Privacy notice for public reviewers of ODSOFT’s own games

Publication record. Version 2026-09-18 — owner-confirmed. Published on 2026-09-18 at https://kervado.com/reviewer-privacy-notice.html; announced the same day for the initial covered listing in that listing’s Steam news/events channel (developer announcement, comments off). Apple App Store announcement: the permitted notice channel and its dated publication record are completed before that store’s first collection. Google Play announcement: the permitted notice channel and its dated publication record are completed before that store’s first collection.

ShardPilot is ODSOFT LLC’s own platform for reading the public reviews of ODSOFT’s own games published on Steam, the Apple App Store and Google Play under ODSOFT’s publisher identities (Kervado on Steam). This notice covers every game ODSOFT publishes on Steam, the Apple App Store and Google Play under ODSOFT’s publisher identities (Kervado on Steam today). The publisher name on the store page tells you whether a game is ours. We start collection for a store only after that store’s notice channel is completed. While collection is enabled for a covered game, we copy its public reviews through the Steam storefront feed or the Apple App Store and Google Play developer review APIs so authorised studio operators can read individual reviews, understand reception, improve the games and respond from the studio’s publisher accounts. Our replies are public on the relevant store and can be read by the reviewer and the public. Collection can copy a review again while it remains public; the 30-day review-copy period is not a promise that collection happens only once. You can object or ask about your information at privacy@kervado.com. Deleting our copy does not delete or change your review on the store where you posted it.

Who is responsible and how to contact us

ODSOFT LLC is the controller: we decide why and how this review information is used. Our registered address is Proshyan street, building 1, apartment 11, Kentron district, 0019 Yerevan, Armenia. Our EU representative is Prighter EU Rep GmbH, Schellinggasse 3/10, 1010 Vienna, Austria; our UK representative is Prighter Ltd, company number 12854033, 20 Mortlake, Mortlake High Street, London SW14 8JN, United Kingdom. Both representatives can be reached through the Prighter privacy portal. We have not appointed a data protection officer; our privacy contact handles requests.

What we collect, where it comes from and why

We rely on our legitimate interests under Article 6(1)(f) of the GDPR and UK GDPR to understand and respond to reception of our own games, including criticism and reported problems, so that we can improve them. Our assessment is limited to that purpose and weighs it against your interests and rights, including your right to object below. Public availability is not your consent to this processing. We do not require a ShardPilot account from you to read your public review.

The internal display includes individual reviews and linked responses for authorised ODSOFT staff: no counts, no export and no individual reviewer profiles. Alongside reply drafting, we use sentiment and priority classification (including whether a review warrants a developer reply) and theme labeling across reviews of our own games. The derived labels, including the needs-reply result, are shown only to authorised operators inside the tool. Including derived labels in a drafting request to the configured LLM API provider or providers (Anthropic and/or OpenAI) is processor input inside the tool; the no-export limit means no publication and no transfer to any other recipient. This review-reading purpose does not include contact marketing or decisions with legal or similarly significant effects about you. For AI-assisted replies, review title and text are sent to OpenAI for embeddings and to the configured completion provider or providers (Anthropic and/or OpenAI) for classification, theme labeling and drafting, with the store provider, rating, locale (language) and app version also sent for classification and drafting and derived sentiment, priority and theme labels used in drafting; each reply is reviewed and edited by a studio operator before publication.

Information we hold

We store review and game identifiers, internal connector/workspace/listing/release references, processing status and collection times; the additional source fields differ by store.

For Steam, the information stored with a review is:

Review and game identifiers, including the Steam recommendation ID, together with internal connector, workspace, listing and release references.
The review text, recommendation, language and processing status, with submission, last Steam update and collection times.
A coded reviewer identifier made with a keyed hash when hashing is configured; Steam ID is used during collection for that matching code and the suppression check.
Helpful-vote count and weighted vote score, early-access and Steam-purchase indicators, and any public developer-response text, its presence indicator and response time.

The normal Steam collector leaves the author label empty and supplies no rating, title or app version for these reviews. It excludes the raw author object from the stored review projection: raw Steam ID, games-owned and review counts, lifetime playtime, recent playtime, playtime at review, Steam Deck playtime at review and last-played time are not copied into that projection. This does not mean that the native identifier is absent from suppression or other records, or that historical author data has already been removed.

For the Apple App Store, we store the review identifier and app identifier, star rating, title, body and reviewer nickname; language or territory, app version and creation time are retained when supplied, together with the source resource type and identifier. For Google Play, we store the review identifier and package identifier, reviewer display name, first user-comment text (split into title and body when supplied in that format), star rating, language, app version, user-comment update time and developer-comment presence. Those two stores’ display names are retained as author labels; they are not stable account identifiers, and the Steam author-label restriction does not apply to them. The source payload can contain other fields which these retained projections do not copy.

