Bubble Punks Privacy Policy

Effective date: November 4, 2026 · Version: 1.1

What's changed

• Parties: the people in your party see your name, title, level, character and whether you're connected, and players in a room see which seats came together (sections 2, 4 and 8).

This policy explains how Immersia Labs LLC ("we", "us") handles information when you play Bubble Punks on iPhone, iPad or Android, use our game servers, or visit bubblepunks.com. We've tried to write it in plain words. If anything is unclear, email support@immersialabs.com.

The short version

• You can play without telling us your real name, email address, phone number or where you live.
• When you set up the game, we create a game account for you with a random ID and a player name, and we save your progress when you play online.
• Solo games and Wi-Fi party games aren't sent to us: we never see what happens in them. When it opens while your phone is online, the game asks our servers for its settings, which sends your IP address but no account details. Once you have a game account, it also checks your sign-in with our servers each time it opens while your phone is online. Offline, it checks nothing, and solo and Wi-Fi games still work. If your account has a friends list, the game also stays connected while it's open, so your friends can see you're online.
• We ask your birth month and year once. We use them only to work out your age group and, for players 13 to 17, the month it changes. We never store your birthday.
• Players under 13 get kids' mode, with extra privacy protections (section 5).
• No ads. We don't sell your information, track you across other apps or websites, or use your information to train AI.
• You can delete your account at any time in the app (Profile → Account → Delete account).

If you're under 13

Here's how we look after you in Bubble Punks:

• We never ask for your real name, email, phone number, address or photo.
• You get a fun game name made from words, like Bouncy Fox 42. Nobody can use it to add you as a friend. (If you take over as host of a room someone else started, other players can see your game name in the room list.)
• You add friends by swapping friend codes: show yours to a friend, or type in theirs. A code works once and lasts 10 minutes. Only swap codes with people you know.
• We save your level, your matches and the things you earn so you don't lose your progress.
• If you have questions, or want to delete your account, ask a parent or another grown-up you trust to help you.

1. Who we are

Bubble Punks is made by Immersia Labs LLC, a Wyoming limited liability company, 30 N Gould St Ste N, Sheridan, WY 82801. You can reach us by email at support@immersialabs.com or by phone at +1 412-773-1760.

We're responsible for the information collected through Bubble Punks. The service providers in section 6 handle it for us. Google also handles some of it under its own terms when it signs you in or checks your phone (section 6).

2. What we collect

Playing solo or on Wi-Fi

• Solo games aren't sent to us.
• Wi-Fi party games don't reach us either. So that you can play together, your phone shares your player name, title, XP and level, character and the looks you wear directly with the other phones in the room. The host's phone announces the room to devices on the same Wi-Fi network, with its name (at first, your player name followed by "'s room") and a room code made from the phone's address on that network. Phones in the room connect to each other directly, so they learn each other's addresses on that network. Players under 13 pick their party name from word lists.
• Once you have a game account (see below), the game checks your sign-in with our servers each time it opens while your phone is online, even if you then play solo or on Wi-Fi. Offline, it checks nothing, and solo and Wi-Fi games still work. If your account has a friends list (kids' accounts and accounts linked to Google or Apple), the game also stays connected to our servers while it's open, so your friends can see you're online and invite you. This sends the account details, IP address and sign-in records described below, but nothing about your solo or Wi-Fi games. Signing out (Profile → Account → Sign out) stops both.
• Even without a game account, the game asks our servers for its settings (such as whether online play is open, and the current season) each time it opens while your phone is online. That request carries your IP address and the app version, but no account details. When the game downloads new game files, such as posters, looks or maps, it fetches them from Google Cloud's file storage the same way: the file's name, your IP address and the app version, nothing else.
• Your settings, such as controls, sound, your player name, your age group and the month it changes, are stored on your phone (see "On your phone" in section 8).

Your game account and online play

When you first set up the game, right after the age question, we create a game account for you. (If the game can't reach our servers then, it creates the account the first time you play online.) This is what we keep:

About IP addresses. Our servers use your IP address to connect you to matches and to stop too many requests coming from one address. These abuse counters are kept only in our servers' memory, never on disk, and forget your address within a few minutes. When we write an IP address into our logs on purpose, we scramble it first. An unscrambled address can occasionally slip into an error message. Either way, logs are deleted after 30 days.

