Privacy Policy

1. Information We Collect

Information you provide

• Account information: name or display name, email address and password. Passwords are handled by our authentication provider, Supabase, and stored only in securely hashed form; we never see or store your password ourselves. The same account can be used to sign in inside our games, such as Popcorn Popper.
• Leaderboard information: if you sign in to a game with a leaderboard, your display name (username), score and level for that game are stored in our Supabase database. Leaderboards are publicly visible: anyone can see the high scores, display names (usernames) and, where a game offers them, avatar images shown on them. Display names are automatically filtered, and we may remove or rename names and remove scores that break our Terms of Service.
• On-device leaderboards: some games, such as Shake It Monkey, keep their leaderboard and the player name you type in only on your device, in your browser's local storage. These scores and names are not sent to us, are not stored in our database and are not shown publicly; they are visible only to people using that same device and browser. You can erase them at any time with the game's "Start over" button or by clearing your browser data.
• Sign-up and wishlist information: name, email, games you wishlist (stored in our Supabase database and linked to your account) and your notification preferences. If you opt in to launch news, your name, email and wishlisted game are also added to our mailing list via Netlify Forms (never your password).
• Support and contact messages: name, email, topic and the content of your message.
• In-game feedback: if you send feedback from inside a game, we receive your message, the feedback type you choose, the game and version and, only if you choose to provide them, your name and email. Feedback is handled by Netlify Forms and delivered to us by email. Our studio email address is not shown to players.
• Public community content: discussion topics, replies and reviews you post, together with your display name and the date posted. This content is publicly visible to anyone who visits our website. You can delete your own posts at any time, and we may remove content that breaks our Terms.

Information collected automatically

• Device and usage data: IP address, browser and device type, operating system, pages viewed, referring URLs, approximate location (city/country derived from IP), and timestamps.
• Game data: progress, settings (such as music, sound, tutorial hand and vibration), in-game coins and items, in-game activity and purchase records, where applicable. Our games save progress and settings on your device in local storage. If you are signed in, your game progress is also saved to your account (see Section 3).
• Cookies and similar technologies: see Section 5 and our Cookie Policy.

Information from third parties

• App stores and payment platforms (e.g., Google Play) may share limited transaction information, such as confirmation that a purchase was completed. We do not receive your full payment card details.

2. How We Use Information

• Provide, operate and maintain the Services, including your account and game progress.
• Send launch alerts, newsletters and updates you have requested (you can unsubscribe at any time).
• Respond to support requests and communicate with you.
• Understand usage and improve our websites and games (with your consent where required).
• Keep the Services safe, prevent fraud, cheating and abuse, and enforce our Terms of Service.
• Comply with legal obligations.

Legal bases (EEA/UK): we process personal data to perform our contract with you, based on our legitimate interests (such as security and improving the Services), with your consent (such as analytics cookies and marketing email), and to comply with legal obligations.

3. Accounts and Authentication (Supabase)

We use Supabase, a third-party backend and authentication provider, to create and manage accounts and store related data. When you register, your email address, display name, a securely hashed password, sign-in timestamps and your wishlist are processed and stored by Supabase on our behalf. Supabase also keeps you signed in using a session token stored in your browser's local storage. You can use the same account to sign in inside our games, such as Popcorn Popper, and you must confirm your email address before your first sign-in. When you are signed in to a game, Supabase also stores your cloud game save (such as your level, coins, score, items and game version) and your leaderboard entry (display name, score and level), so your progress stays with your account. Cloud game saves and leaderboard entries are deleted when your account is deleted. Account emails, such as email confirmation and password reset links, are delivered through our email provider, Resend. Supabase acts as our service provider/processor and may store data on servers located in the United States or other countries. Learn more in the Supabase Privacy Policy.

4. Google Analytics and Google Search Console

With your consent, we use Google Analytics 4 to understand how visitors use our website, such as which pages are viewed and how long visits last. We use Google Consent Mode, so analytics cookies are not set unless you accept analytics cookies, and IP addresses are not stored by Google Analytics 4. You can change your choice at any time using Cookie Settings, or install the Google Analytics opt-out browser add-on.

We use Google Search Console to monitor how our site appears in Google Search results. Search Console provides us with aggregated search performance data and does not set cookies on your device through our website.

For more information, see How Google uses information from sites that use its services.

