Layton Labs AB

Privacy policy

Last updated 14 September 2026

This policy explains how Layton Labs AB handles your personal data when you visit laytonlabs.se and get in touch with us, and when you use a Layton Account or play our games, such as Mercyful. The first sections cover the website. The section Layton Account and our games covers the account and the games. We collect as little as possible, use no tracking tools, and never sell your data.

Who is responsible for your data

The data controller is Layton Labs AB, Swedish company registration number 559590-8202, based in Stockholm, Sweden. If you have questions about how we handle your data, reach us at jean@laytonlabs.se.

What we collect

• When you leave your email in the form: your email address and the optional message you choose to write.
• Automatically when the form is submitted: your IP address, browser information (user agent), referring page (referer) and a timestamp. We keep this for security and to prevent spam and abuse.
• If you click "Book a meeting": we receive a notification with your approximate location (city, region, country) and IP address, and you are sent on to Google Calendar to book the time. The booking itself is handled by Google.

We use no web analytics, no tracking cookies and no advertising cookies. We do not profile you.

Cookies

We use a single functional cookie, lang, which remembers your language choice (Swedish or English) for up to a year. It is needed for the site to show the right language and is not used for tracking.

The account page at laytonlabs.se/account does not use a cookie to keep you signed in. It keeps your sign-in session in your browser's sessionStorage, which is cleared when you sign out or close the tab. If the account page offers sign-in with Apple or Google, it sets a short-lived, strictly necessary security cookie for each of these options when they load, to protect the sign-in. The cookie expires after at most 10 minutes and is removed when a sign-in with Apple or Google completes. Loading these options also loads Apple's or Google's sign-in script, and Apple or Google may set their own cookies under their own privacy policies.

No other cookies are set.

Why we process your data, and the legal basis

• To reply to your inquiry and follow up on a possible project. Legal basis: your consent when you give us your email, together with our legitimate interest in responding to and following up on inquiries and taking steps toward a possible agreement.
• For security and operations (IP address, user agent, referer). Legal basis: our legitimate interest in protecting the site from abuse.
• The language cookie is necessary for the service to work.

Who we share data with

We rely on a few carefully chosen providers (data processors) to run the site:

• Cloudflare: hosting and database. What you send in the form is stored in a database within the EU. Cloudflare also processes traffic data for security.
• Pling (plingpush.com): a notification service that alerts us when a new inquiry comes in. For an inquiry, your email address and message are included in the notification to us.
• Google: only if you choose to book a meeting, for calendar and booking handling.

We do not share your data with anyone for marketing, and we never sell it. Where data is processed outside the EU/EEA, it is done under appropriate safeguards, such as the EU Standard Contractual Clauses.

How long we keep it

We keep your inquiry for as long as we need to handle the conversation and a reasonable period afterward. You can ask us to delete it sooner at any time.

Layton Account and our games (Mercyful)

This section covers Mercyful, our game for iPhone and iPad, and Layton Account, the free account for our games at laytonlabs.se/account. Layton Labs AB is the data controller here too. You can play the campaign without an account, and it sends no personal data to us. The game has no ads, no analytics and no tracking, and we never sell your data.

What we collect

• When you create or sign in to a Layton Account: your email address. We email you a six-digit sign-in code and store only a hashed version of it. The code expires after 10 minutes, and expired codes are cleaned up automatically. If you sign in with Apple or Google, where offered, we receive the account identifier and email address that Apple or Google shares with us.
• Account and sign-in details: a random account ID and when the account was created. For each sign-in we also store when it started and when it was last used, and for sign-ins from the game, the device model and operating system (for example the model "iPhone17,2" and "iOS"). Sign-in tokens are stored on our side only in hashed form.
• Cloud save: while you are signed in, the game uploads your saved game to your account so your progress follows you between devices. It includes campaign progress, wins and losses, in-game currency, items and unlocks, the look you chose for your character, achievement progress and game settings such as music and display.
• Online play: when you play online, the game connects to our match server and sends the online name you chose, your character's look, the items you bring to the table and your moves. Without an account, the game creates a random player code on your device, and our server stores only a hashed version of it. When you are signed in, the server identifies you by your account instead. In the game, Ranked matches require a Layton Account. Your opponent sees your online name and your character's look, and in Ranked also your rank and rating.
• Your online name and ranked record: the match server keeps the online name you chose, which cannot be changed, and, if you play Ranked, your rating, wins and losses. If you have an account, your rating, wins and losses are also stored in your Layton Account.
• Name check: before a new online name is accepted, our match server sends only the name to OpenAI's moderation service to check that it is not offensive. No email address, account ID or device information is sent with it.
• Technical data: like any internet service, our servers receive your IP address when the game or the account page connects. We use it only to deliver the service and protect it from abuse. It is kept only in security logs that are deleted or overwritten automatically, and we do not use it to work out where you are.