Separate linked-response and activity records can contain:

Reply, review, connector and workspace identifiers; reply text and status; source and action labels, generation reference and a key used to prevent duplicate requests.
Sentiment labels and scores, themes, priority labels and scores, a needs-reply indicator, screening labels, action metadata, and creation and update times.
Publication mode, the provider’s reply reference and publication time, and a sanitised error field.
Activity-record identifiers and links to the reply and review, connector and workspace; event and actor types, source and action metadata, screening labels and event time.

Action metadata can include actor and request identifiers; these are not a guarantee that all stored operator identifiers are anonymous. Review text, public developer responses, linked-reply text and the separately stored listing display name may themselves identify people. The current field selection is not general text anonymisation and does not establish that identifying text is absent from other retained copies.

We also keep operational review sync records for reliable collection, suppression accounting and error diagnosis. They include requested game/source scope and time range, selected review IDs, start and completion times, status and counts, and may contain identifying error text. They can relate to a person even though they are operational records.

Who receives it and where it is processed

OVH Hosting Limited, Ireland, provides our hosting and storage in France as a processor. Our director and DevOps engineer work in Armenia and can remotely administer the France-hosted systems. Armenia has no EU adequacy decision. When we fetch reviews, the relevant store operator receives our request metadata. LLM processors and transfers. The configured LLM API provider or providers (Anthropic and/or OpenAI) are US companies (Anthropic, PBC and OpenAI OpCo, LLC) and act as processors for the AI path described above. OpenAI receives the title/body embeddings even when completions use Anthropic; the OpenAI account, retention, residency and transfer conditions below therefore apply to that embedding route as well. The activation conditions require applicable SCC/UK instruments and a transfer assessment, with bounded disclosed retention or a specifically granted zero-data-retention arrangement; a request is not a grant. Anthropic’s direct service uses US/global processing; the owner’s decision is to assess that route under SCCs and a transfer impact assessment. For the OpenAI route, activation requires the owner’s verified eligible EU-residency project configuration for every call; US contractual/access exposure and endpoint exceptions still need assessment, and the EEA instrument route remains to be completed. These are the qualified routes and open conditions described in our policy, not a claim that account settings, provider retention or transfer safeguards have already been confirmed.

Armenia access

Our owner/director and DevOps engineer administer the France-hosted systems from Armenia; a third administrator also administers them from the owner’s workstation. Our reading for our internal review use treats this as our own administrative access to systems we control, rather than disclosure to a third-party controller. We record this reading in our accountability records and review it with counsel before any external customer uses the tool. It does not establish an EU adequacy decision or certify a transfer instrument.

The access controls cover three administrators, SSH key-only access to the database host and cluster nodes, kubeconfig held by the same administrators, OpenBao Kubernetes auth and GitHub two-factor. These measures do not establish per-operator or cluster MFA. Our rule prohibits copying review data to staff devices, but no-local-copy enforcement, managed endpoint controls and privileged-session capture are not verified; the associated risks remain. Hosting remains in France with OVH Hosting Limited, Ireland, as processor under its Data Processing Agreement. You can request a description of the safeguards at privacy@kervado.com.

The store operators receiving our approved replies are Valve, Apple and Google, alongside the reviewer and public readers of the published reply. On Steam, a studio operator posts the reply manually; ShardPilot does not send it automatically. The Apple App Store and Google Play adapters can submit approved reply text through their store APIs when that reply route is enabled. A later Steam collection may copy the public developer response into ShardPilot; the Google projection records developer-comment presence. Removal of a public reply uses the relevant store’s publisher tools and terms; deleting or expiring ShardPilot’s internal copy does not remove the public reply.

Steam publication

Our reply is our own public statement, posted manually through Steam Community from the studio account. The recipient and host of that publication is Valve Corporation (United States), under the Steam Distribution Agreement and Valve’s own terms. The reply appears where the review is already public. Our transfer reading for our internal review use is that ODSOFT discloses to Valve no personal data of the reviewer beyond what Steam already holds and what the reply itself says. The reply may identify people through that content; the original review’s existing availability does not make our reply a non-disclosure. We rely on this reading with no separate transfer mechanism selected. We record this reading in our accountability records and review it with counsel before any external customer uses the tool. Valve’s privacy policy is available on Steam; request our route/safeguard description at privacy@kervado.com.

