Privacy Policy

Last updated: 2026-09-30

Your privacy is important to us. This Privacy Policy explains what data is collected while using the foxtales.cc website and the Foxtales application, how it is used, who it may be shared with, and what rights you have in connection with the processing of your personal data.


1. Data Controller

The personal data controller is:
Hubert Górski
Contact: office@foxtales.cc
Mailing address: Radom, ul. Kościelna 37A/1, Poland.

The e-mail address is the contact point for Users and the designated contact point for direct communication with Member State authorities, the Commission, and the Digital Services Board. The Controller processes data in accordance with applicable regulations, including the GDPR.


2. What data is collected

The application may collect the following data:

  • email address provided during registration,
  • username,
  • User content entered voluntarily while using the application,
  • an image (photo) uploaded voluntarily as a custom avatar in a catalog where the Controller has enabled this feature,
  • data on activity and interactions in the Application (log of actions and system events, e.g., created rooms, joining games, clicks performed, and gameplay progress for analytical, moderation, and technical support purposes),
  • technical data sent automatically by the browser or device, such as:
    • IP address,
    • browser type and version,
    • device and operating system information,
    • server logs and traffic statistics (Cloudflare).

The foxtales.cc website may additionally collect data provided voluntarily by unregistered individuals in the contact form (e.g., for B2B collaboration inquiries):

  • name,
  • email address,
  • company name (optional),
  • message content.

The foxtales.cc website also operates a waitlist for the boxed (physical) edition of the game. Joining it is voluntary and requires separate consent. The sign-up form collects:

  • name,
  • email address,
  • the themed sets you are interested in (optional),
  • your own set suggestion entered in a text field (optional),
  • the content of a remark or suggestion (optional),
  • the fact that consent to receive messages about this edition of the game was given.

Information about the origin of the submission is attached automatically: the address of the subpage it was sent from, campaign parameters (UTM), the referring page address, the country determined from the IP address, and the IP address itself. We use the IP address for two purposes: to limit the number of submissions from a single source and prevent abuse, and — for waitlist signups — to retain, together with the date and time, a record that marketing consent was given.

The application does not collect sensitive data (e.g., health, political).


Technical data comes from the communication of your browser or device with the application and from security and infrastructure services provided by Cloudflare.


All personal data is obtained directly from the user or automatically by the device while using the application. The application does not obtain data from third parties.


3. Purposes of data processing

Data is processed for the purpose of:

  • ensuring the correct operation of the application and handling user accounts,
  • maintaining and administering accounts,
  • ensuring security, detecting and preventing abuse,
  • analyzing traffic and technical statistics to improve the application's performance,
  • handling user reports and contact inquiries,
  • informing people who joined the waitlist about the progress of work on the boxed edition of the game and about its release — solely on the basis of the consent given,
  • enabling social interactions, including generating and sharing gameplay Memories and created Question Catalogs,
  • handling the reporting system for violations, content moderation (including automatic hiding mechanisms based on reports), and processing User appeals,
  • monitoring the proper operation of the Service, diagnosing technical errors, detecting bots/abuse, and providing technical support and moderation in the admin panel.

4. Legal basis for processing

Data processing takes place on the basis of:

  • Art. 6(1)(b) GDPR — processing necessary for the performance of a contract or actions prior to its conclusion (e.g., account maintenance),
  • Art. 6(1)(f) GDPR — the controller's legitimate interest (ensuring system security, traffic analysis, preventing abuse),
  • Art. 6(1)(a) GDPR — user consent, if required by additional application features (e.g., the "Keep me logged in" option) or by joining the waitlist for the boxed edition of the game; consent may be withdrawn at any time, and its withdrawal does not affect the lawfulness of processing carried out before the withdrawal,
  • Art. 6(1)(c) GDPR — obligations resulting from legal regulations (e.g., system security).

Technical data, such as IP address, server logs, browser and device information, are processed based on the Controller's legitimate interest (Art. 6(1)(f) GDPR) in order to ensure security, detect abuse, and maintain the stability of the application's operation.


We store your custom avatar and show it to other game participants on the basis of Art. 6(1)(b) GDPR — it is a feature of the Service that you use voluntarily. Uploading an image depicting you constitutes consent to the dissemination of your likeness to that extent (Art. 81 of the Polish Act on Copyright and Related Rights); you may withdraw it by deleting the avatar. The automated checking of the image, the handling of reports, and the storage of a hidden image for the purpose of resolving the matter take place on the basis of the Controller's legitimate interest (Art. 6(1)(f) GDPR): protecting users against prohibited content and handling appeals. Securing an image at the request of a court or public prosecutor takes place on the basis of Art. 6(1)(c) GDPR.