If you link a Google account (13 and over)

So that you can keep your progress when you change phones, players 13 and over can link a Google account (on Android, iPhone and iPad). Google then shares your Google account ID, email address, name and profile picture with Firebase, our sign-in provider, which keeps them so you can sign in. Each time you sign in, Firebase sends our servers a signed sign-in token that also carries your email address, and may carry your Google name and picture. Our servers ignore those and keep only your Google account ID.

If you sign in with Apple (13 and over, iPhone and iPad)

We don't ask Apple for your name or email address. Apple gives Firebase and our servers only a random Apple user ID that Apple makes for our apps only, plus a token our servers keep only so we can cancel your Apple sign-in when you delete your account.

If you contact us

We keep your email address and what you write, so that we can answer you. Section 8 says for how long.

Crash reports

If the game crashes or hits a serious error, it sends a crash report to Firebase Crashlytics, Google's crash-reporting service. A report holds where in the game's code the problem happened, the app version, your phone's model and operating system, how much memory and storage were free at that moment, and the time. It also carries a random ID for this installation of the game (a Firebase installation ID), so that we can tell how many phones a problem affects. We don't put your account ID, player name or anything you typed into crash reports, and we don't link them to your account, though an error's own message can occasionally include the address of a request, which can hold an account ID. When the game opens, Firebase also registers the installation ID with Google and may send a short note that the game started, even if nothing crashes, so that crash-free sessions can be counted. We use all of this only to find and fix problems. Section 8 says how long they're kept.

What we don't collect

• Your birthday (we keep only your age group and, for players 13 to 17, the month it changes).
• Your real name, home address or phone number. (If you link a Google account, Google shares your Google profile name with Firebase, as described above; our own servers don't keep it.)
• Your precise location, contacts, photos, camera or microphone.
• Advertising IDs, or any other IDs used to track you across apps.
• Payment details: Google or Apple takes payment, and we never see your card or bank details.
• Chat messages: players can't send typed messages to each other. They can send stickers and poses from a fixed list to the players in their room or round; these are passed on and not kept. Players 13 and over can type a player name and room names, which other players can see. Nobody types a title: titles come from the game.

Information from other companies

• Google Firebase sends our servers a signed sign-in token with your sign-in ID and, if you linked a Google account, your Google account ID (see above).
• Checking that the app is genuine. When you sign in, the game proves to Google Firebase that it's our real app on a real phone, to stop fake sign-ins and cheating tools (Firebase App Check). On Android, Google carries out the check (Google Play Integrity, and reCAPTCHA in Google's sign-in tools). On iPhone and iPad, Apple does (App Attest, or DeviceCheck on devices without it). Our servers get only a pass or a fail, and keep only counts of how many passed or failed, never anything from your phone. Google's sign-in tools also send Google details such as your phone model and operating system.
• Apple and Google may share your age range with the game where the law has them do so (for example in Texas, and in California from 2027), and for supervised teens whether a parent approved. We use it only to apply the right age rules. We keep the age group it maps to, the store approval ID above, and a dated record of any change it makes to your account, kept 12 months (section 8).
• Apple and Google give us statistics about downloads and, if you've agreed in your phone's settings to share them with app developers, crash reports. These don't tell us who you are.

3. How we use information

We use information only to:

• Run the game: sign you in, save your progress, run rooms and matches (including matching players of similar skill), and let you play with friends.
• Keep the game safe and fair: stop cheating, abuse, spam and attacks, enforce our rules, and protect players, especially children.
• Keep it working: run our servers, and find and fix problems, such as lag or crashes.
• Follow the law: meet our legal duties, enforce our terms and respond to lawful requests.
• Talk with you: answer your messages.

We don't:

• show ads, or use your information for marketing or to build a picture of your interests;
• sell or rent your information, or share it for advertising;
• track you across other apps or websites;
• use your information to train AI. The AI tools we use to build and run the game don't see players' information, except as section 6 says;
• make automated decisions about you that have legal or similarly significant effects;
• send push notifications. If we add them, we'll ask your permission first, and we won't send them to players under 13.

