Privacy Policy

Last updated: 26 October 2026

This policy explains how personal data is processed when you use Sfermish, including the website at sfermish.io and the Sfermish.io Android application.

1. Controller and contact

The data controller is the individual operator of Sfermish.io. Privacy requests can be sent to privacy@sfermish.io.

2. Data processed by Sfermish

• Nickname: the pseudonym you choose is sent to the game server, shown to other players during a match and may appear in the public Highscore.
• Gameplay data: room participation, score and gameplay events needed to operate the multiplayer game are processed during play.
• Custom skin: a skin you create is sent to the server so other players can see it. If the score associated with that skin enters the current Top 10, that record skin may be stored server-side while it remains relevant to the Top 10 archive.
• Highscore: the best score for a nickname can be stored persistently together with the time it was achieved.
• Aggregate usage statistics: Sfermish counts browser-to-game-server sessions and measures their duration. The analytics file stores only aggregate counters, including total sessions, total measured duration, broad duration ranges and daily aggregate totals. It does not store a per-session history, nickname, IP address, location, browser/user-agent, referrer, device fingerprint or persistent analytics identifier.
• Technical data: IP address, request metadata, browser/user-agent information and security/connection logs may be processed separately by the hosting infrastructure and reverse proxy to deliver and protect the service.
• Browser storage: Sfermish uses local storage for functional preferences such as theme and nickname. See the Cookie Policy.
• App local data: The Android app may store functional preferences, nickname information and saved skins locally on the device. These local files remain on the device unless the user exports or otherwise shares them, or the same information is transmitted as part of gameplay as described above.
• Reports and feedback: if you submit a player report, complaint, bug report or suggestion, Sfermish stores the category and message you submit. Player reports may also store the reported nickname, the room identifier, your in-game nickname when you are currently playing, and a copy of the reported player's skin when that player can be identified in the same room. The in-game report record does not add your IP address or a device fingerprint.

3. Why data is used

Data is used to provide the multiplayer service requested by the user, display the game state and Highscore, maintain security and reliability, prevent abuse, diagnose failures, understand aggregate service usage such as the number and general duration of sessions,.

4. Advertising status

The current Sfermish browser release and Android app (version 1.1.2 and later) are provided without advertisements. They do not request advertising via Google AdSense or Google AdMob. The current Android app does not include the Google Mobile Ads SDK. Older versions, if still installed, may have used different advertising components; please update to the latest version.

5. Recipients and infrastructure

Sfermish uses third-party hosting infrastructure to provide the game and website. Hosting providers may process technical connection information, including IP addresses and security logs, to deliver the service, operate the network, maintain security and troubleshoot failures. To request the identity of the current hosting provider, contact privacy@sfermish.io.

6. Retention

• Live gameplay state is primarily transient and is discarded as sessions end, except for information that is intentionally persisted as described below.
• A nickname's best Highscore may remain stored until it is replaced, removed, or no longer needed for the Highscore service.
• Top 10 skin records are limited to current Top 10 entries and are removed when they no longer belong in that archive.
• For Sfermish usage statistics, a connection start time exists only temporarily in server memory while that connection is active. When it ends, only aggregate counters are updated; no individual session record is retained in the analytics file. Aggregate counters may be retained to compare service usage over time.
• Technical logs are retained only for operational, diagnostic and security needs and are rotated/deleted according to server administration settings.
• Reports and feedback may be retained for as long as reasonably needed to investigate abuse, respond to support issues, improve the game and prevent repeated misuse.
• Local browser preferences remain on the user's device until they are changed or browser/site storage is cleared.

7. Contact and support messages

Sfermish no longer invites applications for its Android closed test through the website and has not collected application email addresses through that invitation. If you voluntarily email support@sfermish.io or privacy@sfermish.io, the sender address, message and ordinary mail metadata are processed to answer the request, investigate technical or player-safety reports, and handle data-protection requests. Existing Google Play testers may also contact support to request removal from the test. Such messages are not used for newsletters or advertising; they are kept only as long as reasonably necessary for the purpose, subject to legal obligations and any provider backups. Mail forwarding and the receiving email provider may process technical metadata as described in their own policies.

8. Visibility to other players

Nicknames, scores and in-game skins are designed to be visible to other players. Do not use a nickname or skin that reveals information you do not want to make public.

9. Your rights

Where the GDPR applies, you may have rights including access, rectification, erasure, restriction, objection, data portability where applicable, and withdrawal of consent at any time without affecting earlier lawful processing. You may also lodge a complaint with the competent data protection authority.

For a request concerning an in-game record, include the nickname and enough context to identify the record. Because Sfermish does not require an account or identity document, additional information may be needed to avoid deleting another player's data by mistake.

10. Children

Sfermish does not require a real name, date of birth, email address or account to play. The service is not intended to solicit sensitive personal data from children. A parent or guardian can contact the privacy address above regarding a child's data.

11. Changes

This policy may be updated when the game, hosting or data-processing setup changes. The date at the top of this page identifies the current version.