THICK AS THIEVES
Privacy Notice
Version 1
Date of Issue: 1st of May, 2026
About This Notice
We are Aonic UK Ltd (doing business as Megabit Publishing), a company incorporated and registered in England and Wales (registration number 14488533) with our registered address at Unit Efg, 4th Floor Zetland House, Scrutton Street, London, England, EC2A 4HJ. We are a video games publisher.
This notice explains how we collect and process personal data relating to users of Thick as Thieves (“the Game”) and any services we provide in connection with the Game (“the Services”). When we decide how and why your personal data is processed, we act as the data controller.
Thick as Thieves is developed by Otherside Entertainment and published on the Steam platform.
If you have any questions about this notice or your personal data, contact us at dataprotection@megabit-publishing.com or hello@megabit-publishing.com.
This notice covers only the Game and the Services. Where the Game links to websites or services not operated by us (including the Steam platform), please refer to their own privacy notices.
What Data We Collect and Why
The data we collect depends on how you use the Game. We only collect personal data when we have a lawful reason to do so. This section sets out each type of data, its purpose, and the legal basis we rely on.
Gameplay Data
Legal basis: contract performance
We collect the following data to operate the Game, enable multiplayer features, and deliver your gameplay experience:
- Steam Player ID - your unique identifier on the Steam platform, used to authenticate your session and link your gameplay data
- Gameplay activity - gear selection, session outcomes, character choice, and virtual currency earned
- Session data - session times and connection information
- Player customisation - any in-game cosmetic or loadout choices you make
We do not collect your Steam username, email address, real name, or any other personal information from your Steam profile. Account creation and authentication are handled entirely by Steam.
Technical Data
Legal basis: legitimate interest (ensuring the Game functions correctly and securely)
When you play the Game, the following technical data is processed as part of the normal operation of the client-server connection:
- IP address - used for network routing and to identify your approximate geographic region
- Device operating system - used to ensure compatibility and diagnose technical issues
This data is necessary for the Game to function and is not used for advertising, profiling, or any purpose unrelated to operating the Game.
Gameplay Analytics
Legal basis: legitimate interest (improving game balance and the overall player experience)
We collect gameplay analytics data to understand how players interact with the Game, to monitor game balance, and to improve the gameplay experience. This data is processed through GameAnalytics.
To track gameplay patterns across sessions (for example, to understand how many attempts it takes to complete a level), we assign each player a randomly generated unique identifier. This identifier is generated by our backend system, is specific to this Game only, and is not linked to your Steam account, real name, email address, or any other personally identifying information. It allows us to follow a player’s journey through the Game over time, but it cannot be used to identify who you are outside the Game.
The analytics data we collect includes:
- Randomly generated unique player identifier (not your Steam ID)
- Gameplay behaviour patterns (e.g. gear selection popularity, character choice, session outcomes, level attempts)
- Session lengths and frequency
- Virtual currency earned and spent
This data is used solely for game improvement and balancing purposes. It does not track any out-of-game behaviour or identity, and is not used for advertising, profiling, or automated decision-making.
Steam Platform Features
Legal basis: contract performance
The Game operates on the Steam platform. Certain features - including friends lists, chat, voice communications, and matchmaking - are provided and managed entirely by Steam (Valve Corporation). Ban lists are also managed by Steam; we do not store ban lists or any moderation data on our servers. We do not operate these social and moderation features independently.
Through the Steamworks API, we access limited data associated with your Steam account for authentication purposes, such as your public persona name, avatar, game ownership status, and whether you have received a ban for cheating in a multiplayer game. Your Steam ID is converted to an internal game identifier (Pragma ID) for gameplay purposes; we do not permanently store your Steam ID. Valve does not share your real name, email address, or other personally identifying information with us through the API.
For information about how Steam processes your data, please refer to Steam’s privacy policy.
Crash and Error Reporting
Legal basis: consent (users choose whether to submit crash reports)
The Game uses BugSplat to collect crash reports and error logs. Submitting a crash report is voluntary - when the Game encounters an error, you are given the choice of whether to send a report. If you choose to send a report, it may include:
- minidump and memory state data
- stack trace
- registers and loaded modules
- system and runtime information
Crash reports do not contain your Steam ID, player identifier, or any other personally identifying information. They are used solely to identify and fix technical issues and are not used for analytics, profiling, or advertising.
Competitions and Promotions
Legal basis: consent
From time to time, we may run competitions or promotions in connection with the Game (for example, through third-party platforms such as Gleam). If you choose to enter a competition or promotion, we may collect your social media handle, email address, and (if you are a winner) your name and postal address for prize delivery.
Participation is always voluntary. Your data will only be used for the purpose of administering the competition or promotion and will not be used for marketing unless you separately consent. You can withdraw your consent at any time by contacting us at dataprotection@megabit-publishing.com.
How Long We Keep Your Data
We keep your data only for as long as it is needed for the purposes described in this notice. When data is no longer needed, we delete it or anonymise it. The following retention periods apply:
- Steam Player ID and gameplay data - retained for as long as you use the Game. You can request deletion at any time.
- Analytics data and player identifier - retained for as long as the Game is actively supported and maintained. The randomly generated player identifier can be deleted on request. Aggregated, non-identifiable analytics insights may be retained indefinitely for product improvement.