Apple App Store publication

Reviews from this store are not yet collected; this publication-route and EU/UK transfer record is completed before that store’s first collection, including its actual recipient, permitted reply route, transfer reading/safeguard status and how to obtain the safeguards. The Steam reading does not cover this store.

Google Play publication

How long information is kept

While collection is enabled, it repeatedly checks each linked game listing under a connector for up to 100 recent reviews; the configured interval is 6 hours between passes, with timing varied slightly. Each review copy becomes eligible for removal after 30 days on its store-specific clock: Steam’s last review update, Apple review creation time, or Google user-comment update time, with the batched sweep configured at approximately hourly intervals. The Apple clock uses the supplied creation date; it is not a separately observed edit date. An update can extend that period where it changes the stored clock, and a public review can be collected again after a copy expires. This is not a 30-day maximum measured from the first collection.

Separately stored linked replies use 30 days from reply creation; their activity records use 30 days from event time, with earlier parent deletion also removing the linked records. Replies stuck in the publishing state are excluded from the independent reply sweep and can remain beyond that period. The separate AI copy contains the reply draft, derived sentiment and priority labels and scores, and theme labels and confidence scores; it has a 30-day period from AI-copy creation and does not share the reply row’s clock, so later-created AI copies can outlive the source review and editing a draft does not restart that clock. Deleting an integrations review does not by itself delete that separate AI copy; provider-side copies have their own retention setting and are not covered by our local 30-day clock. Separate AI-processing run records keep request filters and caller metadata, review/enrichment/generation references, outcomes, screening/error information and timestamps, with a default 30-day period from run creation; erasure removes matching per-review results, while the remaining run record expires through its separate sweep.

Operational review sync records are kept for 90 days from the start of each collection run and are then deleted; deleting a review does not remove its selected ID or identifying error text from a run record before that record expires. Collection runs left in a running state are marked abandoned after 24 hours and then expire under the same 90-day period; workspace or connector offboarding removes these records earlier. We have not yet verified complete rights handling for identifying sync records; requests about them are handled through the contact channel in this notice.

Suppression and rights-case records

Our suppression policy keeps the matching information needed to prevent a deleted review or an upheld objection from being undone by later collection. Suppression markers have no age-based expiry: they are removed only when the suppression is permanently retired, with a count-only record of that removal. A copy kept outside the main store so the suppression survives a restore follows the marker’s lifetime; that copy is still to be implemented. The policy for the separate identity-free decision reference and count-only receipt is 6 years from the decision. For public Steam reviewers, our policy for the Article 15–21 rights-case record is a separate 6-year period from case closure; it covers the case and request identifiers, coded reviewer identifier and key fingerprint, right requested, state and dates, without a raw reviewer identifier or review content. For Apple App Store and Google Play reviewers, the minimal operator-mediated case file follows the 3-year period from case closure until a store-specific decision is recorded; exported data and unnecessary identity evidence do not inherit that case-file period. The decision-reference period and the Steam case period are accountability policies; neither sets an expiry for suppression markers.

Backups and other copies

Backup copies can outlive removal from the live store. The PostgreSQL backup period is 30 days, configured on 17 September 2026; expiry under that setting has not yet been verified. The analytical ClickHouse backup period is 30 days; that is a separate store and does not establish the PostgreSQL limit. The copy policies also set 7 days for local write-ahead or spool copies, 72 hours for abandoned scratch database directories, one day for temporary generated software copies, and 30 days for diagnostic logs and 14 days for traces; VM snapshots, host logs and export destinations remain under the owner’s custody. Those copy policies do not establish that every copy has expired or been removed. Backup copies are for recovery, not ordinary review reading, and erased, restricted or corrected information must be reconciled before restored data is used. Complete copy expiry and restore reconciliation are not yet verified. Separate analytical copies, when that collection is enabled, have limits of 30 days for review text and 365 days for review facts; these copies are not used for the internal review display.

Your rights

For younger readers

The Steam account rule starts at 13, with additional country restrictions. The Apple account rule starts at 13 or the local equivalent, with younger accounts possible through Family Sharing or an approved educational institution. The Google account rule starts at 13 outside its listed higher-age countries; younger children can have parent-managed accounts through Family Link under Google’s terms. Google Play’s terms also require parental permission for a user who is a minor in their country and compliance with feature-specific age restrictions. These account rules are not proof of a reviewer’s age, and game age ratings do not establish it either. We may read your public review to understand and improve our own games, and the studio may reply on the relevant store’s public review thread. Our rule for those replies is to use the studio account in the public thread, with no direct messages, requests for personal details or individual follow-up; if you say you are a minor, we use only a standard studio response. You can email privacy@kervado.com if this worries you or you want us to stop using your information.