We do not collect your location, contacts, photos, advertising identifier or crash reports. We do not profile you and we show no ads.

Game Center

On iPhone and iPad, Mercyful uses Apple's Game Center for achievements. Game Center is provided by Apple under Apple's own privacy policy. The game tells Game Center which achievements you have earned. We do not receive your Game Center identity or friends list.

Why we process the data, and the legal basis

• To provide the account, cloud save, online matches and ranked play that you ask for. Legal basis: performance of our agreement with you.
• To keep online play safe and fair (name check, abuse protection and security logs). Legal basis: our legitimate interest in protecting players and the service from abuse.
• To email you sign-in codes. Legal basis: performance of our agreement with you. We never use your email address for marketing.

Who we share data with

• Cloudflare: runs Layton Account and the account page, stores account data and cloud saves in a database located in Europe, and sends the sign-in emails. Cloudflare also processes traffic data for security.
• Hetzner Online: hosts our match server in Helsinki, Finland.
• OpenAI (United States): checks new online names for offensive content. Only the name is sent.
• Apple: Game Center, and Sign in with Apple if it is offered and you choose it. Google: only if Google sign-in is offered and you choose it.

Other players see your online name and your character's look during matches, and in Ranked also your rank and rating. We do not share your data with anyone for marketing, and we never sell it. Where data is processed outside the EU/EEA, as when OpenAI checks online names in the United States, it is done under appropriate safeguards, such as the EU Standard Contractual Clauses. Contact us if you want a copy of these safeguards.

How long we keep it

• Account data, sign-in details, cloud save and ranked record: for as long as you have a Layton Account. They are deleted when you delete your account.
• Sign-in codes expire after 10 minutes, and expired codes are cleaned up automatically. A sign-in stops working when you sign out, or after 90 days without use.
• Online names and ranked records without an account are tied only to the hashed player code from your device, not to an email address. We keep them until you ask us to delete them. Contact us with your online name if you want them deleted.
• When you delete your Layton Account, the copy of your online name and ranked record on our match server is removed within 30 days.
• Security logs that contain IP addresses: the account service's logs are deleted automatically after at most 7 days, and the match server's logs have a fixed maximum size, so older entries are overwritten automatically by newer ones.
• Deleted data may persist in automatic database backups for a limited period, up to 30 days, before being overwritten.

Deleting your account

You can delete your Layton Account at any time:

• In the game: go to bathroom TV > FIND A TABLE > MULTIPLAYER > ACCOUNT > DELETE ACCOUNT and confirm with CONFIRM DELETE.
• On the web: sign in at laytonlabs.se/account, choose Delete account and type DELETE to confirm.
• By email: write to jean@laytonlabs.se from the address linked to your account.

In the game and on the web, the deletion takes effect immediately. Deleting your account permanently removes:

• your email address and any linked Apple or Google sign-in
• your account ID
• all sign-ins, so every device is signed out
• your cloud save
• your ranked rating, wins and losses
• the online name and ranked record our match server holds for the account (within 30 days, as described above)

This cannot be undone. Progress saved locally on your device stays there until you delete the game. Game Center achievements are managed by Apple.

Your rights for game and account data

The rights described under Your rights below also apply to game and account data. You can ask for access to your data or a copy of your cloud save, ask us to correct or erase it, and object to or restrict processing. Contact jean@laytonlabs.se. Mercyful is rated 17+ and is not intended for children.

Your rights

You have the right to request access to your data, to have it corrected or erased, to object to or restrict processing, to receive your data (data portability), and to withdraw your consent at any time. Get in touch at jean@laytonlabs.se and we will help you.

If you are unhappy with how we handle your data, you have the right to complain to the Swedish Authority for Privacy Protection, IMY.

Changes to this policy

If we change this policy, we update the date at the top of the page.