Privacy Policy and Data Notice

1. Introduction

This Privacy Policy explains how Yellow House Productions Pvt Ltd ('Yellow House,' 'we,' 'our,' or 'us'), the operator of Helixra (helixra.art), collects, uses, stores, and protects your personal data. Helixra is a free-to-play digital archive of Sri Lanka's traditional games (jana kreeda), developed in alignment with the UNESCO 2003 Convention for the Safeguarding of Intangible Cultural Heritage and the World Intellectual Property Organization (WIPO) Traditional Cultural Expressions (TCE) frameworks.

By accessing helixra.art or creating an account, you agree to the practices described in this policy. If you do not agree, please do not use the platform.

2. Data Controller

The data controller for all personal data collected through helixra.art is:

Yellow House Productions Pvt Ltd is registered and operates under the laws of Sri Lanka. Where users access the platform from the European Economic Area (EEA), United Kingdom, or other jurisdictions with applicable data protection laws, we comply with those requirements to the extent applicable.

3. What Data We Collect

3.1 Account Registration Data

When you create an account on helixra.art, we collect:

• Your name or display name
• Email address
• Password (stored as a cryptographic hash - never in plain text)
• Date of account creation
• Optional: organisation or institution name

3.2 Gameplay and Platform Data

When you use the Helixra platform and play games, we may collect:

• Game session data (moves, duration, outcomes)
• Game progress and save states, stored locally in your browser (localStorage) and/or associated with your account
• Platform navigation behaviour (pages visited, time on platform)
• Device type and browser type (collected via analytics - see Section 3.4)

3.3 Voluntary Submissions

If you subscribe to Helixra dispatches or contact us directly, we collect:

• Name and email address provided at the time of subscription or contact
• The content of your message or enquiry

3.4 Analytics Data (Google Analytics)

We use Google Analytics (provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) to understand how visitors use helixra.art. Google Analytics collects:

• Pages visited and time spent on each page
• Referring website or source
• Approximate geographic location (country or city level - not precise location)
• Device type, operating system, and browser
• Session and user counts

Google Analytics uses cookies and similar tracking technologies to collect this information. The data is transmitted to and stored on Google servers, which may be located outside Sri Lanka, including in the United States.

You may opt out of Google Analytics tracking at any time by:

• Installing the Google Analytics Opt-out Browser Add-on (available at tools.google.com/dlpage/gaoptout)
• Enabling 'Do Not Track' in your browser settings (note: we honour this signal where technically feasible)
• Adjusting your browser's cookie settings to block third-party cookies

For more information on how Google processes data, please review Google's Privacy Policy at policies.google.com/privacy.

3.5 Browser Local Storage

Helixra games use your browser's local storage (localStorage and/or sessionStorage) to save game state, preferences, and progress on your device. This data:

• Is stored only on your device, not transmitted to our servers (unless linked to your account)
• Is not a tracking cookie and is not used for advertising
• Can be cleared at any time by clearing your browser's site data or cache

3.6 Data We Do Not Collect

We do not collect:

• Payment or financial information (Helixra is free to play)
• Precise GPS or device location
• Biometric data
• Data from third-party social networks unless you share it with us directly

4. How We Use Your Data

We use the data we collect for the following purposes:

• Account management - to create and maintain your Helixra account and enable login
• Platform functionality - to save game progress, manage sessions, and provide platform features
• Analytics and improvement - to understand platform usage and improve content, performance, and user experience via Google Analytics
• Communications - to send dispatches, updates, or respond to your enquiries, where you have opted in
• Legal compliance - to comply with applicable laws including the Sri Lanka Personal Data Protection Act No. 9 of 2022 (PDPA) and, where applicable, the EU General Data Protection Regulation (GDPR)
• Cultural heritage documentation - anonymised aggregate usage data may inform our cultural preservation reporting and grant applications

We do not use your personal data for advertising, behavioural profiling, or sale to third parties.

5. Legal Basis for Processing

Under the Sri Lanka PDPA 2022 and, where applicable, GDPR Article 6, we process your personal data on the following legal bases:

• Contractual necessity - processing your account data to fulfil our service to you
• Legitimate interests - analytics to improve our platform, provided these interests do not override your rights
• Consent - for dispatch subscriptions and optional communications; you may withdraw consent at any time
• Legal obligation - where processing is required to comply with applicable law

6. Cookies and Tracking Technologies

6.1 Types of Cookies We Use

Helixra uses the following types of cookies:

• Essential cookies: Required for the platform to function. These include session cookies that keep you logged in. These cannot be disabled without affecting platform functionality.
• Analytics cookies: Set by Google Analytics to collect anonymous usage statistics as described in Section 3.4. You may opt out of these.

We do not use advertising cookies, retargeting cookies, or cookies from social media platforms.

6.2 Managing Cookies

You can manage or delete cookies through your browser settings. Please note that disabling essential cookies may prevent you from accessing account-based features of the platform. Disabling analytics cookies will not affect your gameplay experience.

7. Data Sharing and Third Parties

We do not sell your personal data. We share data only in the following limited circumstances:

• Google LLC - for analytics services as described in Section 3.4. Google processes data under its own privacy policy and Standard Contractual Clauses where applicable
• Hosting and infrastructure providers - our platform is hosted on Netlify (Netlify Inc., 44 Montgomery Street, Suite 300, San Francisco, CA 94104, USA). Netlify processes connection data as part of delivering the platform
• Legal requirements - where we are required to disclose data by applicable law, court order, or regulatory authority
• Institutional partners - aggregated, anonymised data only, never individual personal data, shared in the context of cultural heritage research or grant reporting

All third-party providers are selected for compliance with applicable data protection standards. Where data is transferred outside Sri Lanka, we apply appropriate safeguards in line with the PDPA 2022.