Providing personal data is voluntary, but some data — such as email address and username — are necessary for registration and using the application. Failure to provide them will make it impossible to create an account.


5. Data sharing and processors

Your data is not sold. It may be shared only with trusted entities processing data on behalf of the Controller:

  • Vercel Inc. — hosting the application available at app.foxtales.cc,
  • Cloudflare — hosting and delivery of the foxtales.cc website (Cloudflare Workers), CDN, security, traffic analysis, and Turnstile service (user verification and protection against spam/bots), as well as storage and delivery of images uploaded by Users as avatars (Cloudflare R2, data stored in the EU),
  • OVH — hosting of the application servers and storage of database backups,
  • Zoho — email services,
  • Microsoft Ireland Operations Limited — automatic translation of content (Microsoft Azure Translator service),
  • Google Ireland Limited — generation of content by artificial intelligence (Google Vertex AI / Gemini), automatic translation of content, and automated content analysis for moderation purposes (Google Cloud Natural Language), as well as automated checking of images uploaded as avatars for prohibited content (Google Cloud Vision, processed in the EU),
  • Cal.com, Inc. — handling online meeting bookings, submitted solely at the explicit request of the User (clicking the booking button on the foxtales.cc website),
  • Discord Inc. / Discord Netherlands B.V. — provider of internal communication tools used by the Administrator for notifications of system events, supporting the content moderation process, and notifications about submissions sent through the forms on the foxtales.cc website (such a notification then contains the data provided in the form, including name and email address); processing based on Standard Contractual Clauses SCC.

AI Tools, Automated Moderation, and Translations: Part of the application mechanics is based on artificial intelligence (AI) services, automatic translations, and automated content analysis for moderation purposes. Content entered by you in the game — texts and images uploaded as custom avatars, strictly separated from your e-mail address or username — may be sent to external providers (e.g., Microsoft Ireland Operations Limited, Google Ireland Limited) for processing, including automated scanning for safety and compliance with the Terms of Service when an attempt is made to make it public. Please note that for some services, these providers may use these fully anonymized snippets of text to improve their algorithms. For this reason, a strict ban on entering any personal data in the content of questions and answers has been introduced in the Terms of Service.


Recipients of the data may also be IT service providers, hosting entities, companies providing system security, and other entities acting on the basis of a processing agreement.

In terms of protection against abuse, Cloudflare may act as an independent data controller.


Public nature of data: Your username and response content are public data within the game session (for other participants) and in system-generated materials. If you share a gameplay snippet, a question, or a catalog and the like, they become visible to all users on the internet. If you save another user's catalog to your library, its author will see your username and avatar on the list of people who saved that catalog, and may revoke your access to it. If you turn off showing your username in the settings, the author will see you as anonymous.


Custom avatars in catalogs: In catalogs where the Controller has enabled custom avatars, you can upload your own image as an avatar. Before it is saved, the image is cropped and resized, and all metadata embedded in it (e.g., GPS location, camera data) is removed. The image is then sent — without your email address or username — to Google Cloud Vision for automated detection of adult, violent, or racy content. An image assessed as prohibited will not be published. A published avatar is visible to other participants in games played with that catalog and to the catalog's author on the list of people who saved it (unless showing your username has been turned off). An avatar may be hidden following reports from other Users, by decision of the Controller, or when the account is blocked (section 12). You can review and delete your avatars at any time in the account settings (“My photos”). The image is available at a public, hard-to-guess web address. The image is checked only for categories of prohibited content — we do not use facial recognition and do not use the image to identify individuals. Google processes the image only in memory — it does not store it and does not use it to train its models. Upload only your own likeness or the likeness of people who have consented to it.


Traffic analysis on the foxtales.cc website: For traffic analysis on the foxtales.cc website, we use our own self-hosted analytics tool (Umami), served from the foxtales.cc domain. The tool does not save cookies, does not profile users, and does not share data with third parties.