4. What other players can see

Other players' phones receive a little more than their screens show. They get your exact XP, though the screen shows only your level. Players who have you in their friends, requests, party, recent-players or blocked lists, or who get an invite from you, also receive your random account ID, so that their game can manage the friendship or block you; it isn't shown on screen. Other players never see your email address, Firebase sign-in ID, age group, IP address, phone details, match history or totals. Only you see your match history and totals; players you played with see only your line in the matches they shared with you. We never tell a player who reported them.

5. Children under 13

This section is our notice to parents under the US Children's Online Privacy Protection Act (COPPA).

How we find out a player's age

When the game is first set up, before any game account is created, the app asks for the player's birth month and year, with nothing pre-selected. The app works out the age group on the phone and sends only the group to our servers; for players 13 and over, it also sends the month they move up to the next group. No such month is kept for children. The birthday itself is never stored. Once answered, it can't be changed for that account: an account never moves to an older age group that way. On a shared phone, signing out asks the question again, for the next player's own account. If the game doesn't know a player's age group yet, it treats them as under 13.

Where Apple or Google shares an age range. Some places require app stores to check their users' ages and share an age range with apps, for example Texas, and California from 2027. Where your store shares one, the game uses it as well as asking, and checks it again each time the game opens. We keep only the age group it maps to (and, for some players, the store approval ID in section 2), never the age range the store sends. If the store's range is younger than the age you gave us, the store's applies. Once the store has confirmed a teen's age, its range can move them up as they get older, but a store's range never moves anyone out of kids' mode. If the store still needs to check your age, the game follows kids' mode rules until it has, without changing your account.

Kids' mode doesn't switch off by itself when a player turns 13. If a player's age group is wrong, a parent or guardian can email us at support@immersialabs.com.

What's different in kids' mode

Players under 13 automatically get kids' mode:

• A child's game account is created during setup, right after the age question, and follows the under-13 rules from the start.
• Player names come from our word lists, and titles come from the game. Children can't type anything that other players see.
• There's no Google or Apple sign-in, so no email address is collected, by us or by Google Firebase.
• Nobody can find or add a child by their player name, and children can't send friend requests by name. Children add friends only by swapping a one-time friend code, which works once and lasts 10 minutes: they show their code to someone, or type in the code someone shows them. We tell children to swap codes only with people they know.
• Rooms they create have no typed name and aren't listed: others can join only with the room code.
• There's no chat and no push notifications. Children can send stickers from a fixed list (set phrases and pictures) to their room or round; nothing is typed or kept.
• Children can't spend money and never see Glowdrops or real-money prices (they unlock items with Gum earned by playing), so we don't collect purchase information from them. If an account that bought something is switched to kids' mode, its earlier purchase records are kept only as tax and accounting law requires.

What we collect from children, and why

Kids' mode is built so that we collect only what the game needs to run. We don't ask a parent's permission before a child's game account is created. Instead, we use the information only for the things listed below, and parents can see or delete it at any time (see "Parents' rights").

From children, we collect only:

• identifiers: the account ID, the Firebase sign-in ID, a random ID for each sign-in, the IP address, a scrambled form of the recovery code if they make one, and the store's approval ID (section 2) where Google or Apple shares the child's age range;
• technical details sent with them: the phone's platform (iPhone/iPad or Android) and the app version, and details such as the phone model and operating system that Google's sign-in tools send to Google. Google (on Android) or Apple (on iPhone and iPad) also checks that the app is genuine when the child signs in, and our servers get only a pass or a fail (section 2). If the game crashes, a crash report with a random installation ID goes to Google's Firebase Crashlytics (section 2); and
• game information linked to the identifiers: the player name from our word lists, the title from the game, favorite character, age group, progress (XP, level, totals, season pass progress, Gum, and the items they've earned and wear), a skill rating (from their online results, never shown), match records (including connection quality), rooms, friends, friend requests and blocked players, friend codes and room invites (kept 10 minutes), whether they're online and which room they're in (shown only to their friends), reports they send (a reason from a list, never typed text), reports about them and whether their name is hidden after reports, any suspension or ban, which terms versions they agreed to and notices they've seen, where their age group came from (our question or the store), our record of changes to the account (such as a store's age update), and sign-in records (when the game signed in or renewed its sign-in, and when it last did).

