PRIVACY POLICY

Effective date: 20 August 2026

Application: Onsen Overflow (Android package com.onsenoverflow.game)

Developer and data controller: Box of Frogs, Portugal

Contact: boxoffrogs.dev@gmail.com

SCOPE

This Policy describes the information used by Onsen Overflow’s optional account and online features. The game can also be played as a guest without an account.

DATA PROCESSED

ACCOUNT INFORMATION

When an account is created, the service processes the chosen username, an internal Supabase user identifier, an internal email-shaped login identifier derived from the username, authentication records, account and profile timestamps, and an optional two-letter country code selected by the player for a profile flag.

The internal email-shaped login identifier is not a real email address and is not used to send email. The country selection is provided by the player and is not obtained from GPS.

The password is handled by Supabase Auth. Box of Frogs does not receive or store the password in readable form. If Remember me is enabled, an authentication session token is stored on the player’s device.

SCORES AND ONLINE PLAY

For a signed-in player, the service processes the information needed to operate leaderboards and multiplayer, including submitted single-player scores and submission times, aggregate statistics such as best score, games played, total score, multiplayer wins and multiplayer losses, leaderboard entries, match participants, match status, winner, acceptance or decline state, disconnect state and match timestamps.

The service also processes invitations, matchmaking queue status, short-lived online presence timestamps used while a match is active, game and protocol version values used to match compatible clients, and an action name, minute window and attempt count used to limit repeated online requests.

These records exist only to provide the requested account, leaderboard, matchmaking and multiplayer features. They are not used for advertising, marketing, analytics or profiling.

SUPPORT AND DELETION EMAIL

If a player emails boxoffrogs.dev@gmail.com, Google receives and processes the sender’s email address and the contents of that message as part of Gmail. Box of Frogs uses the message only to answer the request.

GUEST AND LOCAL DATA

Guest mode is local-only, including while the device is online. Guest scores, progress, achievements, discovered animals, settings, language preference, local records and saved-run data remain on the device and are not sent to Supabase.

Guest data is not uploaded, synchronized, queued or submitted after a later sign-in. It can be removed by clearing Onsen Overflow’s Android storage or uninstalling the game.

INFORMATION THE CURRENT RELEASE DOES NOT REQUEST

The current release does NOT request a real email address, real name, telephone number, postal address, contacts, photos, camera access, microphone access, precise location, health information, financial information or payment-card information.

The current release contains no advertising SDK and no analytics SDK. It does not collect an advertising identifier or general app-usage telemetry.

WHY THE INFORMATION IS USED

Account and online-play information is used only to create and authenticate the account, show the player’s chosen username and optional country flag, save scores and calculate leaderboard statistics, send invitations, match compatible players, operate online matches, prevent duplicate or excessive online requests, and answer support or deletion requests initiated by the player.

The account and online records are processed because they are necessary to provide the account and online game features requested by the player. The optional country flag can be removed in Settings.

SERVICE PROVIDERS AND VISIBILITY TO OTHER PLAYERS

Supabase provides authentication, database hosting, realtime communications and server-side account deletion for Onsen Overflow. Supabase processes account and online-play information on behalf of Box of Frogs.

Supabase’s privacy information is available at:

https://supabase.com/privacy

A username, optional country flag, scores and multiplayer win/loss statistics may be visible to other signed-in players in leaderboards, invitations, matchmaking and match screens.

Box of Frogs does not sell account or gameplay information and does not share it for advertising or marketing.

RETENTION AND DELETION

Account-linked information is retained while the account exists so that the account, leaderboard and multiplayer features continue to work.

A signed-in player can permanently delete the account by opening Settings, selecting Delete account and cloud data, and confirming both prompts. The deletion removes the Supabase Auth account and the account-linked application records, including the profile, username, optional country flag, scores, statistics, score submissions, leaderboard data, matches, invitations, matchmaking rows, match-presence records, match events, request counters and multiplayer outcome records.

Box of Frogs does not intentionally retain a separate copy of those account-linked application records after account deletion.

Cloud account deletion does not remove local device data. Clear the app’s Android storage or uninstall the game to remove local scores, settings, achievements and saved-run data.

If the app cannot be accessed, email boxoffrogs.dev@gmail.com with the subject “Onsen Overflow Account Deletion Request” and the account username. Do not send a password.

SECURITY

Account and online requests are sent over encrypted HTTPS or secure WebSocket connections. Authentication is provided by Supabase Auth, and database access is restricted by authenticated server functions and row-level access controls. Box of Frogs cannot read a player’s plaintext password.

Because the game does not request a real email address, automatic password recovery by email is not available.

PLAYER RIGHTS

Where data-protection law applies, a player may ask Box of Frogs to provide access to, correct, delete, restrict or object to the processing of account information, or provide a portable copy where the relevant legal conditions are met.

These statutory rights depend on the circumstances and do not create broader rights than applicable law provides.

Requests may be sent to boxoffrogs.dev@gmail.com. Players may also complain to Portugal’s Comissão Nacional de Proteção de Dados at:

https://www.cnpd.pt/

CHANGES

This Policy will be updated if Onsen Overflow’s actual data practices change. The effective date above identifies the current version.