- Technical data (IP address, device OS) - processed transiently during your session and not retained in a personally identifiable form beyond what is necessary for server operation.
- Crash reports (BugSplat) - retained for up to 1 year, then deleted.
- Competition and promotion data - retained only for the duration of the competition or promotion, plus any period required for prize delivery and legal compliance. Deleted promptly thereafter.
In some cases, we may need to retain data for longer where required by law. If we do, we will keep it secure and continue to respect your rights where possible.
Who We Share Your Data With
We share your data only where necessary and only with the following recipients:
- Valve Corporation (Steam) - to operate the Game on the Steam platform and facilitate platform features including authentication, matchmaking, and social features.
- Pragma Platform, Inc. - our backend services provider, based in Culver City, California (USA). Pragma provides the server infrastructure that powers the Game’s online features. Their data processing agreement requires them to process your data only on our instructions.
- GameAnalytics - our analytics provider. GameAnalytics processes aggregated gameplay data to help us understand player behaviour and improve the Game. Data resides on AWS and Google Cloud infrastructure.
- BugSplat - our crash reporting provider. If you choose to submit a crash report, it is processed by BugSplat to help us identify and resolve technical issues.
- Otherside Entertainment - the development studio for Thick as Thieves. Otherside may receive data to assist with development, analytics, and technical support. They are subject to the terms of this privacy notice.
- Law enforcement and authorities - where required by law, to comply with legal obligations, or to protect the rights and safety of our users.
- Corporate transactions - if Aonic UK Ltd undergoes an investment, merger, acquisition, or sale of assets, personal data may be shared as part of that process.
Our data processing agreements with service providers require them to process your data only on our instructions and to maintain appropriate security measures. They are prohibited from using your data for their own marketing.
Aonic UK Ltd does not sell your personal data to third parties.
International Data Transfers
Some of our service providers are based outside the United Kingdom and European Economic Area. In particular, Pragma Platform, Inc. is based in the United States and processes data in the United States and the European Union. Where we transfer personal data to a country that does not provide an equivalent level of protection, we put appropriate safeguards in place as required by law, including standard contractual clauses approved by the relevant authorities.
For more details about international data transfers, contact us at dataprotection@megabit-publishing.com.
Cookies and Similar Technologies
The Game does not use cookies. There are no advertising SDKs, tracking pixels, or similar technologies integrated into the Game.
Deleting Your Data
You can request deletion of your data at any time, free of charge, regardless of where you are located. Email us at dataprotection@megabit-publishing.com or hello@megabit-publishing.com.
We will act on your request within 30 days. In some cases, we may need to retain certain data where required by law (for example, to comply with a legal obligation or to resolve a dispute). If any exception applies, we will explain why.
Your Rights
Depending on where you are located, you may have rights under applicable data protection laws. These include the right to:
- access the personal data we hold about you;
- correct any inaccurate or incomplete data;
- restrict how we process your data;
- request a copy of your data in a portable format;
- object to our processing of your data; and
- withdraw your consent at any time.
To exercise any of these rights, email us using the contact details in the “How to Contact Us” section below. We will respond within 30 days. If we need more time, we will let you know within that period and explain why.
These rights are not absolute - in some circumstances, we may be unable to fulfil a request in full. If that happens, we will explain why.
If you are not satisfied with how we handle your request, you have the right to lodge a complaint with your local data protection authority. In the UK, this is the Information Commissioner’s Office (ico.org.uk). In the EU, find your supervisory authority via the European Data Protection Board (edpb.europa.eu).
Children’s Privacy
Thick as Thieves is distributed on the Steam platform. We do not knowingly collect personal data from children under the age of 13 and do not market the Game to children.
Steam requires users to be at least 13 years old to create an account. We rely on Steam’s age verification and parental controls. If we become aware that we have collected personal data from a child under 13 without appropriate consent, we will delete that data without delay.
If you are a parent or guardian and believe your child has provided personal data through the Game, please contact us at dataprotection@megabit-publishing.com and we will take steps to delete the data promptly.
Additional Information for California Residents
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). The categories of personal information we collect are described in the “What Data We Collect and Why” section above.
We do not sell or share your personal information for cross-context behavioural advertising. We do not use sensitive personal information beyond what is necessary to provide the Game.
Under California law, you have the right to:
- request access to the categories and specific pieces of personal information we have collected about you;
- request deletion of your personal information;
- request correction of inaccurate personal information; and
- opt out of the sale or sharing of your personal information.
We will not discriminate against you for exercising any of these rights. To make a request, contact us using the details in the “How to Contact Us” section. We will respond within 45 days, as required by California law.
Changes to This Notice
We may update this notice from time to time - for example, when our services change or when the law requires it. When we do, we will update the date at the top of this notice. For significant changes, we may also notify you directly.
We encourage you to review this notice regularly.
How to Contact Us
If you have any questions about this notice or wish to exercise your rights, contact us at:
- dataprotection@megabit-publishing.com - for privacy and data rights requests
- hello@megabit-publishing.com - for player support
When making a data rights request (such as a deletion or access request), please include the nature of your request in the subject line so we can respond promptly.