Privacy Policy

Foxling is provided by Oxyloop. For anything in this policy, write to [email protected].

We are the data controller for the information described below.

This list is short on purpose, and it is the most useful part of this policy:

• No third-party analytics, advertising or attribution SDK. We do keep our own first-party usage statistics — see “What we collect” — but nobody outside Oxyloop ever receives them, and you can turn them off.
• No advertising. No ad network, no advertising identifier (IDFA / Android Advertising ID), no ad profile.
• No cross-app or cross-site tracking, by us or by anyone we use. We never ask for permission to track you, because we do not.
• No third-party session-replay service, and no recording of any kind on the web. On the iOS and Android apps we do capture our own in-house session recordings to find and fix bugs — stored on our own server only, never sent to anyone else — and you can turn that off in one tap; see “What we collect”. We also use a crash-reporting service, Sentry, to see what broke when something goes wrong.
• No persistent device identifier, device fingerprint or advertising ID used to recognise you across sessions or other apps. We do record a few technical details with each request — your app’s platform, version and time zone, for instance — described below.
• No location, contacts, calendar, photos, camera, microphone or health data. The coarse, country-level location described below never comes from GPS and is never precise.
• No push notification tokens. The reminders on your phone — the daily one, and the one before a free trial ends — are scheduled by your own device, and nothing about them leaves it.
• No marketing email. We send two kinds of email and no others: a sign-in code when you ask for one, and a single reminder before a free trial ends.
• No password. Signing in does not use one.
• We never sell personal data, and we never share it for advertising.

Account. If you create an account, we store the email address you give us, or — if you sign in with Apple or Google — the anonymous subject identifier that provider returns, and the address they share with us if you let them. We never receive your Apple or Google password. If you use Apple’s Hide My Email, we only ever see the forwarding address it gives us, and anything we email you goes through Apple’s relay.

Signing in by email. There is no password. We email you a six-digit code, store it only as an irreversible hash, and delete nothing else about the request; the code stops working ten minutes after we send it, or the moment it is used.

Before you create an account. You can play immediately, with no account. When the app first reaches the internet it creates an anonymous account so your progress can be backed up. That account is a randomly generated identifier and nothing else — no part of it is derived from your device.

Training history. The rounds you play: the game, the level, your score, hits and misses, how long a round took, and your reaction times. This is what the progress and brain-profile screens are drawn from.

Preferences. The skills you chose to train, your daily commitment, your reminder time, which games you muted or skipped, and your sound and music switches — including whether you have turned usage statistics off.

Crash and error reports. When the app or the website hits an unexpected error, a report is sent to our crash-reporting service, Sentry: the error itself and a stack trace, the app version, coarse platform information, and a request id. It does not include your name, email address or account id directly, and no screen is ever recorded or replayed — Sentry never sees what a screen looked like, only what broke. That request id also appears in our own 30-day operational log described below, so if we need to investigate a crash we can match it back to the account it happened on, in our own records — Sentry itself never makes that link.

Device and request information. Every request your app or browser makes to us carries a few technical details along with it: the platform (iOS, Android or web), the app version, the OS version, your device’s time zone and language, and a coarse, country-level location worked out from your network connection, not from GPS — we never store the IP address itself. We keep the most recent of these on your account.

Session recordings, to find and fix bugs. On the iOS and Android apps only — never on the web — we capture a screenshot of the app’s own screens about once a second, plus a few extra ones right after each tap (never more than four a second), skipped whenever nothing has changed since the last one, together with your taps and which screen you are on, tied to your account. Screenshots are small — 360 pixels wide — but legible, so they can show anything visible on screen at the time, including a game’s own score and level. A short list of screens is never captured at all — email sign-in, the suggest-a-game screen, and any screen that shows your email address — because those show something you typed or your address rather than gameplay; on those, a placeholder stands in for the frame and your taps there are not recorded either. Recording is on by default. “Record my sessions to fix bugs” on the Account screen turns it off at once and deletes whatever has not yet reached our server. Recordings are stored on our own server only and never sent to a third party. They are watched only by the account owner inside Oxyloop, through the same internal tool described under “Support access inside Oxyloop” below — every time one is opened, that is logged too.

