Bunnyhug Studios Privacy Policy

Current Policy Effective Date: August 30, 2026 Last Updated: August 30, 2026

1. Nature of the Services & Virtual Currency Notice

The Services provide digital and arcade entertainment across diverse genres. Certain games (such as Quinella Derby) feature simulated arcade horse racing, betting odds, and virtual wagering mechanics, whereas other games (such as Hardle 16) are free-to-play casual word puzzle experiences.

2. Information We Collect

We collect only the information necessary to provide the Services, maintain server-authoritative multiplayer integrity, prevent cheating, and facilitate player communications.

2.1 Information You Provide to Us

• Registered Account Credentials: When you register a permanent account, we collect your email address, chosen player handle/username, avatar selection, and authentication credentials.
• Third-Party Authentication (OAuth): If you authenticate through Google, Apple, or Meta (Facebook), we receive your provider-specific user ID, verified email address, and display profile name as permitted by your third-party account permissions.
• In-Game Chat & Communications (User-Generated Content): In multiplayer games with chat functionality, we collect the text of your messages, sender handle, station identifier, and message timestamps.
• Customer Support & Inquiries: When you contact our support or privacy team, we collect your email address, correspondence history, and diagnostic screenshots or logs you provide.

2.2 Guest & Ephemeral Sessions

If you play our games as a guest without creating an account (e.g., guest arcade play or playing Hardle 16 directly in your browser), we do not require your email address or real name. We assign an ephemeral session identifier and use browser storage to maintain your current game round, virtual score, or streak. Guest records are subject to automated pruning as described in Section 6.

2.3 Automated Gameplay, Telemetry, and Device Data

• Gameplay & Economy Telemetry: In multiplayer and simulated arcade games, our servers log virtual balance changes, round numbers, wager selections, race seeds, and virtual payout calculations to resolve disputes and ensure server-authoritative fairness. In puzzle games, we record completed rounds and score summaries.
• Device & Technical Metadata: We collect Internet Protocol (IP) addresses, operating system version, browser type, device identifiers, screen resolution, WebGL graphics performance metrics, and error logs. We never access camera, microphone, or biometric sensors.
• Anti-Cheat & Platform Security: Data collected to identify automated bots, client-side script injection, packet tampering, rapid multi-accounting, and latency exploits.

2.4 Payment & Transaction Data

Purchases of virtual credits or digital goods are processed entirely by authorized third-party payment platforms and Merchants of Record (e.g., Xsolla, Stripe, Apple App Store, Google Play).

Bunnyhug Studios never receives, stores, or processes your raw credit card numbers, banking details, or CVV codes. We receive only non-sensitive transaction confirmation receipts, order identifiers, country of purchase, and digital fulfillment tokens.

3. Cookies, Local Storage, and Browser Storage

We use browser cookies and localStorage solely to:

1. Maintain authenticated player sessions and prevent session hijacking;
2. Persist local player preferences (sound effects, music volume, visual themes);
3. Store local puzzle states, daily game completion status (e.g., daily Hardle 16 word guesses), and guest balances;
4. Monitor server connection stability and asset-loading performance.

You may clear or block cookies and local storage through your browser settings. Note that disabling essential storage may reset your daily streaks, puzzle progress, and custom audio/visual preferences.

4. How We Use Your Information (Lawful Bases)

Under GDPR, PIPEDA, and international standards, we process personal data only when an established lawful basis applies:

5. How We Share Your Information

We do not sell, rent, lease, or monetize your personal data. We share information only under strict operational safeguards:

• Core Infrastructure & Cloud Vendors: Trusted service providers operating under strict Data Processing Agreements, including cloud database hosting (e.g., Convex), hosting platforms (e.g., Cloudflare Pages), and transactional email infrastructure.
• Payment Processors & Merchants of Record: Authorized payment partners (such as Xsolla, Stripe, Apple, Google) to complete digital purchases and resolve billing inquiries.
• Public Multiplayer Elements: In multiplayer titles, your chosen player handle, avatar, station, public chat messages, and leaderboard standings are visible to other active participants in that room.
• Automated Chat Moderation: Chat messages are analyzed in real time by automated filtering mechanisms to intercept profanity, hate speech, harassment, sexual exploitation, and phishing links.
• Legal Requirements & Safety: When required by applicable statutory law, court order, subpoena, or search warrant, or to protect the safety of players or the general public.
• Corporate Reorganization: In the event of a merger, acquisition, or sale of assets of Bunnyhug Studios Inc., player accounts and associated records will transfer subject to this Privacy Policy.

6. Data Retention & Pruning Lifecycles

In accordance with BC PIPA and GDPR data minimization principles, we enforce scheduled retention and pruning policies:

• In-Game Chat Messages: Retained for a rolling buffer of three (3) days for community moderation review, after which they are permanently deleted from database storage.
• Inactive Guest Profiles: Guest player sessions and associated temporary balances inactive for seven (7) consecutive days are automatically pruned.
• Gameplay & Wagering Rounds: Non-winning round records and transient simulation telemetry are maintained in rolling buffers during active gameplay and purged.
• Registered Account Profiles: Maintained for the lifetime of your active registered account to preserve career stats and leaderboard placement, or until you request account deletion.
• Financial Records: Basic non-sensitive transaction tokens and order receipts are retained to satisfy statutory corporate tax and financial auditing requirements.