Catalog logo: If the Administrator has enabled custom branding for your catalog, you can upload its logo as the catalog author. The image is downscaled (without cropping) and its metadata is removed; it is then checked by Google Cloud Vision — without your email address or username — in the same way as custom avatars. The logo is seen by participants in games played with that catalog, by people entering the application from a link to the catalog or from an invitation to such a game, and by visitors of the catalog page; it is available at a public, hard-to-guess web address. The logo follows the same reporting, hiding and retention rules as custom avatars (sections 9 and 12) and is deleted together with your account or the catalog. It usually contains no personal data — if it does (e.g. a likeness), we apply the rules described for custom avatars.


6. Transfer of data outside the European Economic Area (EEA)

Some services (e.g., Cloudflare, Vercel Inc., Discord Inc., Cal.com, Inc.) may process data on servers outside the EEA. Appropriate safeguards are then applied, including Standard Contractual Clauses (SCC) .

For online meeting bookings, the service provider remains Cal.com, Inc. (an entity based in the USA), while the booking widget itself is served from the provider's European infrastructure (the cal.eu domain).


7. Cookies and similar technologies

The application uses two types of cookies:

  • Session and technical (essential) — required for the correct operation of the application, user authentication, and ensuring security (e.g., verifying whether a user is not a bot, provided by the Cloudflare Turnstile service). They expire automatically after closing the browser or after a short period (e.g., security tokens after 30 minutes). They do not require user consent as they are necessary to provide the service electronically.
  • Persistent (optional) — saved only when the user consciously selects the "Keep me logged in" option during login. They store an encrypted authentication token for a period of up to 1 day, allowing you to remain logged in after closing and reopening the browser. Selecting this option constitutes consent to save a persistent cookie (Art. 6(1)(a) GDPR).

We do not use marketing or tracking cookies. You can manage cookies in your browser settings or delete the persistent cookie by logging out of the application.


8. Privacy in games and shared materials

During an active game session, your username is visible to other game participants. In accordance with the principle of data minimization, however, we give you the right to a higher level of privacy in captured content. In the application settings, you can enable "Anonymous Mode" , which will cause your username to be hidden or replaced with a generic phrase in materials generated by the application (e.g., Memory graphics) and publicly shared content .


9. Data retention period

Personal data is stored for the following period:

  • permanent account data — until the account is deleted by the User + backups up to 90 days,
  • temporary account data — automatically deleted from the active database approximately 24 hours after its creation + backups up to 90 days,
  • custom avatar image in a catalog — until it is deleted by the User or replaced with a new image, or until the catalog or the account is deleted; the image file is then usually deleted immediately, and at the latest within 48 hours; we usually remove its copy from the CDN immediately (at the latest it expires after 24 hours), and copies in browser caches expire within a further 24 hours. An image hidden as a result of moderation or when the account is blocked is not displayed anywhere; we store it for the purpose of handling reports and appeals for 14 days from the last moderation decision (or for a shorter period if you delete your account or the catalog is deleted earlier), after which it is deleted within the time limits indicated above. If you lodge an appeal during this time, we may extend storage until the appeal is decided. During this time, you cannot delete or replace it yourself. If a court or public prosecutor requests that an image we still store be secured, we keep a copy of it in a separate, non-public storage — together with the image's upload date and the case reference — for the period specified in that request, not exceeding 90 days (Art. 218a of the Polish Code of Criminal Procedure), even if you delete your account or the catalog is deleted in the meantime, and then delete it,
  • server logs — up to 90 days,
  • persistent "Keep me logged in" cookie — up to 1 day or until logout,
  • data based on consent — until it is withdrawn,
  • evidence of acceptance of the terms of service and privacy policy — stored (along with the e-mail address and User identifier) for a period of up to 6 years from the moment the account is deleted, corresponding to the general limitation period for civil claims (Art. 118 of the Polish Civil Code), in order to demonstrate legal compliance and defend against possible claims (Art. 6(1)(f) GDPR).
  • correspondence from the contact form (foxtales.cc) — stored in the Controller's database and mailbox for up to 12 months from the resolution of the matter to which it related; it is removed from the database automatically once that period elapses.
  • waitlist submissions (foxtales.cc) — stored in the Controller's database and mailbox until consent is withdrawn, together with the date, time and IP address at which it was given. Withdrawing consent is equivalent to requesting removal of the address from the list and is done by replying to any message from us or by writing to the contact address given in section 19.

