FuzzyCastle Privacy Policy

This policy explains how FuzzyCastle Games processes information when you use our websites, games, apps, authentication, leaderboards, multiplayer features, and related services (the “Services”).

Information we process

• Account and sign-in information: an internal account identifier, display name, account status and security metadata, and a protected mapping to the sign-in provider you choose. A FuzzyCastle password account also stores its username and a salted password hash, never the plaintext password.
• Provider information: Apple, Google, Discord, or another supported provider may send identifiers and profile information during authentication. We use the provider identifier to recognize the account. We may process an email address supplied by a provider and may retain an email when you provide it for account, support, or recovery services.
• Gameplay information: game identifiers, weekly personal-best scores, leaderboard display names and rankings, and information needed to operate multiplayer rooms and matches. Other players may see your display name, score, rank, and multiplayer activity.
• Technical and security information: IP address, user agent, device/browser and operating-system information, host and requested path, timestamps, response status, latency, request size, correlation identifiers, and bounded authentication, abuse-prevention, or error outcomes.
• Information you provide: support messages, privacy requests, and other information you choose to send us.

How we use information

We use information to authenticate users; provide accounts, games, leaderboards and multiplayer; secure the Services; prevent abuse and cheating; diagnose errors; operate and improve reliability; respond to support and privacy requests; and meet legal obligations. We use aggregate infrastructure analytics to understand traffic and capacity. We do not use this information for targeted advertising.

Cookies and sessions

We use essential cookies or similar local storage for sign-in, security, preferences, and core service operation. We do not use Google Analytics or an advertising analytics beacon on the reviewed FuzzyCastle web services.

Service providers and disclosure

We do not sell personal information. We disclose information when needed to operate the Services, including to Google Cloud for hosting, databases, queues, monitoring and logs; Cloudflare for DNS, security, content delivery, static hosting and aggregate traffic analytics; and the authentication provider you select for its sign-in or revocation transaction. Those providers process information under their own terms and applicable data-protection commitments. We may also disclose information when required by law, to protect users or the Services, or with your direction.

Retention

We retain account and gameplay information while an account remains active and may delete older information earlier as part of normal maintenance. When an account is deleted, information associated with the account is deleted or de-identified, except for limited backup, security, deletion-confirmation, fraud-prevention, dispute, or legally required records. Those records are access-restricted, excluded from normal product use, and retained only as long as reasonably necessary for their stated purpose. De-identified or aggregated information that can no longer identify an account may be retained indefinitely.

Current operating targets include deleting expired weekly leaderboard data after a 30-day maintenance grace period, retaining bounded account security events for up to 90 days, and retaining completed deletion/display-name workflow records for approximately 30–31 days. Cloud-provider backup and log retention varies by protected dataset and provider configuration. Data in an expiring backup is not returned to normal product use; a recovery must honor account-deletion cutoffs.

Account deletion and your choices

You can initiate account deletion from the account-deletion page presented by the app or at https://auth.fuzzycastle.com/Account/Delete. Access is revoked when a valid deletion request is accepted. Normal cleanup usually completes much sooner, but allow up to 30 days for dependency failures or manual remediation. Sign in with Apple authorization is revoked when the required Apple token is available. Limited residual records may remain only as described in the Retention section.

You may also ask to access, correct, or delete personal information, object to or restrict certain processing, or request portability where applicable. We may verify the identity and authority of a requester. Applicable law may provide a right to complain to a privacy regulator.

Security and international processing

We use reasonable technical and organizational safeguards, including encrypted transport, protected credentials, access controls, and separation of operational data. No system is completely secure. Information may be processed in the United States or other places where our providers operate, subject to applicable transfer safeguards.

Children

The Services are not directed to children under 13, or a higher minimum age where required. We do not knowingly collect personal information from a child without required authorization. Contact us if you believe this has occurred.

Changes and contact

We may update this policy as the Services change. The effective date above identifies the current version. For privacy questions or requests, email fuzzycastle@gmail.com.