7. Data Security & International Transfers

7.1 Security Safeguards

We enforce industry-standard administrative, physical, and technical safeguards—including TLS/HTTPS transport encryption, cryptographic password hashing, and role-based restricted database access—to protect personal information from loss, theft, and unauthorized alteration.

7.2 International Data Transfers

Bunnyhug Studios operates from British Columbia, Canada. Commercial entities subject to Canadian PIPEDA benefit from an adequacy decision by the European Commission. Where personal data is processed by our cloud infrastructure providers in the United States or other jurisdictions, we ensure valid cross-border transfer mechanisms are in place, including European Commission Standard Contractual Clauses (SCCs).

8. Your Privacy Rights and Choices

Depending on your jurisdiction (including British Columbia, Canada, the European Economic Area, the United Kingdom, and US states such as California), you possess specific enforceable statutory rights:

• Right to Access / Know: Request a copy of the personal information we hold about you.
• Right to Rectification: Request correction of inaccurate, incomplete, or outdated data.
• Right to Erasure (“Right to be Forgotten”): Request deletion of your account and personal records.
• Right to Restrict or Object: Object to processing based on legitimate interests or request processing restrictions.
• Right to Data Portability: Receive a machine-readable export of your personal data.
• Right to Withdraw Consent: Revoke consent for marketing or optional processing at any time without penalty.

To exercise any of these rights, email your request to bunnyhugstudios@gmail.com. We do not charge fees for standard statutory requests and respond within statutory timeframes (typically within 30 days).

9. California Resident Disclosures (CCPA / CPRA)

Under the California Consumer Privacy Act as amended by the California Privacy Rights Act:

• No Sale or Sharing: Bunnyhug Studios does not sell your personal information, nor do we share your personal data for cross-context behavioral advertising. We have not sold or shared personal information in the preceding 12 months.
• No Sensitive Personal Information Exploitation: We do not collect or process Sensitive Personal Information (SPI) for inferring characteristics about consumers.
• Non-Discrimination: We will never discriminate against you, alter your gameplay, or charge different prices for exercising your privacy rights.
• Shine the Light: Under California Civil Code § 1798.83, we do not disclose personal information to third parties for their own direct marketing purposes.

10. Age Requirements & Eligibility by Game

Bunnyhug Studios enforces clear, game-specific age tiers across our portfolio:

• Simulated Wagering Games (Quinella Derby): Due to arcade betting themes, simulated horse wagering mechanics, and optional virtual coin purchases, you must be at least eighteen (18) years of age (or the age of legal majority in your jurisdiction) to play Quinella Derby. We do not permit minors to register accounts or place virtual bets.
• Casual & Word Puzzle Games (Hardle 16 and General Web Games): Our casual, word, and logic puzzle games are designed for general audiences aged thirteen (13) years or older. Players between the ages of 13 and the age of majority represent that a parent or legal guardian has agreed to these terms.
• Under 13 Policy (COPPA): We do not knowingly collect or solicit personal information from children under the age of 13. If we discover that a child under 13 has provided personal data without verified parental consent, we will promptly delete that data. Contact us at bunnyhugstudios@gmail.com if you believe a minor under 13 has submitted personal data.

11. Advertising & Analytics Notice

Our current games—including Hardle 16 and Quinella Derby—are completely free of third-party advertising networks. We do not track players across third-party websites or serve behavioral banner ads.

If Bunnyhug Studios introduces third-party advertising networks (such as Google AdMob or Unity Ads) in future casual titles, we will update this policy accordingly, clearly disclose the ad partners, and provide applicable opt-out and consent mechanisms in compliance with COPPA, GDPR, and regional privacy laws.

12. Policy Updates

We may update this Privacy Policy periodically to reflect new game releases or changes in statutory law. When material revisions are posted, we will update the “Last Updated” date at the top of this document and provide prominent notice through the Services or via email. Continued use of the Services after notice constitutes acknowledgment of the updated policy.

13. Contact Our Privacy Officer & Regulatory Recourse

For questions, privacy inquiries, or data access/erasure requests, contact our designated Privacy Officer:

Independent Regulatory Recourse

If you are unsatisfied with our response to a privacy concern, you have the statutory right to lodge a complaint with your relevant supervisory authority:

• British Columbia: Office of the Information and Privacy Commissioner for British Columbia (OIPC BC) at www.oipc.bc.ca
• Canada (Federal): Office of the Privacy Commissioner of Canada (OPC) at www.priv.gc.ca
• EEA / UK: Your local national Data Protection Authority (DPA) or the Information Commissioner’s Office (ICO) in the UK at ico.org.uk