Privacy Policy

Tiny Frenzy Games (“we,” “us,” or “our”) is a one-person independent game studio run by Kylee McCarthy. This Privacy Policy explains what personal information we collect through tinyfrenzygames.com (the “Site”), including information received through Google Sign-In, how we use it, who we share it with, how we protect it, how long we keep it, and the rights you have over it.

This policy applies to the Site and the emails we send from it. It does not apply to third-party websites or services we link to.

1. Who We Are

Tiny Frenzy Games is based in Utah, United States. For any question about this policy or your personal information, email us at support@tinyfrenzygames.com.

2. Information We Collect

We collect only what the Site needs to work:

• Mailing list. When you subscribe, we collect your email address, when you subscribed and confirmed, and a one-way hash of your IP address (used only to prevent abuse; the original address cannot be recovered from it).
• Contact form. When you write to us, we collect your name, email address, subject, message, and a one-way hash of your IP address.
• Newsletter engagement. Our email provider, Resend, records whether each newsletter was delivered, opened, or a link in it was clicked, using a tracking pixel and tracked links. We use this only to see how newsletters perform; our own database stores totals per newsletter, not per person.
• Google Sign-In (studio administrators only). Visitors never need to sign in. Google Sign-In is used only by the studio to reach a private admin area. See section 3 for exactly what Google data this involves.
• Technical data. Our hosting provider, Cloudflare, processes standard request data (such as IP address, browser type, and the pages requested) to deliver and secure the Site. We do not use advertising trackers or behavioral analytics.
• Cookies and local storage. The Site sets a cookie only when an administrator signs in (see section 3). Your light/dark theme choice is saved in your browser's local storage and is never sent to us.

We do not knowingly collect sensitive personal data.

3. Google Sign-In and Google User Data

The Site uses Google Sign-In (Google OAuth) solely so the studio's administrator can sign in to the Site's private admin area, where games, newsletters and messages are managed. It requests only Google's basic sign-in scopes (openid, email, profile) and no access to Gmail, Drive, Calendar, contacts or any other Google service.

What Google user data we access

When you sign in with Google, Google shares your name, email address, and profile picture, along with a Google account identifier.

How we use it

We use this data only to confirm that your email address is on our list of administrators allowed to sign in, and to keep you signed in. Anyone whose email is not on that list is refused, and their data is not kept. We do not use Google user data for advertising, marketing, profiling, or to develop, improve, or train artificial intelligence (AI) or machine learning models.

How we store it

We do not store Google user data in our database. After you sign in, your name, email address, and profile picture are kept only inside an encrypted, signed session cookie in your own browser, so the Site knows you are signed in.

Sharing, transfer, and disclosure

We do not sell, share, or transfer Google user data to anyone. The only exception is if the law requires us to disclose it, as described in section 6.

How we protect it

The session cookie is encrypted and signed with a secret key held only by our server, is marked secure and HTTP-only (so page scripts cannot read it), and is sent only over HTTPS. Only allowlisted administrators can sign in.

Retention and deletion

The session cookie is deleted when you sign out and expires automatically after 30 days without use. We keep no other copy, so nothing remains once the cookie is gone. You can also remove the Site's access at any time from your Google Account permissions page, or email us at support@tinyfrenzygames.com to ask about any data we hold.

Limited Use

Tiny Frenzy Games's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. How We Use Your Information

• Send the newsletter you subscribed to (unsubscribe any time from any email);
• Reply to your messages and support requests;
• Let the studio's administrator sign in to manage the Site (section 3);
• Operate, secure, and improve the Site, and prevent spam and abuse;
• Comply with legal obligations.

We never add you to the mailing list because you used the contact form. That requires you to subscribe separately.

5. Legal Basis and Consent

Where the law requires a legal basis, we rely on your consent (newsletter emails, which you can withdraw at any time), our legitimate interests (answering messages, securing the Site, running the studio), and legal obligations. Withdrawing consent does not affect processing that happened before.

6. How We Share Your Information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We use these service providers, which process data on our behalf and only to provide their service:

• Cloudflare: hosts and secures the Site, and forwards email sent to our addresses to our inbox.
• Neon: hosts our PostgreSQL database (mailing list, contact messages, and Site content), in the United States.
• Resend: stores mailing-list addresses and sends our newsletters, confirmations, and contact-form notifications.
• Google: provides Google Sign-In for administrators (section 3).

We may disclose information if required by law or a valid legal request, or to protect the rights, property, or safety of Tiny Frenzy Games, our users, or others. If the studio is ever merged or sold, we will notify you before your information becomes subject to a different privacy policy.

7. Data Retention

• Mailing list: until you unsubscribe or ask us to delete it. We may keep your address in a suppression record so we never email you again after you unsubscribe.
• Contact messages: as long as needed to handle your request and for a reasonable period afterward, then deleted.
• Google Sign-In data: only in the administrator's session cookie, until sign-out or 30 days without use (section 3).
• Hashed IP addresses: kept with the subscription or message they belong to, and deleted with it.

When a retention period ends, we delete the data. We keep information longer only where the law requires it.

8. Data Security

All traffic to the Site uses HTTPS. Our database connection is encrypted with verified certificates, IP addresses are stored only as one-way hashes, and the admin area is limited to allowlisted administrators. No system is perfectly secure, but if a breach affects your information we will notify you and the authorities as the law requires.

9. Your Privacy Rights

Utah residents (UCPA). You have the right to confirm whether we process your personal data and to access it, to delete data you provided, to get a portable copy of it, and to opt out of targeted advertising or the sale of personal data. We do neither, but the right is yours. We will not discriminate against you for using these rights.

Everyone else. You may have similar rights under other U.S. state laws or the EU/UK GDPR, such as access, correction, deletion, portability, or objection. We honor valid requests wherever you live, as far as practical.

To make a request, email support@tinyfrenzygames.com. We may confirm that you control the email address involved before acting, and we respond within the time the law requires (for the UCPA, generally 45 days, extendable by 45 days when necessary). You may also complain to the Utah Attorney General or your local data protection authority.

10. Children's Privacy

The Site is not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child has given us information, email support@tinyfrenzygames.com and we will delete it.

11. Third-Party Links

The Site links to other sites, such as game storefronts and social media. Their privacy practices are their own, so please review their policies.

12. International Users

We are based in the United States, and your information is processed and stored in the United States and wherever our service providers operate. By using the Site you understand your information may be transferred there.

13. Changes to This Policy

If we change this policy, we will update the effective date above. If we change how we use Google user data or other personal information in a material way, we will notify affected users before the change applies.

14. Contact Us

Questions or requests about this policy or your personal information: support@tinyfrenzygames.com.

Tiny Frenzy Games · Utah, United States