Legal
Privacy policy
Last updated 9 October 2026
This policy covers personal data collected through sandcat.studio. The data controller is Sandcat Studios Ltd, company number 17355129, registered at 128 City Road, London, EC1V 2NX, United Kingdom. Contact us about anything on this page at privacy@sandcat.studio.
What we collect
- Contact form. Your name, email address, chosen subject and the message you write. We use it to answer you, and nothing else.
- Server logs. Our web server records IP address, timestamp, requested page, referrer and browser user agent. This is standard operation and security housekeeping.
- Visit statistics. We count visits with Umami, a privacy-focused analytics tool that runs on a server we control. It records the page you viewed, the site that referred you, your browser, device type and approximate country. It sets no cookies, does not store your IP address, and cannot identify you or follow you across other websites. We only look at the results in aggregate, to see how the site is used.
- Development updates sign-up. If you use the “Get development updates” form, we collect the email address you enter and the time you signed up. We use it only to send you Hollow Cedar development updates.
We do not use advertising trackers, analytics profiling or third party marketing cookies on this site.
Cookies
One session cookie is set when you open the contact page. It exists to protect the form against cross site request forgery and expires when you close your browser. No consent banner is needed for it, because the site does not work without it.
Why we are allowed to hold it
- Legitimate interests for replying to enquiries, keeping the site secure, preventing abuse and understanding, in aggregate, how the site is used.
- Consent where you have signed up for development updates. You can withdraw that at any time using the unsubscribe link in any email.
How long we keep it
Contact messages are kept for up to 24 months so we have context if you write again, then deleted. Server logs are kept for up to 12 months, and visit statistics are deleted after 24 months.
Who else sees it
Our hosting and email providers process data on our behalf under contract. We do not sell personal data, and we do not share it for marketing. We may disclose data where the law requires it.
Some of the people and services that process data on our behalf are based outside the United Kingdom, so your data may be accessed from abroad. Where that happens we rely on appropriate safeguards such as the UK International Data Transfer Addendum.
The development updates sign-up form runs on our own n8n automation server at n8n.velocityviral.ae, which we control. It receives the form submissions and the contact form messages described above, and acts as a processor of that data on our behalf. Your email address is not shared with anyone else for marketing.
Hollow Cedar Dev Updates (Reddit app)
Sandcat Studios operates a small Reddit app, “Hollow Cedar Dev Updates”, installed only on r/HollowCedar. Its sole purpose is to publish the weekly Hollow Cedar development update to that subreddit after a moderator has approved it. The app does not collect, store, profile or share personal data about Reddit users, and it does not read users’ posts, comments or messages. The post text and images are prepared by Sandcat, approved by a moderator in a private Discord channel, and passed from Sandcat’s own server (n8n.velocityviral.ae) to the app, which publishes them. Reddit and Discord process data under their own privacy policies. Questions or requests: privacy@sandcat.studio.
Links away from this site
Discord, Reddit and hollowcedar.com are separate services with their own privacy policies. Once you follow a link, what happens to your data is governed by them, not by us.
Your rights
Under UK GDPR you can ask for a copy of your data, ask us to correct or delete it, object to or restrict how we use it, and ask for it in a portable format. Email privacy@sandcat.studio and we will respond within one month.
If you are not satisfied with our response, you can complain to the Information Commissioner's Office at ico.org.uk.
Children
This site is not aimed at children under 13, and we do not knowingly collect their data. If you believe a child has sent us personal data, contact us and we will remove it.
Changes
When this policy changes we will update the date at the top of the page.