Waterhole Patrol – Website & Mailing List Privacy Policy
Last updated: 26 October 2026
This policy covers the Waterhole Patrol website (waterholepatrol.com) and our mailing list for grown-ups. It does not cover the Waterhole Patrol app, which collects no personal information. The app has its own privacy policy at waterholepatrol.com/privacy.
Who we are: KEO Gaming is operated by KEO Consulting Pty Ltd (ABN 94 618 862 954, ACN 618 862 954), Tower One, 100 Barangaroo Ave, Barangaroo NSW 2000, Australia. Email: support@waterholepatrol.com. We are responsible for (the "controller" of) the information described here.
The short version
- The mailing list is for grown-ups only (18+): parents, carers and educators. Please don't sign up a child or give us a child's details.
- We only email you if you tick the box to say yes, and confirm by email (double opt-in).
- We store your email address and, if you choose, your role and country. We use them to send Waterhole Patrol news and to keep a record that you agreed.
- We never sell your details or share them with anyone except the services that help us run the list (listed below), or where the law requires us to. We don't track whether you open our emails or click links in them.
- Our own website pages set no cookies and have no analytics or ads. Buttondown's confirm and unsubscribe pages may set cookies (see Cookies below).
- You can unsubscribe at any time using the link in every email we send you, apart from the one-off email asking you to confirm your sign-up. After you unsubscribe, we stop emailing you straight away. We keep a suppression record (your email address, the date you unsubscribed, your consent record, and any role and country you gave) so we never email you again and can show that you agreed. If you'd like that record erased completely, email us at support@waterholepatrol.com and we'll delete it. If you choose a reason on Buttondown's unsubscribe page, it is stored with this record.
How sign-up works
- The sign-up form is on our own website. It sends your details to a small program that we run on Cloudflare (a Cloudflare Worker). The program checks the form and passes your details on to Buttondown, our email provider in the United States, which stores the list and sends our emails. The program doesn't keep a copy of your email address in our own logs.
- We pass the IP address you signed up from to Buttondown, so it can check that sign-ups are genuine and not spam.
- Buttondown then emails you a link to confirm. You're on the list only after you click it.
- We don't use a third-party CAPTCHA, and the form sets no cookies.
What we collect and why
| What | When | Why | How long we keep it |
|---|---|---|---|
| Email address | You join the mailing list | To send the news you asked for | Until you unsubscribe. After that we keep a suppression record (see the next row). |
| Role (parent or carer, or educator) and country – optional | You choose to tell us at sign-up | To send the right content and dates for your country | As above |
| Your 18+ confirmation and consent record (date and time of sign-up, the sign-up wording you agreed to, how you signed up, the IP address you signed up from) | At sign-up | To show we have your consent, as anti-spam laws require, and to check sign-ups are genuine | While you're subscribed. When you unsubscribe, we stop emailing you straight away. Our email provider keeps a suppression record of your email address, your unsubscribe date, your consent record, any role and country you gave, and the reason you choose on Buttondown's unsubscribe page, if any, so you're never emailed again by mistake (for example, if a list is re-imported) and so we can show that you agreed and that we followed the law. If you ask us to erase it completely, we will; it then leaves our provider's backups within 2 days. |
| Emails you send us | You write to support@waterholepatrol.com or reply to one of our emails | To answer you | 24 months after our last reply, then deleted. Held in our Google Workspace mailbox (see Who we share it with). |
| Website access information (IP address, browser, page address, referring page) | You visit the website | Processed automatically by our host, Cloudflare, to deliver and secure the site. We don't use it to identify or track visitors. | Kept by Cloudflare under its own privacy policy and retention periods, which we can't change |
We don't use any website analytics or statistics tools.
Children: we don't knowingly collect information from or about children. If a child signs up, or you send us a child's details, we'll delete them completely. Please don't include children's names or details when you reply to our emails or fill in a form.
Cookies
Our own website pages set no cookies. The sign-up form is ours, and you land on our own "thanks" and "confirmed" pages after you sign up.
Two steps happen on Buttondown's own pages: the link you click to confirm your subscription, and the unsubscribe page. When you confirm or unsubscribe, you'll briefly visit a page run by Buttondown. It may set cookies, including one called fingerprint (kept until you close your browser) and one called initial_path (kept for up to 90 days), under Buttondown's cookie policy.
- fingerprint: a session cookie (deleted when you close your browser), which Buttondown classes as essential and analytics;
- initial_path: a functional cookie that records the page you first arrived on; kept for up to 90 days.
Buttondown's cookie policy lists other cookies it may use on its pages (for example for spam prevention). We don't receive or use these cookies. Buttondown's cookie policy was last updated on 16 September 2026, and we checked it on 26 October 2026.
