Privacy Policy

1. Information we collect and process

Accounts and authentication

When you sign in with Google or Apple, we process the provider's account identifier and identity tokens to verify you and associate your FuzzFizz account. Google may also provide a display name and profile claims, including a photo URL. We may use the supplied name as your initial display name. Provider photo claims can be present temporarily during sign-in, but we do not import them as game portraits. Our current account system does not store your Google or Apple password or maintain a provider email-address field as your game profile.

We store an internal account ID, linked provider IDs, your display name, username, chosen game portrait, account/session timestamps, and authentication/session records. You can edit your game name, username and portrait. Please avoid using a child's real name or other sensitive information in public profile fields.

Game activity and social features

Our servers store match participants, game mode, moves and replays, scores, clocks, wins/losses, matchmaking information, Ranked XP and placement, achievement progress, weekly-drop progress, virtual-currency balances, and owned/equipped portraits, outfits and animations. We also store friend relationships, friend requests, match invitations, presence and related notification/delivery records. These are linked to your game account.

Device and notification information

The app and Firebase Messaging process app-installation identifiers and push tokens. When notifications are enabled for your account, our backend associates a randomly generated installation ID, push token, platform and notification preference with your account so it can route invitations, friend requests and messages sent by our administrators. Notification content may contain the sender's name/username and may appear on your device's lock screen according to your device settings. Firebase services can process installation or technical information even when notification presentation is disabled.

Optional performance diagnostics

Enable Debugging is off by default. If you enable it while signed in, the app sends gameplay performance batches to our own backend. These contain your account ID, a random diagnostic-session/batch ID, match ID and mode where applicable, device model, operating-system version, CPU/GPU specifications, memory and screen information, renderer/engine/app version, FPS, frame timings, draw calls, object counts and connection latency. Reports are account-linked, not anonymous. We do not collect hardware serial numbers, IMEI, advertising IDs, keyboard input, screenshots, microphone recordings or the contents of other apps for this feature. Turning the setting off stops future uploads and clears queued reports on the device.

Nearby players and network data

While signed in and the app is active, Nearby discovery broadcasts your game account ID, display name, username and online availability to the local Wi-Fi/LAN. Other devices on that network can receive these unencrypted discovery packets and observe the originating local IP address. We use this to find nearby players for Friendly matches; invitations and matches are processed by our server. We do not use GPS, precise location, address-book contacts or Bluetooth discovery for this feature. Network proximity does not establish a player's physical identity or exact location.

Purchases and virtual items

If in-app purchasing is enabled, Google Play or Apple's App Store processes payment. We process product IDs, purchase tokens/receipts or signed transaction information, transaction status, platform and account associations to validate purchases, grant virtual items and prevent duplicate grants or fraud. Our game does not receive your full payment-card number. Store purchase records, wallet transactions and virtual-item ownership can remain associated with your account.

Connections, local storage and support

Connecting to our backend or hosting provider necessarily exposes a source IP address and request metadata. Authentication/security records can include IP addresses, timestamps and session status. Service logs record request IDs, route, method, status and timings. The app stores session credentials, notification preferences, tutorial completion, audio/display settings and cached game/profile/catalog data locally. Browser sign-in uses temporary security cookies and state to complete authentication; these policy pages do not set analytics cookies or use third-party trackers.

If you email us, we receive your email address and the information you include. Send only what is necessary to resolve your request, and never send passwords or authentication tokens.

Website visits

The FuzzFizz landing page and these information pages serve locally hosted images, fonts and page files. We do not include advertising, third-party analytics, tracking cookies or contact forms on the website. The landing page requests a public configuration file containing store and support links; it does not require a game login.

Our web server, hosting infrastructure and reverse proxy can process network/request information such as IP addresses, requested URLs, timestamps, response status, browser information and referring pages in access logs. We use this information to deliver and maintain the website and investigate errors or abuse. When you follow an App Store, Google Play or Steam link, that service processes your visit under its own terms and privacy policy. Emailing support shares your email address and the message you send.

2. How we use information

• Authenticate accounts, keep progress and synchronize the game across sessions/devices.
• Run matches, matchmaking, leaderboards, profiles, replays, friend requests and invitations.
• Deliver requested notifications and service/game messages, subject to device and app settings.
• Validate purchases, award currencies/items/achievements, and keep an auditable transaction history.
• Diagnose performance when you opt in, maintain reliability and protect against cheating, abuse and unauthorized access.
• Respond to support/privacy requests and meet applicable legal obligations.