Anonymization of data and content: Upon deletion of an Account, the User profile is eliminated, and their username is permanently deleted or anonymized in the application's operational databases. The e-mail address is removed from the active database and – as indicated above – is stored solely in a secured evidence registry for a period of up to 3 years to defend against claims. Regarding technical system logs (e.g., HTTP request logs, Cloudflare logs), after Account deletion, this data may still contain technical information, such as IP address or device identifier. This data is separated from the User profile, is not used for identification purposes, and is stored solely for technical purposes and to ensure cybersecurity for a period of up to 90 days, after which it is automatically and permanently deleted. User Content entered by you (e.g., Catalogs, Questions) is subjected to permanent anonymization upon account deletion, which consists of irreversibly removing the link between it and your email address. From this moment on, it loses its character as personal data and is stored by the Controller for statistical purposes and application development for an indefinite period.


10. Your rights

You have the following rights:

  • access to your data,
  • rectification,
  • deletion,
  • restriction of processing,
  • data portability,
  • objection to processing,
  • withdrawal of consent at any time.

11. Data export and deletion procedure

Data export (right to portability): The user has the right to receive a copy of their data in a structured, machine-readable format (JSON file). For this purpose, a request should be sent to office@foxtales.cc from the e-mail address assigned to the account in the application.


Data deletion: Temporary accounts (guest access) are automatically deleted from the system approximately 24 hours after their creation.

In the case of permanent accounts, deleting the account is possible from the Application settings or by sending a request to office@foxtales.cc from the e-mail address assigned to the account in the Application. If the request is sent from a different e-mail address, the Controller may take additional steps to verify the User's identity before fulfilling it.


Time limit for processing requests: Requests regarding data export or deletion, as well as other requests related to the rights indicated in point 10, are processed without undue delay, and in any event within one month of their receipt. In cases justified by the complexity of the request or the number of requests, this period may be extended by a further two months, of which the User will be informed within one month of receiving the request, along with the reasons for the delay (Art. 12(3) GDPR).


12. Automated decision-making and lack of profiling

The Controller does not use profiling within the meaning of Art. 22 GDPR that would produce legal effects concerning the User or similarly significantly affect them.

However, the application employs automated moderation mechanisms, including content scanning by artificial intelligence algorithms at the moment an attempt is made to make it public. A decision by the algorithm classifying content as violating the Terms of Service may result in the automated blocking of its publication (rejection). In addition, the system may automatically and temporarily hide content after reaching a certain threshold of community reports.

Furthermore, to protect the service against attacks and spam (bots), the application uses automated traffic analysis mechanisms provided by the Cloudflare Turnstile service, which may result in automated blocking of access to the application in the event malicious traffic is detected. However, this does not constitute profiling for marketing purposes.

In every case of automated blocking or hiding of content, the User has the right to contest that decision. Final decisions (e.g., permanent deletion or restoration of content) are always subject to manual verification and human intervention by the Controller.

Images uploaded as custom avatars are checked automatically on every upload, not only when an attempt is made to make them public — an image assessed as prohibited is not published. The deletion of a hidden avatar after the retention period has elapsed (section 9) is not a moderation decision but an application of the storage limitation principle. If your account has an e-mail address, we will inform you when your avatar is hidden, with a statement of reasons: which catalog and image it concerns, whether the decision was made automatically (following reports) or by the Controller, when the image will be permanently deleted, and how to appeal.


13. Data security

We use technical and organizational measures to ensure data security, such as transmission encryption, server security, and access control.


14. External links

The application may contain links to third-party sites. The Controller is not responsible for the privacy policies of these sites. This also applies to sharing buttons: clicking such a button takes you to an external platform (e.g. Facebook), which processes data under its own rules and as an independent data controller.


15. Changes to the Privacy Policy

We reserve the right to make changes. We will inform you of significant changes by updating the date in the header.


16. Complaint to the supervisory authority

If you believe that your data is being processed unlawfully, you can file a complaint with:
President of the Office for Personal Data Protection
ul. Stawki 2, 00-193 Warsaw, Poland.


17. Age of users

The application is intended for persons who have reached the age of 13. For users under 16 years of age, consent to the processing of personal data (such as email) should be given by a parent or legal guardian. The Controller does not verify the age of users by documents, but reserves the right to delete accounts of persons who have been informed that they use the service without the required consent. A person under 16 years of age may upload a custom avatar depicting their likeness only with the consent of a parent or legal guardian.


18. Data Protection Officer

The Controller has not appointed a Data Protection Officer. Contact regarding GDPR matters: office@foxtales.cc .


19. Contact

In matters related to data protection, please contact: office@foxtales.cc .


This Privacy Policy is for information purposes and describes the rules for processing personal data in the Foxtales application.