Who we share it with
- Buttondown (email newsletter provider), which stores the mailing list and sends our emails from mail.waterholepatrol.com. Open and click tracking is turned off, so we can't see whether you open our emails or click links in them. Buttondown adds a hidden link to each email so that automatic mail scanners can't confirm or unsubscribe people by accident. Data is stored in the United States. Buttondown also receives the IP address you signed up from.
- Cloudflare, Inc. (United States), which hosts our website using its Workers static assets service, runs the small program that handles our sign-up form (a Cloudflare Worker), and forwards emails sent to support@waterholepatrol.com to our company inbox (Cloudflare Email Routing). Cloudflare processes technical data such as IP addresses to deliver and protect the site, and may process forwarded emails in the United States and other countries where it operates.
- Google Workspace (Google LLC), which hosts our company mailbox and stores the emails you send us and our replies. Unless a Google Workspace data region is set, Google may store and process this information in the countries where Google or its sub-processors operate, including the United States. Google acts as our data processor under its Cloud Data Processing Addendum.
- We may disclose information if the law requires it.
We never sell your information or use it for advertising.
Overseas storage: your mailing-list details are stored in the United States (Buttondown), and emails you send us with Google Workspace, which may store and process them in the countries where Google or its sub-processors operate, including the United States. Cloudflare processes website visits, sign-up form submissions and forwarded emails in the United States and other countries where it operates. We choose providers that protect information to a comparable standard. For UK users: Buttondown transfers are covered by the UK International Data Transfer Addendum to the EU standard contractual clauses in Buttondown's data processing agreement; Cloudflare, Inc. is certified under the UK Extension to the EU–US Data Privacy Framework (the "UK–US data bridge"), and its data processing addendum includes the EU standard contractual clauses with the UK Addendum; Google LLC is certified under the UK Extension to the EU–US Data Privacy Framework, which Google relies on for UK personal data sent to the United States, and Google's Cloud Data Processing Addendum includes the EU standard contractual clauses with the UK Addendum for transfers that framework doesn't cover. For New Zealand and Canadian users, we tell you here where your information is stored, and we use contracts with our providers to protect it.
Emails and your consent
Our mailing list is set up around the anti-spam laws of the countries we market to: - Australia – Spam Act 2003: we only send with your express consent, identify KEO Consulting Pty Ltd in every marketing email we send and honour unsubscribes within 5 working days. - New Zealand – Unsolicited Electronic Messages Act 2007: consent, accurate sender details and a working unsubscribe in every marketing email we send. - United States – CAN-SPAM Act: our postal address is in every marketing email we send, and opt-outs are honoured within 10 business days. - United Kingdom – PECR and UK GDPR: we email you only with your consent, which you can withdraw at any time. - Canada – CASL: we ask for express consent that identifies us and our contact details, tell you that you can withdraw it, and keep a record of it.
Every marketing email we send includes our name, ABN, address, a link to this policy and an unsubscribe link. The one-off email asking you to confirm your sign-up is sent by Buttondown and only asks you to confirm; it doesn't carry these details or an unsubscribe link. Unsubscribe requests are actioned straight away and never later than the shortest legal deadline above.
We send about one email a week for about three weeks before and after the game's launch, then about one a month or less.
Your rights
You can ask to see, correct or delete the information we hold about you, or withdraw your consent, at any time. Email support@waterholepatrol.com. We'll reply within 30 days. - Erasing your record: if you've unsubscribed, we keep the suppression record described above. If you'd like that record erased completely too, email us at support@waterholepatrol.com and we'll delete it. Once it's gone, we can no longer recognise your address, so if someone signs it up again you'd get a new confirmation email and nothing more unless you confirm. - Australia: you can ask for access to and correction of your personal information. See the Australian Privacy Principles at www.oaic.gov.au. - UK: under UK GDPR our lawful basis is your consent for the mailing list, and our legitimate interests for answering your emails and for keeping the suppression record after you unsubscribe. You also have the rights to restrict or object to processing and to data portability. - Canada: you can withdraw consent and ask how your information is handled under PIPEDA. - US (California and other states): we don't sell or share personal information for cross-context behavioural advertising.
Security
We use providers with strong security, limit access to a small number of KEO staff, and use HTTPS on our website. If a data breach is likely to cause you serious harm, we'll tell you and the relevant regulator as the law requires.
Complaints
Please contact us first at support@waterholepatrol.com. If you're not satisfied, you can complain to: - Australia: Office of the Australian Information Commissioner – www.oaic.gov.au, 1300 363 992 - New Zealand: Office of the Privacy Commissioner – www.privacy.org.nz - United States: Federal Trade Commission – www.ftc.gov - United Kingdom: Information Commissioner's Office – ico.org.uk - Canada: Office of the Privacy Commissioner of Canada – www.priv.gc.ca
Changes
If we add a playtest or feedback form, we'll update this policy first. If we change this policy, we'll update the date above. If a change is significant, we'll email subscribers before it takes effect.