Usage statistics. By default we record a fixed, short list of things you do in the app — opening it, reaching a step of onboarding, finishing or leaving a how-to, quitting a round, seeing a new rule, hitting a level cap, seeing or tapping the paywall, answering the notification prompt, tapping the suggestion card — tied to your account id. There is no free text and nothing about what a round scored. It goes to our own server only, never to a third party, is never used for advertising and is kept for 13 months. “Share usage stats” on the Account screen is on by default; turning it off stops any further sending and clears anything still waiting to be sent from your device.

Subscription. If you subscribe, the app store sends a transaction identifier, the product you bought, whether it is in a free trial, whether it will renew and when the current period ends, which we and our subscription processor use to check that the subscription is valid and current. We keep the history of these events for as long as your account exists, as our billing record. We never see or receive your card number, billing address or any payment detail — those stay with Apple or Google.

Trial reminder. If you start a free trial that is set to renew, we record that a reminder is owed for it: which trial it is, when the reminder is due, and whether it was sent.

Game suggestions. If you suggest a game from the Games screen, we keep what you wrote and the skill you picked for it, linked to your account.

Technical. Our server records the time it received each round, so your devices can sync without losing anything. It also keeps a short operational log of failed or slow requests and subscription webhook deliveries, tied to your account, so we can find and fix problems; this is kept for 30 days and is deleted at once if you delete your account. Separately, it keeps a record that an email was sent — the sign-in code, the trial reminder — identified only by a scrambled version of the address rather than by your account. That scrambling is one-way, so on its own it cannot be reversed back into an address; deleting your account still finds and deletes this record too, by scrambling your address the same way and matching it, even though the record was never linked to your account id directly. Kept for 30 days otherwise.

Foxling is offline-first. Every round you play is written to a database on your own device first, and every screen is drawn from that. Your training history, your preferences and your sign-in tokens are all stored locally.

If you never sign in and never connect, nothing ever leaves your device.

Signing out erases the local copy.

To provide the app — to deal your daily session, score your rounds, draw your progress and keep your devices in sync. Legal basis: performance of our contract with you.

To compare scores against the population. We publish per-game score cut points calculated from all players together, so the app can tell you where a round sits. This is computed in aggregate and never identifies anyone. Legal basis: legitimate interest.

To run subscriptions — to check with Apple or Google that a subscription is genuine and current, and to decide what your account can open. Legal basis: performance of our contract with you.

To remind you before a free trial ends. The paywall promises a reminder two days before a trial becomes a paid subscription, so we keep that promise twice: a notification your own device schedules, and one email to the address on your account, if it has one — including an address Apple or Google shared with us when you signed in. The email says when the trial ends, that the store will charge the price shown when you subscribed, and how to cancel. It is sent once, advertises nothing, and is not sent if you have already turned renewal off. Legal basis: performance of our contract with you — the reminder is part of the trial as it is offered.

To decide which games to build next, from the suggestions players send. Legal basis: legitimate interest.

To find and fix what breaks — crash and error reports, the operational log of failed or slow requests, and the session recordings described above. Legal basis: legitimate interest. You can object at any time by turning “Record my sessions to fix bugs” off on the Account screen.

To understand how the app is used and improve it, from the usage statistics described above. Legal basis: legitimate interest. You can object at any time by turning “Share usage stats” off on the Account screen — that stops it outright, which is a stronger guarantee than an opt-out notice alone.

To keep the service secure and working. Legal basis: legitimate interest.

Nobody, with these unavoidable exceptions:

• Apple and Google, for billing. They are the merchant of record, not us.
• RevenueCat, which checks with Apple or Google that a subscription is genuine and tells us whether yours is active. It receives your purchase history and the account identifier we use for you, and nothing else — no advertising identifier, no device identifier, and nothing about how you play. It processes this only to run subscriptions for us.
• Resend, which delivers our two emails: the sign-in code when you sign in by email, and the reminder before a free trial ends. It receives your email address and the message itself, and nothing else. It hears of you only if you sign in by email, or start a free trial on an account that has an email address — whichever way that address reached us.
• Sentry, our crash-reporting service, which receives a report — the error, a stack trace, the app version, coarse platform information and a request id — only when the app or website hits an unexpected error. It does not receive your name, email address or account id, and never records or replays a screen; we are the ones who can match a request id back to an account, in our own logs.
• Our hosting provider, which runs the server our database sits on. It processes data only on our instructions and cannot use it for anything else.