5. Cookies and Local Storage

We use essential cookies and browser local storage to run the site, keep you signed in (Supabase session token), remember a game you chose to wishlist while signing up, save your game progress and settings (such as music, sound, tutorial hand and vibration) on your device, and save your cookie preferences. With your consent, we also use analytics cookies. We do not use advertising cookies. See our Cookie Policy for details.

6. How We Share Information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share information only:

• With service providers who help us operate the Services, such as hosting and form handling, including in-game feedback (Netlify), authentication, databases and cloud game saves (Supabase), analytics (Google) and email delivery (Resend), under contracts that limit their use of the data.
• Publicly, for content you choose to make public, such as community posts and leaderboard entries (display name, score and level).
• With app stores and platforms to process purchases you make.
• When required by law, or to protect the rights, safety and property of Xoana, our players or others.
• In connection with a merger, acquisition or sale of assets, subject to this Policy.
• With your consent or at your direction.

7. Children's Privacy (COPPA)

Our websites and games are intended for a general audience and are not directed primarily to children under 13. Because many of our games may appeal to children, we comply with the U.S. Children's Online Privacy Protection Act (COPPA) and similar laws.

We do not knowingly collect or solicit personal information from children under the age of 13. If we learn that we have collected personal information from a child under 13 without verifiable parental consent, we will promptly delete that information from our servers.

• Children under 13 should not create an account, sign in inside a game, submit their email, send in-game feedback with their name or email, or post in discussions or reviews without a parent or guardian's consent. Games that offer guest play can be played without an account.
• Because community posts and leaderboard display names are public, players should never use their real name as a display name or share personal information in them.
• Where we operate features for younger players, we limit data collection to what is reasonably necessary, do not show behavioral advertising, and do not allow children to publicly share personal information.
• Parents may review, request deletion of, or refuse further collection of their child's information, including their account, cloud game saves and leaderboard entries, by sending a Privacy / Parent Request through our Contact page.
• Age screen: before an account can be created on our website or in any of our games, we ask for a birth month and year. We do not store the date of birth. We keep only an age-range result (under 13, 13 to 17, or 18 and over) in your browser's local storage and an essential cookie, and, for accounts that are created, the age range (13 to 17 or 18 and over) is saved with the account. If the answer shows the person is under 13, the account is not created, no email address or password is collected, and we ask a parent or guardian to contact us through the Privacy / Parent Request form. The under-13 result is remembered on that device so the age screen cannot simply be retried.

Parent and guardian requests. To request the immediate removal of your child's display name or score from a leaderboard, or the deletion of your child's account data, choose Privacy / Parent Request on our Contact page. Please tell us the game and your child's display name or account email. We act on these requests promptly and may ask for information needed to verify them. If you believe we have collected information from a child without appropriate consent, please contact us the same way and we will delete it promptly.

8. Your Privacy Rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you and receive a copy.
• Correct inaccurate information.
• Delete your personal information.
• Object to or restrict certain processing, and withdraw consent at any time.
• Data portability.
• Opt out of marketing emails using the unsubscribe link.

California residents (CCPA/CPRA)

California residents have the right to know what personal information we collect, use and disclose; to request deletion and correction; to opt out of the sale or sharing of personal information; to limit use of sensitive personal information; and not to be discriminated against for exercising these rights. We do not sell or share personal information as defined by the CCPA. You may designate an authorized agent to make a request on your behalf.

EEA, UK and Switzerland (GDPR)

You have the rights listed above under the GDPR/UK GDPR, and you may lodge a complaint with your local data protection authority. Where we transfer personal data outside your region, we rely on appropriate safeguards such as Standard Contractual Clauses.

To exercise any right, contact us through our Support page. We will verify your request and respond within the time required by law.

9. Data Retention

We keep personal information only as long as necessary for the purposes described in this Policy: account data for as long as your account is active and for a reasonable period afterward; cloud game saves and leaderboard entries until your account is deleted, or earlier if removed under our Terms; support messages and in-game feedback for up to 24 months; newsletter data until you unsubscribe; and analytics data for up to 14 months. We may retain information longer when required by law or to resolve disputes and enforce our agreements.

10. Security

We use reasonable administrative, technical and physical safeguards to protect personal information, including encrypted connections (HTTPS), hashed passwords and access controls. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please use a strong, unique password.

11. International Users

Xoana is based in the United States. If you access the Services from outside the U.S., your information may be transferred to, stored and processed in the U.S. and other countries where our service providers operate.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version with a new effective date and, if changes are material, provide additional notice where appropriate.

13. Contact Us

For privacy questions or requests, contact us:

Xoana Studios
Contact form: xoanastudios.com/contact