We don't collect any other personal information from children, such as their name, email address, phone number, photos, voice or location. Children can't make personal information public, because everything they show other players comes from our word lists.

We use this information only to support the internal operations of the game, which are:

1. signing the child in and keeping the account secure;
2. connecting the child's phone to our servers to run rooms and matches, including matching them with players and computer players of similar skill;
3. saving progress and what the child has earned, and showing the child their own level and match history;
4. letting the child play with friends they added with a friend code: their friends list, showing those friends when the child is online and which room they're in, and room invites between them;
5. showing other players who they're playing with:
   • in the child's rooms and matches: the child's player name, title, level, character, team and match results, and afterwards, in the round history of the players in those matches, the child's player name, character, team and results;
   • afterwards, in those players' "played with recently" lists, with when they last played together;
   • in the room list, if the child takes over as host of a room someone else started;
6. preventing cheating, abuse, spam and attacks, including blocking and reporting;
7. keeping our servers and the app working and fixing problems, including through crash reports;
8. meeting our legal obligations, such as keeping kids' mode on for the account, and noticing if a parent withdraws a store's approval for the game. For that, we keep Google's ID for this installation of the game if a parent supervises the child's Google account, or Apple's ID for this game's download if Apple shares the child's age range.

How we make sure the information is used for nothing else:

• The app contains no advertising, analytics or ad-tracking tools, and we show no ads.
• We never use it to contact a particular child. We send no email, no push notifications and no messages of our own to a child's account. (We may show the same in-game notice to every player, for example about a change to these rules.)
• We don't use children's information for advertising or marketing, or to build a picture of a child's interests or behavior, and we never sell it.
• Only the people who run Bubble Punks can look at it, and only for the uses above. The AI tools we use to build and run the game never see children's information. Our written security program sets these limits, and everyone with access gets them in writing.
• We delete it on the schedule in section 8. When we write an IP address into our logs on purpose, we scramble it first. One can occasionally appear unscrambled in an error message, and logs are deleted within 30 days.

Who we share children's information with

• Service providers that run parts of the game for us: Google (our servers and game files on Google Cloud, Firebase sign-in, crash reports, Google's app checks on Android, and our email, if a parent or child writes to us), Apple (its app check on iPhone and iPad), and Amazon Web Services (our test server, used only by our own team and family to try new versions). They may use it only to provide those services to us. Google also applies its own terms to its sign-in tools and app checks (section 6).
• Our website's host, GitHub, records the IP address of everyone who visits bubblepunks.com, children included, to keep its service secure (section 13).
• Other players see a child's player name, title, level, character and match results, as described in section 4. Some players' phones also receive the child's random account ID, for example friends and people who played with the child recently, so that their game can show the friendship or block the child. It isn't shown on screen. None of this lets anyone contact the child, or add the child as a friend without swapping friend codes.
• Legal reasons and safety: when the law requires it, or to protect someone's safety, or to stop fraud, abuse or security problems (section 6).
• If our company changes hands: the new owner must keep the promises in this section, and must get a parent's permission before using a child's information in any new way (section 6).

We don't share children's information with anyone else, and we never sell it or share it for advertising.

Parents' rights

If you're the parent or guardian of a player under 13, you can:

• see the information we hold about your child;
• have it deleted: in the app on your child's phone (Profile → Account → Delete account), or by asking us. We erase it within 30 days;
• stop us collecting more: delete the account, or ask us to. After that, solo and Wi-Fi party games still work without an account. The game may still ask our servers for its settings when it opens, which carries no account details.

To make a request, email support@immersialabs.com with the subject "Parent request", write to us at 30 N Gould St Ste N, Sheridan, WY 82801, or call +1 412-773-1760. Include your child's player name, which you can see on the Profile screen. To protect children, we'll check that the request comes from the child's parent or guardian, usually by asking for a screenshot of the Profile screen on your child's phone. We'll reply within 30 days.

