Barking Kennels — Privacy Policy
Version: 1.0 Last updated: 1 November 2026 Effective date: 1 November 2026
1. Who is responsible for your data
Barking Kennels is operated by Francisco Antonio Freire Cortes, an individual sole trader established in Chile, RUT 20.084.080-1, at Augusto Villanueva 395, Ñuñoa, Chile.
For questions about your data, or to exercise any of the rights in section 8, write to [email protected]. A real person reads that address and will reply within one month.
This policy explains what we collect, why, how long we keep it, and what you can ask us to do about it. It applies to the game at https://barkingkennels.com and forms part of our Terms of Service.
2. What we collect, and why
We only collect what the game needs to work, plus aggregate statistics about how the site performs. There is no advertising network, and no one builds a profile of you from your play.
2.1 Your account
| What | Why | Legal basis (EU/UK) |
|---|---|---|
| Username | Identifies you when you sign in and to other players | Performance of a contract |
| Nickname, bio, profile picture, affix, displayed title | Your public profile in the game | Performance of a contract |
| Email address | Sign-in recovery, security notices, purchase receipts, confirming your address | Performance of a contract |
| Password | Signing in. Stored only as a bcrypt hash — we never hold the password itself and cannot recover it for you | Performance of a contract |
| Date of birth | Enforcing the minimum age (13) and the minimum purchase age (18) | Legal obligation, legitimate interests |
| Country | Tax treatment of purchases, and regional features in the game | Legal obligation, performance of a contract |
| Which version of the Terms you accepted, and when | Proving the agreement between us | Legitimate interests, legal obligation |
| If you took part in our alpha test: the email address you gave us for it | Recognising you with the Alpha paw, title and gift if you create an account with that address. Write to us and we will remove it | Legitimate interests |
| If you supported us on Patreon: a SHA-256 hash of the email address on your Patreon account, not the address itself | Recognising you with a thank-you letter and gift if you create an account with that address. Write to us and we will remove it | Legitimate interests |
2.2 What you do in the game
Your kennel, your dogs and their pedigrees, competition entries and results, market listings and bids, inventory, achievements, titles, friendships, community goal contributions and daily progress. This is the game state — without it there is nothing to come back to. Legal basis: performance of a contract.
2.3 What you write
Private messages to other players, dog and kennel names, your bio, and any other text you can type. We do not read private messages routinely. We do run an automatic language filter over public names and trade notes, and a flagged text may be reviewed by a moderator. If a player reports a private message, a moderator can read that message and the letters between the two of you from seven days before to seven days after it; every such read is logged. We keep a record of moderation reports and of any sanction on your Account (warnings, suspensions and bans), with the reason and the moderators' notes. Legal basis: performance of a contract, and our legitimate interest in keeping the game safe.
2.4 Purchases
For every purchase of Premium Coins or a Premium Membership we store: the amount, the currency, the tax applied, the country used for tax, your country as reported by the payment provider, its reference for the order, what you bought, and the timestamp of the consent you gave at checkout. We also keep a ledger of every Premium Coin credited to or spent from your account.
We never see or store your card number. The payment form belongs to Lemon Squeezy, which sells the packs as merchant of record, and your card details go to them, not to us.
Legal basis: performance of a contract, and a legal obligation — Chilean tax law requires us to keep accounting records of what we sold and to whom.
2.5 Technical data
| What | Why | Retention |
|---|---|---|
| A session cookie | Keeps you signed in. Strictly necessary; it carries a random identifier and nothing else. The session itself is stored in our database | Deleted when the session expires (24 hours) or you sign out |
| Sign-in and rate-limit counters | Slowing down brute-force attacks. The identifier (your IP address or account) is stored only as a SHA-256 hash, never in the clear | Minutes to hours — each counter expires with its own window |
| Email links (invitations, address confirmation, password resets) | Letting you in. Only the SHA-256 hash of the link is stored, never the link itself | Deleted after use or expiry |
| Server access logs | Diagnosing errors and investigating abuse. These include your IP address and browser user agent | 30 days |
| A device cookie | Enforcing "one person, one Account" (section 4 of the Terms). It holds a random identifier and nothing else, is set only once you sign in, and stays after you sign out so we can tell that two Accounts were used in the same browser | Renewed on each visit; expires 400 days after your last one |
| Account signals: the IP address you sign in from (for IPv6, only the network part) and the device cookie's identifier | Detecting one person running several Accounts. They are stored only as keyed hashes (HMAC-SHA-256): we can tell that two Accounts share one, but not read the address back. Accounts that share a device cannot trade with each other; a shared IP address alone is only shown to our moderators, because families and schools share one | Deleted 90 days after they were last seen |
| Site statistics, through Cloudflare Web Analytics: the page visited, the referring site, browser and device type, country and loading times | Seeing which pages are used and whether the site is fast and working. We see totals, not individual players. It sets no cookies, uses no local storage, and Cloudflare states that it does not fingerprint visitors | Kept by Cloudflare as aggregate statistics |
Legal basis: legitimate interests (security, keeping the service running, understanding how the site performs, and keeping the Game economy fair for every player).
2.6 What we do NOT do
- We do not sell, rent or trade your personal data. Not to anyone, ever.
- We do not use advertising networks, ad cookies or tracking pixels.
- We do not profile you for marketing, and we make no automated decisions with a legal or similarly significant effect on you. Blocking trades between Accounts on the same device is automatic; suspensions and bans are decided by a person.