8. Data Retention

We retain your personal data only for as long as necessary for the purposes outlined in this policy:

• Account data - retained for the duration of your account. If you delete your account, your data is permanently deleted within 30 days
• Gameplay session data - retained for the duration of your account or until you request deletion
• Dispatch subscription data - retained until you unsubscribe, after which it is deleted within 30 days
• Analytics data - Google Analytics data is retained for 14 months by default, consistent with Google's standard retention settings
• Legal or compliance records - retained for the minimum period required under applicable law

9. Children and Minors

Helixra is a cultural heritage platform designed for general audiences, including younger players. We take the protection of minors' data seriously.

• The platform is accessible to users of all ages, including children under 13 (COPPA) and under 18 (general minors)
• We do not knowingly collect personal data from children under 13 without verified parental or guardian consent
• If you are a parent or guardian and believe your child has provided personal data without your consent, please contact us at info@thearchivistgame.art and we will delete that data promptly
• In the context of the Helixra All-Island Traditional Games Championship and any school or institutional programmes, parental consent forms will be required for participants under 18 prior to registration
• We do not serve behavioural advertising to any user, including minors

10. Your Rights

Under the Sri Lanka Personal Data Protection Act No. 9 of 2022 (PDPA) and, where applicable, the GDPR, you have the following rights:

• Right of access - to request a copy of the personal data we hold about you
• Right to rectification - to request correction of inaccurate or incomplete data
• Right to erasure - to request deletion of your personal data, subject to legal obligations
• Right to restriction - to request that we limit how we process your data in certain circumstances
• Right to data portability - to receive your data in a structured, commonly used format (where technically feasible)
• Right to object - to object to processing based on legitimate interests
• Right to withdraw consent - for any processing based on consent (e.g. dispatch subscriptions), you may withdraw at any time without affecting lawfulness of prior processing

To exercise any of these rights, contact us at info@thearchivistgame.art. We will respond within 30 days. We may request verification of your identity before processing your request.

11. Data Security

We implement reasonable technical and organisational measures to protect your personal data from unauthorised access, loss, or disclosure. These include:

• Passwords stored using cryptographic hashing
• HTTPS encryption for all data in transit
• Access controls limiting who within Yellow House Productions can access personal data
• Regular review of third-party service providers' security practices

No digital platform can guarantee absolute security. In the event of a data breach that poses a risk to your rights, we will notify affected users and relevant authorities in accordance with our obligations under the PDPA 2022.

12. International Data Transfers

Some of our third-party providers (including Google Analytics and Netlify) process data on servers outside Sri Lanka, including in the United States and European Union. We ensure that such transfers are subject to appropriate safeguards, including Standard Contractual Clauses where applicable under GDPR, and that providers meet data protection standards consistent with the PDPA 2022.

13. Heritage Data and Traditional Cultural Expressions

Helixra's mission involves the documentation, preservation, and digital archiving of Sri Lanka's traditional games and associated intangible cultural heritage. This section clarifies the relationship between personal data and heritage data on the platform.

13.1 What is Heritage Data

Heritage data refers to knowledge, game rules, historical records, regional variants, cultural practices, field documentation, and oral traditions related to traditional games archived on Helixra. This is distinct from personal data.

13.2 No Ownership Over Traditional Knowledge

Yellow House Productions Pvt Ltd makes no claim of ownership over the traditional games, gameplay knowledge, or cultural expressions archived on this platform. These belong to the communities of Sri Lanka and the broader South Asian region. Our copyright covers only our original written content, software implementations, visual designs, and documentation - not the underlying traditional knowledge or cultural heritage.

This position is consistent with:

• UNESCO 2003 Convention for the Safeguarding of Intangible Cultural Heritage
• WIPO Intergovernmental Committee (IGC) principles on Traditional Cultural Expressions (TCEs) and Traditional Knowledge (TK)
• The Nagoya Protocol on Access and Benefit-Sharing (CBD) as applicable

13.3 Contributor and Knowledge-Holder Data

Where individuals contribute traditional knowledge, oral accounts, performance recordings, or cultural expertise to the Helixra archive, their contributions are governed by a separate Contributor Knowledge Agreement. That agreement covers:

• The scope of knowledge being shared
• Attribution and credit preferences
• Any agreed compensation or non-monetary benefit
• Consent to use the contribution in the platform and related documentation

Personal data of contributors (such as name and contact details) is handled under this Privacy Policy. Contributor data is retained for the lifetime of the archive unless deletion is requested.

13.4 Field Documentation

Helixra conducts field documentation activities including video recording at heritage sites and community locations. Individuals who appear in field documentation are informed of the purpose of recording prior to filming. Field documentation is used for heritage preservation, academic research, and institutional reporting purposes. It is not used for commercial advertising.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or platform features. When we make material changes, we will update the 'Last Updated' date at the top of this document and, where appropriate, notify registered users by email. Continued use of helixra.art after a policy update constitutes acceptance of the revised policy.

15. Contact Us

For any questions, data requests, or complaints relating to this Privacy Policy, contact us at:

We aim to respond to all data-related enquiries within 30 days.