Privacy Policy
Last updated 7 October 2026
This policy covers Burrow, a website and app (at theburrow.live, and its Android and iOS apps) where people walk a tunnel and randomly cross chambers that other people have dug. Burrow is run by Paul Cole, an individual based in the United Kingdom, who is the "data controller" for the information described here. For any privacy question or request, contact us at burrowcore@gmail.com.
This page says what we collect, why, who else handles it, how long we keep it, and how to delete it. We've tried to keep it plain.
What we collect
| What | Why |
|---|---|
| Your email address | To email you a sign-in code, and to recognise you when you return. It is never shown to other people. |
| Your screen name and avatar | They appear beside your chambers when other people cross them. |
| Your chambers: the text, quiz questions, captions, item names, links and any photos you add or upload | To show them to other signed-in people as they walk. Chambers are shown to strangers by design — don't put anything in one you wouldn't want a stranger to read. Please don't include other people's personal details. |
| Your walking and activity: how far you have walked, chambers you cross, quiz answers, your votes in surveys (other people only see totals, never who voted), milestones reached, the pebbles you have earned and what is in your home chamber | To run the game and show you your own history. Other people only see an anonymous count of how many times a chamber has been crossed. |
| Who you have blocked, and any reports you make | To keep you from meeting people you have blocked, and to review reports. Only you can see your block list. |
| Premium subscription details | If you subscribe, Stripe takes the payment. We never see your card number; we keep only your Premium status and Stripe's customer and subscription reference numbers. |
| A sign-in cookie | A single, strictly necessary cookie that keeps you signed in. We use no advertising or tracking cookies and no analytics. |
| Technical data: your IP address | Used briefly in the server's memory to slow down abuse (for example, repeated sign-in attempts). Our hosting provider may keep ordinary server logs that include IP addresses. |
| When you agreed to our Terms | Recorded when you create an account. |
Who else handles your information
We use a few services to run Burrow. They only receive what they need:
- Render — hosts the website and database.
- Resend — sends the sign-in code emails (it receives your email address).
- Stripe — takes Premium payments (it receives your email address and payment details, under its own privacy policy).
- Sightengine — an automated moderation service. Photos you upload, and the text you write in chambers and your screen name, are sent to it to check for inappropriate content before they are shown to others.
- Google Fonts — the text fonts are loaded from Google, so Google can see your IP address when a page loads.
- Wikimedia — the photos in milestone moments are loaded from Wikimedia's servers, so Wikimedia can see your IP address when one is shown.
We don't sell your information, and we don't use it for advertising. Some of these providers process information outside the UK and EU; where they do, they rely on the safeguards the law requires.
Why we're allowed to use it
To run your account and the service you asked for (a contract); to keep Burrow safe, including automatic and manual moderation (our legitimate interests); and to meet legal and payment-record obligations.
How we protect it
Everything is sent over an encrypted (HTTPS) connection. Sign-in uses one-time codes by email rather than passwords, so there is no password to leak. Sign-in codes expire after 15 minutes, and sessions are stored only as one-way hashes. Access to the admin tools is limited to the person who runs Burrow.
How long we keep it, and deleting it
- We keep your information while you have an account.
- You can delete your account at any time from My account → Delete my account, or by following the steps on our account deletion page (which also covers requests by email if you can't sign in). That permanently removes your account, chambers, uploaded photos, activity, blocks and sessions, and cancels any Premium subscription so you aren't billed again.
- Daily safety backups of the database are kept for up to 14 days, so deleted information disappears from them within that time.
- Stripe may keep payment records for as long as the law requires.
- Sign-in codes expire after 15 minutes. Reports and moderation notes about content are deleted with the content or the account they relate to.
Your rights
Under UK data protection law you can ask to see the information we hold about you, have it corrected or deleted, object to how it's used, or ask for a copy. Email burrowcore@gmail.com and we'll help. If you're unhappy with how we've handled something you can complain to the Information Commissioner's Office (ico.org.uk).
Children
Burrow is not for children under 13, and we don't knowingly collect information from them. If you believe a child under 13 has made an account, tell us and we'll delete it.
Changes
If we change this policy in a way that matters, we'll update the date above and, for big changes, tell you in the app or by email.