We use information to provide the services you request and for necessary security/operational purposes, and seek consent where applicable law requires it. Access to online services is not permission to use data for unrelated advertising. No privacy-policy statement replaces any legally required parental-consent process.

3. Who can receive information

We disclose information to providers for the functions described above, authorized support/operations, and when necessary to comply with law, protect users or investigate abuse. Providers operate under their own privacy terms and applicable contractual/legal requirements. A service transfer or reorganization could involve relevant data; we would apply applicable notice and protection requirements. We do not sell or rent personal information, share it for cross-context behavioral advertising, or include third-party advertising/behavioral-analytics SDKs in the current game. Platform/service SDKs may still process technical data under their own policies.

4. Children and families

FuzzFizz is intended for a mixed audience, including children under 13 and their families. Parents and guardians can contact info@sandboxlabs.dev to ask about information associated with their child, request access/correction/deletion, or ask us to stop further collection where applicable.

The current version does not collect a date of birth or implement verified parental consent. Its online accounts, social features, notifications, purchases and optional diagnostics process information as described in this policy. Where consent or other child-specific safeguards are legally required, those requirements must be satisfied before a child uses the affected features; merely using the app or accepting this policy does not provide verified parental consent. We will review reports of children's information collected without required authorization and take appropriate restriction/deletion action.

Do not place personal contact details, school names or a child's full name in public names/usernames. A platform purchase approval or ordinary device permission is not automatically parental consent for all data processing. Additional age-appropriate and parental controls are required before releasing affected features to children where law or store policy requires them.

5. Retention and deletion

We retain account, gameplay, social, notification and transaction records while needed to operate and support the account, maintain fair-play records and resolve disputes. Sign-in challenges and invitation validity are time-limited; expiration of a login or invitation does not necessarily delete every associated record. Diagnostic reports currently have no fixed automatic deletion period; they remain until removed through maintenance or a verified deletion request. Disabling Debugging or notifications does not retroactively erase previously stored records.

On a verified deletion request, we review the associated account/data for removal or anonymization. We may retain limited records where necessary for legal, financial, fraud-prevention or dispute-resolution obligations, and explain relevant exceptions in our response. Backup copies, where maintained, may remain until their normal replacement/deletion cycle and must not be used to reactivate a deleted account. We do not promise that signing out or uninstalling the app deletes your server account.

How to request account or data deletion

6. Your choices and privacy requests

• Change your name, username and game portrait in Profile. Portrait selection does not require access to personal photos.
• Turn off Notifications in Settings and/or your operating-system settings. Existing lock-screen messages may need to be dismissed separately.
• Keep Enable Debugging off to avoid uploading optional account-linked gameplay diagnostics.
• Signing out or leaving the app stops its active local Nearby discovery. Discovery occurs while the signed-in app is active, not only while the Nearby screen is visible.
• Contact us to request access, correction, deletion, restriction, objection or a copy of applicable personal data, according to your local rights. Parents/guardians can make requests concerning their child.
• Manage third-party sign-in access and platform purchases through Google, Apple or Steam. Revoking a provider connection or requesting a store refund is separate from deleting a FuzzFizz account.

We may need proportionate information to verify ownership or parental authority before acting. We do not need your password, one-time sign-in codes or payment-card details. Where applicable, you can also raise concerns with your local privacy/data-protection authority.

7. Permissions and device access

The current mobile game does not request camera, photo-library, broad storage, microphone, contacts or GPS permissions for profile portraits. Internet/network access supports online services and local Nearby discovery. Notification permission supports alerts. Apple devices may request local-network access for Nearby; refusing it can prevent local discovery. Necessary platform SDKs can declare normal network, push-delivery, wake-lock and store-billing permissions. These are distinct from permission to browse personal files or read other apps' notifications.

8. Security, international processing and changes

Online API connections use HTTPS, authenticated access and server-side validation. Authorized staff and service providers receive access appropriate to their role. Local Nearby discovery packets are broadcast on the LAN without encryption, as explained above. No system or transmission method can guarantee absolute security.

Our infrastructure and third-party providers can process information in countries other than your own. Applicable transfer safeguards and provider terms depend on the services and legal requirements involved. Contact us with questions about your data or service providers.

We may update this policy when features, providers or requirements change. The date above identifies this version; material changes requiring notice or consent will need the appropriate notice/consent before the affected processing.

9. Contact

Sandbox Labs Entertainment · FuzzFizz
Privacy, support and account/data deletion: info@sandboxlabs.dev.