We never ask a child for more information than they need to play. If a child under 13 emails us directly, we reply once and then delete their email address and message. If they need more help, we'll ask them to have a parent or guardian contact us.

If we learn a child is using a regular account

If we learn that a player under 13 is using a regular account (for example, because a parent tells us, or because Apple or Google tells the game the player is under 13), we'll either switch it to kids' mode or delete it. When the store tells us, the game switches the account by itself. Switching keeps the player's progress on that phone. It removes any linked Google or Apple sign-in and the details that came with it, replaces a typed name with one from our word lists, and removes typed room names. Friends they already had stay, and pending friend requests are removed. If the account had bought anything, we keep those purchase records only as tax and accounting law requires, and any Glowdrops left stay on the account, unused while kids' mode is on.

If someone says they're under 13 on a phone that's signed in to a regular account, the game starts a new kids' mode guest account for them and leaves the regular account as it is.

6. Who we share information with

We share information only in these cases.

Service providers. These companies run parts of Bubble Punks for us. Their terms with us let them use the information only to provide their service to us, and require them to protect it at least as well as this policy does. Apple and Google also act under their own terms when they take payment, when you sign in with your Apple or Google account, and when they share your age range with the game (below).

Google's own terms. Google also handles some information under its own terms and privacy policy (policies.google.com/privacy). If you sign in with Google, your Google account keeps a record that you use it with Bubble Punks. Google Cloud keeps its own records of requests to its services, such as the IP address of a file download, under its own privacy notice. Google Play takes payment for purchases on Android, and shares your age range where the law has it do so. On Android, the checks that the app and phone are genuine (section 2) run under Google Play's terms.

Apple's own terms. Apple takes payment for purchases on iPhone and iPad, runs Sign in with Apple, and shares your age range where the law has it do so, under its own terms and privacy policy (apple.com/legal/privacy).

GitHub's own terms. GitHub hosts bubblepunks.com and records visitors' IP addresses under its own privacy statement (section 13).

Other players. See section 4.

Legal reasons and safety. We may share information if the law requires it, to respond to valid legal requests, to protect anyone's safety, or to prevent fraud, abuse or security problems.

If our company changes hands. If our company is sold or merges with another, player information may pass to the new owner. The new owner must keep the promises in this policy for that information, or tell you about any changes before they apply. They must also get a parent's permission before using children's information in any new way.

We don't sell personal information, and we don't share it for targeted advertising, as those terms are used in California and other US state privacy laws.

7. Where we keep information

Our servers are in the United States (Google Cloud; our test server is on Amazon Web Services), and Google says Firebase sign-in runs in US data centers. If you play from outside the United States, your information is sent to and kept in the United States.

8. How long we keep information

This is our data retention policy. It applies to everyone, including children.

When we delete something from our servers, Google Cloud, which runs them, says it also clears it from its own systems within 180 days.

If the law requires us to keep something longer, for example for a legal claim, we keep only that, and only for as long as required.

On your phone. Your settings stay on your phone until you delete the app. They include your age group, and for players 13 to 17 the month it moves up, never your birthday. On iPhone and iPad, a backup of your device can include the game's settings; the Android app doesn't use Android's backup. Your sign-in details are kept in the phone's secure storage. On iPhone and iPad, Apple keeps that storage even after you delete the game, so if you reinstall it you may be signed back in to the same account, and an encrypted backup of your device can include it. Signing out removes your age group from the phone. Deleting your account (Profile → Account → Delete account) removes your sign-in details and your age group from the phone. We can't see anything stored on your phone, and we can't remove it.

