PRIVACY POLICY

Last Updated: Aug 19, 2026

Superposition NULL OÜ ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we process information when you play our video games on VR, PC, and Console platforms (the "Games") and when you visit our website (the "Website"). Because our Games are distributed through third-party platforms, we do not collect directly identifying contact details such as your name, email address, or phone number. We do, however, process platform identifiers and gameplay data, which constitute personal data under the GDPR, and we describe below exactly what that means.

1. WHO IS RESPONSIBLE FOR YOUR DATA

UnLoop is developed by Superposition NULL OÜ and published by CM Games OÜ. The platform developer accounts through which the Game is distributed (Steam, Meta, PICO) are held by CM Games OÜ.

Both companies act as controllers of the limited data described in this Policy: Superposition NULL OÜ in respect of game functionality, community, press, and content-creator correspondence, and CM Games OÜ in respect of store distribution and platform account administration.

Superposition NULL OÜ — Uus-Sadama tn 21-207, 10120 Tallinn, Estonia. Registry code 17216135. privacy@superpositionnull.com

CM Games OÜ — A. H. Tammsaare tee 92, 13423 Tallinn, Estonia. Registry code 11617092. privacy@cm.games

Superposition NULL OÜ is your point of contact for any question or request under this Policy, and will coordinate with CM Games OÜ where necessary.

2. INFORMATION WE ACCESS AND PROCESS

When you interact with our Games, we may access and process the following data through the platform you use (Meta, PICO, Steam):

Platform Identifiers: Your unique Platform Player ID, profile nickname, and avatar.
Gameplay Data: Your game progress, level results (such as completion time and actions taken), achievements, and leaderboard scores.
Device Permissions (Microphone Access): Our Games may request access to your device's microphone. In UnLoop, voice recording is part of the core gameplay: what you say is recorded so that your past selves can replay it back to you within the time loop. This audio is captured and processed locally on your device and is written to a separate local file, stored alongside your game data on the device itself. It is not transmitted to us, is not stored on our servers, is not shared with other players, and — unlike your game progress — it is not included in platform cloud saves and never leaves your device. You can remove it at any time by deleting your local game data. Microphone permission is entirely optional, and you can deny or revoke it at any time through your device or platform settings.
Storage Access: We access your device's local storage to write and read game save files, and we utilise the platform's native features for cloud saves.
Platform Analytics: The platform software development kits integrated into our Games (Steam, Meta, PICO) collect aggregate technical and usage statistics — such as session counts, crash reports, hardware configuration, and performance data — under the platform operator's own privacy policy. We do not operate our own analytics or telemetry in the released Games, and we receive this information only in aggregated form through the platform's developer dashboard.
When you visit our Website: Our Website is hosted by Google Sites. Google automatically collects certain standard technical information (such as IP addresses, browser types, and hosting cookies) necessary to display and maintain the website. We do not independently collect, track, or analyse this data, and we do not place advertising or analytics cookies of our own.

3. HOW WE USE YOUR INFORMATION

We use the data listed above solely for the following purposes:

To provide, maintain, and improve our Games and their features.
To display your nickname and avatar on public, in-game leaderboards.
To save your game progress locally and via platform cloud saves.
To enable in-game voice functionality, if microphone access is granted.
To diagnose crashes and technical faults, using the aggregated information made available to us by the platform.

4. LEGAL BASIS FOR PROCESSING (FOR EU USERS)

Under the EU General Data Protection Regulation (GDPR), our legal basis for processing this data is:

Performance of a Contract: To deliver the game functionality and services you requested.
Legitimate Interests: To maintain accurate leaderboards, track game achievements, diagnose technical faults, and optimise gameplay performance.
Consent: For access to your device's microphone, and for any marketing communications you sign up to. You may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

5. DATA RETENTION

We keep data only for as long as it is needed for the purposes described above:

Leaderboard entries and associated platform identifiers are retained for as long as the relevant leaderboard is active, or until you ask us to remove your entry.
Game progress and save data is stored on your own device and, where cloud saves are enabled, by your platform operator under its retention rules. We do not hold copies. It is removed when you delete your game save or the Game itself through your platform account.
Recorded voice audio is stored only in a local file on your device, is never uploaded to us or to a platform cloud save, and is removed when you delete your local game data.
Aggregated platform analytics and crash reports are retained by the platform operator in accordance with its own privacy policy. We do not retain individual-level records.
Correspondence you send us by email is retained for up to 24 months from our last exchange, unless you ask us to delete it sooner.

6. DATA SHARING AND THIRD-PARTY SERVICES

We do not sell, rent, or share your data with third-party advertisers or marketing companies. However, your data is processed by the platforms hosting our Games and Website. You can find their respective privacy policies here:

Where required, we also share information with CM Games OÜ as publisher, as described in Section 1.

7. INTERNATIONAL TRANSFERS

The platform operators through which our Games are distributed (Valve, Meta, PICO) and our website host (Google) may process data outside the European Economic Area, including in the United States. Such transfers are carried out under the safeguards those operators maintain, including adequacy decisions of the European Commission, the EU–U.S. Data Privacy Framework, or standard contractual clauses, as described in their respective privacy policies. We do not ourselves transfer personal data outside the European Economic Area.

8. MARKETING, PRESS AND COMMUNITY

If you contact us by email, sign up for our newsletter or playtests, or request a review or content-creator key, we process the contact details and correspondence you provide. Our legal basis is your consent, in the case of marketing communications, or our legitimate interest in responding to enquiries and administering press and creator relations.

You can withdraw your consent or ask us to delete your details at any time by writing to privacy@superpositionnull.com. We do not sell or rent these details to anyone.

9. CHILDREN'S PRIVACY

Our Games are rated PEGI 12 and are not directed to children under the age of 13 without the consent and supervision of a parent or legal guardian. Virtual reality hardware manufacturers and storefronts set their own minimum age requirements, which apply in addition to this Policy.

If you believe we have inadvertently accessed data from a child without proper consent, please contact us and we will coordinate with the relevant platform to address it.

10. DATA SECURITY

We apply reasonable technical and organisational measures to protect the limited information we hold, including access controls on our developer accounts and correspondence. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Data held by platform operators is protected under the security measures described in their own policies.

11. YOUR RIGHTS (GDPR)

Depending on your location, you have rights under data protection laws, including the right to access your data, to have it corrected or erased, to restrict or object to its processing, and to receive it in a portable format. Where we rely on legitimate interests as our legal basis, you have the right to object to that processing at any time.

Because most of your data is managed and stored by the platform operator (Steam, Meta, PICO), the fastest way to exercise these rights is through your platform account settings, or by submitting a request directly to the platform operator.

You may also contact us directly at privacy@superpositionnull.com. We will respond to your request within one month of receipt, as required by the GDPR.

You also have the right to lodge a complaint with a data protection supervisory authority. Our lead supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia — info@aki.ee — www.aki.ee. You may also complain to the supervisory authority in your own country of residence.

12. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date.

13. CONTACT US

If you have any questions about this Privacy Policy, you can reach us at: privacy@superpositionnull.com

Page updated

Report abuse