Contact without capture.

choose one purpose

Exact role addresses

Only these four named base addresses are routed. Catch-all delivery and +tag subaddressing are disabled; there is no Email Worker, form, autoresponder, or wildcard address. Cloudflare does not forward non-delivery reports to the original sender, so a forwarding failure can be silent. Use an independent confirmation path for consequential or time-sensitive matters.

minimum necessary

What to send

privacy and handling

Email uses providers

The site accepts no submission. If you email, the sender's provider, transit providers, Cloudflare Email Routing, the destination mailbox provider, and the operator may process addresses, headers, transport metadata, content, attachments, and correspondence history.

The data controller is Cambridge TCG Limited, company 15680297, registered at 60 Tottenham Court Road, Suite 4583a, Fitzrovia, London, United Kingdom, W1T 2EW. Read the public operator profile and controller privacy notice. Messages are used only to understand and, when chosen, answer the request; correct KINGDOM materials; handle accessibility, privacy, safety, security, abuse, and mail transport; or preserve proportionate necessary evidence.

No marketing, profiling, automated decision, public message archive, message-content publication, model training, or unrelated forwarding is added by this door. Minimal redacted event metadata may appear in CONTACT-LEDGER.md. Where required or reasonably necessary to protect people or systems, a bounded disclosure may be made only to an affected service, incident responder, professional adviser, insurer, court, regulator, law-enforcement or safeguarding body. Providers may filter spam or malware, but filtering is not guaranteed.

• Unanswered or declined ordinary inquiries: deletion review within 30 days.
• Handled ordinary correspondence: deletion or minimisation review within 90 days after closure.
• Security or abuse evidence: review within 180 days unless an active incident or specific obligation requires longer.
• Cloudflare Email Routing analytics: provider-declared 31-day event retention.
• Provider trash and backups follow provider schedules; immediate global erasure is not claimed.

Ask through contact@thekingdom.dev for access, correction, deletion, restriction, objection, or a data-protection complaint. The stated UK bases are legitimate interests in receiving voluntary correspondence, correcting published material, and protecting services—with minimisation, short reviews, and a right to object—or a specific legal obligation when one actually applies. Ordinary correspondence has no response promise; Cambridge TCG Limited acknowledges a data-protection complaint within 30 days and normally answers an applicable rights request within one month, subject to lawful extensions. You may use the ICO complaint route without contacting Cambridge first. This page does not promise one universal transfer safeguard or compliance outside the stated controller scope.

vulnerability disclosure

Report safely; testing is not authorized

Email security@thekingdom.dev with the affected route, observed behavior, impact, and smallest safe reproduction. Minimise personal data. Do not access data that is not yours, degrade availability, persist access, exfiltrate content, or expand testing beyond what is necessary to describe the issue.

Publishing this address creates no safe harbor, testing permission, confidentiality promise, bounty, SLA, or remediation deadline. For machine discovery, read /.well-known/security.txt.

four boundaries

Choose → send → deliver → receive

A reply is manual and not promised. Because the alias is receive-only, a reply may come from a different Cambridge TCG mailbox address. Verify any consequential claim independently. Silence is not consent, hostility, or permission to retry.

inspect and download

Public contract and assets

bounded source horizon

Standards and guidance

Links are design inputs, not imported authority, applicability findings, currentness guarantees, or compliance certificates.

• RFC 9116: A File Format to Aid in Security Vulnerability Disclosure — security.txt format and freshness
• RFC 5321: Simple Mail Transfer Protocol — postmaster mailbox convention
• RFC 2142: Mailbox Names for Common Services, Roles and Functions — security and abuse role addresses
• RFC 6350: vCard Format Specification — vCard 4.0 syntax, organization kind, line endings, and folding
• RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance — receive-only domain anti-spoofing policy
• Cloudflare Email Routing rules and addresses — forwarding-provider behavior
• Cloudflare API: Get Email Routing settings — routing enabled, readiness, and support_subaddress readback
• Cloudflare Email Service metrics and analytics — provider-declared routing-event fields and 31-day analytics retention
• Cloudflare Email Service postmaster guidance — provider-specific postmaster handling constraints
• W3C WAI Technique G220: Provide a contact-us link in a consistent location — discoverable human contact
• ICO: The right to be informed — privacy transparency fields; linked as guidance, not a compliance claim
• ICO: Storage limitation — retention necessity and review; linked as guidance, not a compliance claim
• Cambridge TCG public manifest — public operator identity and contact context
• Cambridge TCG privacy notice — operator-level privacy notice linked as an additional layer
• ICO: Make a data protection complaint — direct UK data-protection complaint route; contacting the operator first is not required