen size. Your Windows user folder and any Steam ID are taken out of the logs first. If you tick Include screenshot, it carries a picture of the game as it was behind the menu, which can show other players' names or chat if they were on screen. Reports go to a private Discord channel that only we can read. What you typed, in English when it was translated, is also copied onto our team's private task list in Notion with your game version and where you were, so the bug gets fixed. Nothing else from the report goes there.

Two more things are up to you, and both are empty unless you fill them in. If you type your Discord name in the box under the switches, the report carries it, so we can write back to you. The game also remembers it on your computer for your next report. If you tick Include Steam ID, the report shows the Steam ID that Steam confirmed from your ticket, as a link to your Steam profile, next to the short code.

Player reports. Report a player from the pause menu and the game sends our server your Steam ticket, so Steam can tell us who is reporting. It also sends the Steam ID and in-game name of the player you reported, the reason you picked, anything you wrote, your own in-game name, and the signed notes that show you were in the same game. Our moderators read it in a private Discord channel. They see your Steam ID too, so they can spot anyone who sends false reports. The player you reported is never told who reported them. A report never bans anyone by itself: a moderator reads it and decides.

If you play with other people

Multiplayer runs over Steam. Your game reaches the rest of your crew through Steam's own networking rather than through anything of ours, and lobbies and invites are Steam's as well, so what is collected there is between you and Valve.

Voice chat goes straight between players and never reaches us. One monster, the mimic, copies voices: while you play, the host's game keeps the last few seconds of each player's voice in memory, so the mimic can play a bit of it back to the crew. It is never saved to a file, and it is gone when the game closes.

Scores and achievements. The Top Moggers boards and the achievements are Steam leaderboards and Steam achievements. Posting a score puts it on Steam under your Steam name, where other players can see it, which is the point of a leaderboard. We keep no copy and run nothing behind it.

If you post in our Discord or Steam discussions

Once a day a bot reads new posts in our Discord server's public channels and on MOGGED's Steam discussion boards, so feedback does not get lost. The text of each post, without your name, is sorted by Anthropic's Claude into bug reports, ideas and general chat. A summary with short quotes, the poster's name and a link goes to a private channel for our moderators. Nothing else is done with it.

When you start a thread in our Discord's bug reports forum, its title and first post, without your name, are copied onto our team's private task list in Notion with a link back to the thread, so the bug gets fixed.

Our Discord bot, MogBot, also reads posts in the public channels as they come in, for two things. First, translation: when a post is not in English, or is an English reply to one, its text goes to Anthropic's Claude without your name, and MogBot posts the translation under it for everyone in the channel. Posts in plain English are not sent anywhere. MogBot keeps a note of which posts it translated for one week, so it can remove a translation when the post is deleted. Second, raids: MogBot watches for a wave of new accounts posting spam and warns our moderators. For that it remembers who posted what for 15 minutes, and then forgets it.

Why we are allowed to do this

Data protection law requires us to name a lawful basis for each thing we do. Everything on this page rests on the same one, legitimate interests, and none of it relies on your consent, because none of it needs it. Here is the interest in each case.

Your contact message: legitimate interests. You chose to write to us and asked for a reply. Reading the message and answering it is the obvious and expected use, it is the only use, and it cannot reasonably be against your interests. If you would rather we had not kept it, say so and we will delete it.

Page views and link clicks: legitimate interests. We have an interest in knowing whether anyone visits the site and whether the Wishlist button gets pressed. The counting is aggregate and cookieless, it cannot identify you, and it stores nothing on your device. That is also why you are not asked to consent: there is no tracking to consent to.

Crash reports and gameplay stats: legitimate interests. We have an interest in knowing when the game breaks and where it is unfair, and you have an interest in it getting fixed. Neither has a name in it or can be traced back to you, and if you would rather send none at all, the switches are in Settings. That is why you are not asked to consent to it either: a switch you can flip at any moment, in the game, is worth more to you than a box you ticked once and cannot find again.

Bug reports: legitimate interests. You chose to send it, to get something fixed. We use it for that alone, and it carries a code rather than your account.

The ban check and player reports: legitimate interests. Keeping online games free of cheating and abuse is in the interest of every player. A report cannot be acted on, and a ban cannot hold, without knowing which Steam account it is about. A moderator, not a program, decides every ban.

Community posts: legitimate interests. You posted them in our spaces for us to read. Sorting them is how we make sure we actually do. Translating them lets everyone in the server read them, and watching for raids keeps the server usable for everyone.

Who else receives data

Six companies are involved in running the site and the game. Each has its own privacy policy.