If someone else mentions you

If a review or a studio reply mentions you, send us the review link and identify the passage so you can ask for it to be removed from our copy. You do not have to be the review’s author to contact us. For Steam requests on this route, the author’s numeric Steam profile link is required; we do not resolve another person’s vanity link. For Apple App Store or Google Play requests, give the store, game/review link or review reference and the passage; a display name is not a stable account identifier, and identifying the material does not establish authority to receive another person’s data. We assess a proportionate remedy for the passage without handing someone else’s information to you or treating removal of the entire review as the default. We cannot yet confirm that a removed passage will stay removed through every later collection and restore.

Your right to object

You can object at any time, for reasons relating to your particular situation, to our processing based on legitimate interests. Contact privacy@kervado.com; we assess the objection and stop the disputed processing unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or need the processing to establish, exercise or defend legal claims. We explain our decision and how to challenge it, and you can request restriction while we assess your objection.

Other rights

You may request access, correction, restriction or erasure where applicable. Portability does not generally apply to this legitimate-interest activity; any processing that separately qualifies is considered on its own basis. Deleting our copy does not delete or change your review on the store where you posted it. A correction to our own copy does not change the store’s source text. We cannot yet promise a correction that survives every restore, complete deletion from every copy or prevention of every renewed copy. You can still make a request through the mailbox; we explain what can be done, any interim non-disclosing remedy and any remaining limit rather than report a queued request as completed.

Making a request

Email privacy@kervado.com with the review link and enough information to identify the material; do not email identity documents or unnecessary personal details. For Steam requests about your own review, the numeric profile link, in the form https://steamcommunity.com/profiles/<steamid64>/, is required. For Apple App Store or Google Play requests, give the store, game/review link or reference and identify the material; we assess proportionate proof before disclosing personal information, without treating a display name as proof of account control. Resolving a vanity link is not yet available. Steam sign-in and profile-code verification are not available through this rights route at this stage. A public link selects the material but is not proof that you control the account; access copies and correction require account-control or equivalent proof. We protect other people’s information in any access copy and confirm actual completion, including any remaining restrictions or exceptions. We respond without undue delay and normally within one month; if complexity or the number of requests permits up to two additional months, we explain the extension within the first month. Requests are free of charge. You can complain to your competent data-protection authority, including in the EU country where you live or work or where the infringement occurred; in the UK you can contact the ICO.

Publication and delivery record

For every future game on a covered store, we provide this same notice through the store-page privacy-policy field or the game’s own announcement, according to the notice-delivery route recorded for that game; no new notice version is needed. We complete that route before collecting the game’s reviews.

Steam delivery

Every future game also follows the per-game delivery rule above.

This is the Article 14(5)(b) exception and public-delivery record for the Steam portion of this notice; it is confirmed by the owner's publication commit that fills the publication record above. Population input: 112 reviews counted on 2026-09-15, a dated Steam-only estimate for the first collection, not a current count across all three stores. The material is public review text with any public author labels; public availability does not establish low sensitivity or remove the risks described above.

Channels considered: this notice on the studio page and the first covered game’s Steam news/events announcement; a link in a substantive studio reply; and direct notice. The normal Steam review projection has no dedicated contact-detail field; this is not a statement that identifying or contact text is absent from free text. The exception rests on the effort and additional data collection needed to find direct-contact channels beyond that review-reading flow, rather than assuming that a public review needs no notice. We do not collect new contact details solely for notice delivery. A reply may carry the notice link only when answering the review on its merits, never as a notice-only reply; the public reply is itself a disclosed output.

Initial listing’s public measures and timing: this page at https://kervado.com/reviewer-privacy-notice.html, the initial covered listing’s Steam news/events announcement dated 2026-09-18, the notice link in that listing’s Steam store-page privacy-policy field if available, and the link carried by substantive replies. Publication is required before collection is enabled and is recorded in our accountability records. We review the delivery decision for every new game or store, any new output, recipient or processing purpose, and at least every twelve months. People named by someone else are handled under the named-person rule above; this Steam delivery record does not establish delivery to them.

Apple App Store delivery

Every future game also follows the per-game delivery rule above.

Reviews from this store are not yet collected; this delivery or reasoned-exception record is completed before that store’s first collection, with its population, available individual/public channels, recipients, timing, public measures and review triggers. The dated Steam population and channel analysis do not apply to this store.

Google Play delivery

Every future game also follows the per-game delivery rule above.