9. Your choices and rights

Everyone can:

• See your information. Your profile, progress and recent matches are in the app. Parents can get a copy of everything we hold about their child (section 5), and so can anyone whose state's law gives them that right (see below): email support@immersialabs.com. We send it in a common format such as JSON. It includes reports made about you, with their reason, date and outcome, but never who made them, and a list of the actions our staff took on your account, and when.
• Correct it. Change your player name on the Profile screen. Players under 13 pick new words.
• Delete it. In the app: Profile → Account → Delete account. Without the app: see bubblepunks.com/delete-account. Section 8 says what's erased, and when.
• Sign out. In Profile → Account, sign out on this phone. If your account is linked to Google or Apple, you can also sign out on all your devices.
• Remove things you typed. You can change your player name at any time on the Profile screen. Change or clear a room's name in its Room tab while you're hosting it. That's everything a player can type in the game. If you're under 18 and live in California, this is how you use your legal right to remove what you posted. Removing something doesn't guarantee it's completely gone everywhere: for example, someone may have taken a screenshot, and copies stay in our logs and backups until they're deleted (section 8). A closed room keeps its name in our records until your account is erased, and a name someone reported stays in that report until the report is deleted.
• Withdraw permission. We don't rely on your permission (consent) for anything today. If we ever ask for it, for example for notifications, you'll be able to withdraw it at any time in the game's or your phone's settings.
• Use extra rights in some states. Some US state laws, such as Connecticut's, also give you the right to a copy of your information in a format you can reuse, and to opt out of targeted advertising, the sale of your information, and profiling used for decisions with legal or similarly significant effects. We don't do any of those things (our skill rating only picks fair opponents), and we send copies in a common format such as JSON. If we turn down a request, you can appeal by replying to our answer with the subject "Appeal" within 60 days. We'll answer your appeal within 60 days, and if we still say no, we'll tell you how to complain to your state's attorney general.

We'll answer requests within 45 days, and we may first need to confirm that the account is yours. We won't treat you differently for using these rights.

10. Security

• Sign-in, account and room traffic is encrypted on its way between your phone and our servers (HTTPS and secure WebSockets).
• During a match, your moves travel in signed packets: our servers throw away any packet that has been changed on the way. They aren't encrypted, because they contain only game moves.
• Our server disks and backups are encrypted. Our servers keep sign-in tokens, recovery codes and room passwords only in scrambled (hashed) form (except the Apple sign-in token, which we need whole to cancel your Apple sign-in, and which is useless without our own Apple key), and scramble IP addresses when they write them into logs on purpose (see "About IP addresses" in section 2).
• Only the people who run Bubble Punks can access player data, and we follow a written security program that we review every year. The AI tools we use to build and run the game don't see player data, except as section 6 says.
• Our admin tools show each person only what their job needs, one account at a time. They need two-step sign-in with a passkey, and every look at a player's account and every change is recorded.

No system is perfectly secure. If a security breach affects your information, we'll tell the people affected and the authorities as the law requires. Because we don't have most players' email addresses, we may tell you in the game or on our website.

11. Teens

Players aged 13 to 17 get the protections in this policy: no ads, no selling of their information, no location tracking, and no one else sees their age group. Every player can block other players. Anyone can report a player or a problem to us at support@immersialabs.com (see section 6 of our Terms of Service). If you're a teen, we encourage you to talk to a parent or guardian about playing online.

12. Players outside the United States

We're based in the United States and keep information there (section 7). We follow this policy wherever you play, and you can use the choices in section 9 from anywhere. You may also have the right to complain to the data protection authority where you live.

13. Our website

bubblepunks.com has no accounts, ads, analytics or forms, and doesn't use tracking cookies. It's hosted by GitHub (GitHub Pages), which records each visitor's IP address to keep its service secure. GitHub keeps those records under its own privacy statement (docs.github.com/site-policy), and doesn't share them with us.

14. California notices

• Do Not Track. We don't track you across other websites or apps, and we don't let other companies do so through Bubble Punks, so we don't respond differently to "Do Not Track" signals.
• No other trackers. No company other than our service providers (section 6) collects information through Bubble Punks about what you do over time or on other websites or apps.
• Minors. See "Remove things you typed" in section 9.

15. Changes to this policy

When we change this policy, we'll post the new version here with a new effective date, and keep earlier versions, each at its own dated address, listed at bubblepunks.com/privacy/versions. If a change is important, we'll tell you in the game before it takes effect. If we ever want to collect, use or share children's information in a way that the law says needs a parent's permission, we'll get that permission first.

16. Contact us

Immersia Labs LLC
30 N Gould St Ste N, Sheridan, WY 82801
Email: support@immersialabs.com
Phone: +1 412-773-1760