• Cloudflare hosts the site and serves it. Like any web host, it processes your IP address, browser type and the pages you request, in order to deliver the site and protect it from attacks. It also runs the small server the game talks to, and stores the gameplay stats, the ban list and open player reports for us. Cloudflare privacy policy
• Valve runs Steam, which carries the game's multiplayer, voice, lobbies, leaderboards and achievements. When the game sends us a bug report or a player report, or hosts an online game, our server asks Steam to confirm a one-time ticket from your game, and Steam tells us which account it belongs to. On the site, Valve streams the trailer from Steam's video servers: when you press play, those servers receive your IP address and browser type, in order to send you the video. Nothing is sent to them just from browsing. Valve privacy policy
• Web3Forms relays contact form submissions and site issue reports to our inbox. It receives whatever you put in the form. It is only contacted when you press Send, never just from browsing. Web3Forms privacy policy
• Discord receives a copy of contact form messages and site issue reports, bug reports and player reports from the game, and the totals from the gameplay stats, delivered into private channels we control. If you also join our Discord server, that is a separate relationship between you and Discord, apart from the daily summary described above. Discord privacy policy
• Sentry receives crash reports and the session notes from the game, and nothing from the site. Sentry privacy policy
• Notion holds our team's private task list. It receives the words of bug reports from the game (in English when they were translated) with the game version and where you were, the title and first post of new threads in our Discord's bug reports forum without the poster's name, and the title of each new kind of crash, which names an error and the place in the game's code where it happened. It receives nothing from the site. Notion privacy policy
• Anthropic receives the text of new posts in our Discord server and Steam discussions, without names, so its Claude model can sort them for the daily summary, and the text of Discord posts MogBot translates. It also reads the game's public Steam reviews, without the reviewer's name, to sort them by what they are about. From the game, it receives only the words of a bug report written in a language other than English, to translate them for us. It receives nothing from the site. Anthropic privacy policy

Where your data goes

All seven of those companies are based in the United States, so if you are in the UK or the EU, your data leaves your country when it reaches them. That is a normal part of using the internet, but the law expects us to tell you rather than leave you to work it out.

Each of them handles the legal side themselves through the mechanisms available for such transfers, including standard contractual clauses and, where they participate, the EU-US and UK-US Data Privacy Framework. Their own privacy policies, linked above, set out what they rely on. We are a one person operation and we chose them partly because they take that responsibility on.

Cookies and tracking

This site sets no cookies of its own and stores nothing in your browser. The analytics it uses are cookieless and cannot identify you or follow you across sites. There is no advertising, no tracking pixels and no data sold to anyone. That is why you were not shown a cookie banner: there is nothing to consent to.

Links to other places

The site links out to Steam, Discord, X, YouTube, Instagram and TikTok. Following any of those links takes you onto their platform, where their own privacy policies apply and we have no control or visibility.

How long things are kept

Contact messages stay in our email inbox for as long as we need them to deal with your enquiry and any follow-up, and are deleted when they are no longer needed. Server logs are kept by Cloudflare on their own retention schedule.

Crash reports are held by Sentry for 90 days and then deleted automatically. We do not copy them anywhere else, so after that they are gone.

Gameplay stats are deleted automatically after 90 days, too. The totals posted in our Discord channel are counts, such as "12 players died to a zombie", with no id in them.

The link click counters hold only a link name, a date and a number. They delete themselves automatically after 90 days. Nothing in them relates to a person, so there is nothing in them to identify or remove.

Bug reports stay in our private channel for as long as we need them to fix the problem, and are deleted when they are no longer needed.

A player report is kept for 30 days after the last report about that player. The count of reports you have sent is kept for 90 days after your last one. A ban, or a moderator's note that your reports are ignored, lasts until a moderator lifts it. The moderators' channel keeps the message for each case as a record of what was decided.

The mimic's copy of your voice lasts a few seconds, in memory on the host's computer, and is never written anywhere.

The daily community summary stays in our moderators' channel, and the posts it quotes stay where you posted them, under your control.

Your rights

If you are in the UK, the EU, or another region with similar law, you have the right to ask for a copy of the personal data we hold about you, to have it corrected, to have it deleted, to object to how it is used, to have its use restricted while a question is sorted out, and to receive it in a portable form you can take elsewhere. In practice that means any message or report you have sent us, and any report about your Steam account or ban on it. Crash reports and gameplay stats have no name in them, so we cannot pick yours out to hand over, but they delete themselves after 90 days.

You can also object at any time to processing we base on legitimate interests, which is everything listed above. For crash reports and gameplay stats the fastest way to object is the switches in the game: they stop them at the source, before anything is sent. There is no automated decision making or profiling on the site or in the game: every ban is a person's decision.

To make any of those requests, use the contact form and say what you want. We will reply to the address you give. There is no charge, and we will not ask you to justify the request.

If you are unhappy with how we handle it, you can complain to your local data protection authority. In the UK that is the Information Commissioner's Office.

Children

MOGGED is a horror game intended for adults, and neither the game nor this site is directed at children. We do not knowingly collect information from anyone under 13. If you believe a child has sent us something, contact us and we will delete it.

Changes

If this policy changes, the date at the top changes with it. There is no separate archive, so the version you are reading is the current one.

Contact

For anything on this page, including data requests, use the contact form.