Privacy policy

Information we receive

• Account information: your email address, verification status, display name, avatar, connected sign-in methods, provider account identifiers, and game-access status.
• Third-party sign-in information: profile information supplied by the provider, such as a name, avatar, and email address when available. We use authentication proofs to validate sign-in; we do not receive your provider password.
• Pending registrations: information needed to finish Steam or Xbox registration, including the provider profile, your proposed email address, verification state, and temporary security tokens.
• Game information: your creatures, care actions, collection, inventory, virtual currency, progress, activity times, and preferences such as audio, graphics, and time zone.
• Technical information: hosting and service logs may include IP addresses, request times, browser or device information, and errors. Error reporting, when enabled, can include diagnostic information about a failure.
• Messages you send us: the contents of support, privacy, or security requests and the information needed to respond.

Google and other sign-in providers

Google sign-in supplies your account identifier, basic profile, email address, and email verification status. We use that information to authenticate you, create or identify your Flipbits account, and display your profile. We do not request access to your Gmail messages, Google Drive files, or contacts.

Discord can supply a profile and verified email. Steam supplies a Steam account identifier and may supply a display name and avatar; it does not supply an email address. Microsoft/Xbox can supply a profile, suggested email address, and profile photo. Steam and Xbox users verify an email with Flipbits to complete registration.

Verified email addresses are used to identify an account across supported sign-in methods. Signing in with another method using the same verified email may link it to your existing account. Provider information is stored with that account so you can sign in and see connected methods.

How we use information

• Create, authenticate, secure, and manage accounts; finish email verification and prevent misuse of sign-in flows.
• Manage the waitlist and grant or revoke pilot access.
• Save and operate the game, keep preferences, and provide care-related features.
• Send sign-in and verification emails, service communications, and care or reminder emails when enabled by your preferences.
• Respond to support and privacy requests, investigate errors and abuse, and meet applicable legal obligations.

Reasons for processing

Where data protection law requires a legal basis, we process account and game information to provide the service you request, security and diagnostic information for our legitimate interests in operating and protecting the service, and records needed to meet legal obligations. Where consent is required, we rely on that consent and you can withdraw it. Withdrawing consent does not affect processing already carried out lawfully.

Services that help run Flipbits

We use service providers to host and operate Flipbits: Vercel for the website, Convex for backend data, file storage, and authentication, and Resend for sending email. Sentry may process error diagnostics when error reporting is enabled. These services receive information needed for their functions.

Our browser error reporting is configured without default personal-information collection and strips user, request, and breadcrumb fields before sending reports. Error messages may still contain contextual information; this is not a guarantee that diagnostics contain no personal information.

Sign-in providers process authentication according to their own privacy policies. We may disclose information when required by law, to protect users or the service, or as part of a transfer of the service with appropriate safeguards and notice where required.

We do not sell personal information or use account information for targeted advertising. We do not use Google user data for advertising.

Storage, retention, and security

We keep account and game information while it is needed to provide your account and operate the service. Temporary sign-in and registration proofs expire. Some records may need to be retained for security, legal obligations, or resolving disputes, and deleted information may remain in backups until those backups are rotated.

We use authentication, access controls, and encrypted connections to protect information. No online service can promise complete security. Do not send us passwords or reusable sign-in links.

Our providers may process information in countries other than your own. Applicable protections and rights depend on your location and the processing involved.

Your choices and requests

You can update available account preferences in the game and opt out of optional care or reminder emails. Necessary sign-in and verification messages are separate. To request access, correction, export, or deletion of your personal information, email hello@flipbits.gg from the email associated with your account. We may ask you to verify account ownership.

Depending on your location, you may also have rights to object to or restrict processing, withdraw consent where processing relies on it, and complain to your local data protection authority. We respond in accordance with applicable law.

Children

Flipbits accounts and the game are for people aged 13 and older, subject to any higher minimum age or permission requirements that apply to them. We do not currently support registration for children under 13 or a parental-consent flow. If you believe a child under 13 has provided personal information to Flipbits, contact hello@flipbits.gg so we can investigate and take appropriate action. Older minors must have the permission required by applicable law and our Terms of use.

Changes

We may update this policy as the game develops. The date on this page identifies the current version. We will provide notice of material changes through the service or account email where required.