Signing in with Apple or Google means talking to them, of course: their code in our app asks them who you are and hands us a signed answer we check with them. Neither is told anything about how you play, and Google’s sign-in library collects nothing beyond what that exchange needs.

We use no advertising, attribution or data-broker service, and nothing that profiles you. Those are the only companies involved, and each is here because signing in, subscribing, the trial reminder or keeping the service working cannot happen without it.

We will disclose data if the law requires it, and will tell you unless we are forbidden from doing so.

A small internal tool, used only by Oxyloop, lets us look up an account to help with a support request, see aggregate usage so we know what to build next, and — for an account that has not turned it off — watch its session recordings to find and fix a bug. It cannot see your Apple or Google password (we never receive it) and cannot grant itself a subscription — the only thing that ever changes what your account can open is the RevenueCat webhook described above.

Every time someone opens an account in that tool, and every action taken in it, is itself recorded — who, when, which account, and what was done. If you delete your account, those entries are not erased — we keep the fact that access happened — but the account in them is re-keyed to the same one-way hash described below, so they no longer identify who it was.

Your data is held on servers we control in France. It is encrypted in transit (TLS) and the server is not reachable from the internet except through our application.

Sign-in tokens are stored as irreversible hashes, never in a form that could be replayed. Access tokens expire after fifteen minutes.

Your training history is kept for as long as your account exists — it is the point of the app.

A trial reminder’s record, your subscription event history and your game suggestions are kept for as long as your account exists.

Usage statistics are kept for 13 months from when they happened, then deleted, whether or not the account still exists.

Session recordings are kept for 30 days, then deleted automatically. Turning “Record my sessions to fix bugs” off deletes anything not yet sent from your device at once, and deleting your account deletes every recording of it immediately.

The operational log of failed or slow requests and webhook deliveries is kept for 30 days. Our record that an email was sent is also kept for 30 days, identified only by a scrambled version of the address rather than by your account.

If you delete your account, everything personal is erased from our database at once, in the same step as the deletion itself — your training history, any subscription and trial reminder record, any game you suggested, any usage statistics or operational log entries tied to your account id, any session recordings, and our record that we emailed that address. Deleting the account also wipes the copy on your device immediately.

Two things sit outside our database and are not reached by that step. Our own servers keep a short, routine line-per-request log for running the service day to day; it is capped in size rather than kept for a fixed number of days, and is overwritten as it fills, on its own schedule, separately from anyone’s deletion. And our processors — RevenueCat, Resend and Sentry — each keep whatever record their own service needs, on their own retention schedule, described under “Who we share it with” above; deleting your account does not reach into theirs.

What we keep after that is one non-identifying record that an account existed and was deleted: a one-way hash of the account id, the date, how long the account had existed and whether it had Plus. It cannot be traced back to you, and it exists only so we can count how many accounts are deleted.

Population statistics already computed from past rounds are aggregate numbers that identify nobody, and are not reversed by a deletion.

You can do the two things that matter without asking us, from Account in the app:

• Export everything we hold about you, as a file.
• Delete your account and all of its data.

You can also start a deletion from https://foxling.oxyloop.com/delete-account without opening the app.

If you are in the UK, EU or EEA you also have the right to correct your data, to object to or restrict our use of it, to withdraw consent, and to complain to a data protection authority — ours is the CNIL in France, and you may also complain to the one where you live. Write to [email protected] and we will answer within one month.

Foxling is not intended for children under 13, and we do not knowingly collect anything from them. If you believe a child under 13 has given us data, write to [email protected] and we will delete it.

If we change this policy we will change the date at the top, and we will tell you in the app before any change that affects what we collect or why.

Questions, requests or complaints: [email protected].