- We do not ask for, or want, your address, phone number or identity documents.
3. Cookies
Barking Kennels uses two cookies, both described in section 2.5: the session cookie that keeps you signed in, and a device cookie that stops one person from running several Accounts. Both are first-party, carry only a random identifier, and exist to keep the service working and secure, so they do not require consent and there is no cookie banner to click through.
Our site statistics (section 2.5) work without cookies or local storage. If we ever add anything that stores something on your device beyond these two cookies, we will ask you first and this section will say so.
4. Who else touches your data
We use a small number of service providers, each of which processes data only on our instructions:
| Provider | What they do | What they see |
|---|---|---|
| Railway | Runs the game servers and the database | Everything stored in the game, as the infrastructure it runs on |
| Resend | Delivers our emails | Your email address and the content of the message we send you |
| Lemon Squeezy (Sold through Link, LLC) | Sells the packs as merchant of record and takes the payment | Your account email, which we send to pre-fill the checkout, and your payment details, which go to them directly; they tell us the amount, the tax, your country and their reference for the order |
| Cloudflare | Protects the site, carries the traffic between you and the game, measures site statistics, and stores our database backups | Your IP address and the pages you request, as the network they pass through, and the site statistics in section 2.5. The backups reach them encrypted, and they do not hold the key |
| Google Fonts and jsDelivr | Serve the fonts and one charting library the pages load | Your IP address and browser details, when your browser downloads those files |
Some of these providers operate outside Chile and outside the European Economic Area. Where that involves an international transfer of personal data, it is made under the safeguards those providers offer — standard contractual clauses or an equivalent mechanism. Ask us at [email protected] and we will tell you exactly where your data sits.
We will also disclose data if a court or a competent authority lawfully requires it, or if it is genuinely necessary to protect someone's safety or to defend a legal claim.
5. What other players can see
Some of your data is public inside the game by design: your username and nickname, your profile (bio, picture, displayed title, affix), your kennel and your dogs, your market listings, your competition results, your achievements and your friendships.
Your email address, your date of birth, your purchase history and your Premium Coin balance are never shown to other players.
6. How long we keep it
| Data | Kept for |
|---|---|
| Account and gameplay data | While your account exists. See the inactivity rule in section 15 of the Terms |
| Purchase and accounting records | 6 years from the end of the tax year, because tax law requires it. These survive the deletion of your account — we keep the minimum: the amounts, the dates, the country and the provider's reference |
| Premium Coin ledger | While your account exists, and then as part of the accounting record above |
| Private messages | While your account exists. A letter you delete leaves your inbox at once and is erased 30 days later, unless it is part of an open report, in which case it is kept until the report is closed |
| Moderation records and sanctions | 2 years, so that a repeated pattern is still visible |
| Server logs | 30 days |
| Email links and rate-limit counters | Until they expire, which is a matter of hours |
| Account signals (hashed IP address and device identifier) | 90 days from when they were last seen |
| Encrypted database backups | Daily copies for 14 days and weekly copies for 56 days, then deleted automatically |
When you close your account we delete or anonymise your personal data, except what we are legally required to keep (the accounting record above) and anything we genuinely need to defend a legal claim. Data we delete stays in the encrypted backups until they expire, at most 56 days later. If we ever have to restore a backup, we delete that data again.
7. How we protect it
Passwords are stored as bcrypt hashes. The links we email you are stored only as SHA-256 hashes, so a leak of our database does not hand anyone a way into your account. Rate-limit identifiers are hashed too, and account signals are hashed with a secret key, so they cannot be turned back into an IP address. Traffic is served over HTTPS. Sessions can be revoked centrally, so changing your password signs out every other device. Database backups are encrypted before they leave our servers, and the key that opens them is not kept on those servers.
None of this makes a breach impossible. If one happens and it is likely to put your rights at risk, we will tell you and the relevant authority without undue delay.
8. Your rights
Wherever you live, you can write to [email protected] and ask us to:
- tell you what we hold about you, and give you a copy;
- correct anything that is wrong;
- delete your account and your data;
- export your data in a portable format;
- restrict or object to a particular use of your data;
- withdraw consent, where we relied on it, without affecting what we did before you withdrew it.
We answer within one month. We do not charge for this, and we will not make your experience of the game worse because you asked.
If you are in the EU, the EEA or the UK, these are your rights under the GDPR (or the UK GDPR), and you may also complain to your national data protection authority.
If you are in Chile, these are your rights under Law 19.628, and from 1 December 2026 under Law 21.719, which also lets you complain to the Agencia de Protección de Datos Personales.
If you are in California, we do not sell or share your personal information as those terms are defined by the CCPA/CPRA, and we will not discriminate against you for exercising your rights.
9. Children
Barking Kennels is not for children under 13, and we do not knowingly collect data from them. Where the law of your country sets a higher age for consenting to the processing of your data — up to 16 in parts of the European Economic Area — that age applies to you instead.
If you are a parent or guardian and believe your child has an account they should not have, write to [email protected] and we will delete it.
Players under 18 cannot buy anything. See section 3 of the Terms.
10. Changes to this policy
If we change what we collect or what we do with it, we will update this page, change the version at the top, and tell you by email or in the game before the change takes effect. For a material change we give at least 30 days notice.
11. Contact
Francisco Antonio Freire Cortes — RUT 20.084.080-1 Augusto Villanueva 395, Ñuñoa, Chile [email protected]