How to read this draft. Written for parents and guardians, to be published next to the Wampus Privacy Policy (privacy-policy.md). [CAPITALISED BLANKS] are facts still to be filled in; [ATTORNEY: ...] notes give our proposed choice, the alternative and why it matters; delete every note before publishing. Section 11 describes a feature that is not built; it is here so the attorney can say what the finished design must do.

Wampus Children's Privacy Notice (for parents and guardians)

Effective [EFFECTIVE DATE]

1. About this notice

1.1 Wampus Studios LLC, doing business as "Wampus" ("we", "us"), makes Chaos Champs, a free-to-play online 3v3 action game for iPhone and Android that can also be played on arcade cabinets at venues that host them. Future Wampus games (Space Race is next) will use the same account system and the same rules for children.

1.2 This notice explains how we treat players who tell us they are under 16. We call them Young Players. It covers children under 13 in particular (section 10). It adds to our Privacy Policy [LINK]; where the two differ for a Young Player, this notice applies.

1.3 Contact for parents: yo@wampus.games · Wampus Studios LLC, 1734 E El Paso St. Ste 190, Fort Worth, TX 76102.

2. How we ask a player's age

2.1 The first time the app opens, it asks for the player's birth month and year. The question is neutral: nothing is pre-selected and it does not say which answers unlock what.

2.2 We keep only the age group the answer falls in (under 13, 13-15, or 16 and over) and the date it was given. We do not keep the month or year. The age group moves up over time (for example, a player who was 13-15 becomes 16 and over three years later, never earlier).

2.3 The answer is locked for that installation of the app: it cannot be changed in the game, and deleting the account and starting again on the same device starts with the same answer. If more than one age is ever given on one install, the youngest one counts. Our support team can move a player to a younger group if a parent asks, but never to an older one.

2.4 Shared devices. Because the answer is kept per device, a younger child's answer also applies to a new guest account an adult starts on the same device. An adult who already has a Wampus ID can still sign in to it.

[ATTORNEY: Is a self-declared, neutral age screen, locked per install, enough age screening for a mixed-audience game (lawyer question 4)? The alternative is relying on the app stores' age signals (section 11) as the main source, with our screen as a fallback.]

3. What a Young Player can and cannot do

Before choosing a name, every player sees our Terms of Service and this policy with an I AGREE button. Young Players see the words "Read our rules with a parent or guardian. They need to agree to them too." [ATTORNEY: there is no separate parent confirmation; is this enough for 13-15 and for under-13s (lawyer question 37)?]

4. What we collect from a Young Player

4.1 To run the game for a Young Player, we collect and keep:

• a random account ID and an 8-character player tag shown to other players;
• a device key and an install ID: random values kept in the device's secure storage; we keep only scrambled (hashed) versions of them;
• the age group and the date it was given;
• which version of our terms was accepted, and when;
• the generated player name and past names;
• match results and stats: matches, wins, losses, crowns, results per mode and per champ, the last 25 match results, and the difficulty level of computer-controlled players for that player;
• skins owned and the store's purchase records (transaction IDs, item, price, dates, refunds);
• reports and blocks the player makes, and reports made about the player;
• cabinet sign-ins (venue, cabinet position, time; not stored after the 2-hour seat ends);
• the device's IP address, used only in our servers' memory to limit abuse.

4.2 We do not collect from a Young Player: an email address, real name, phone number, postal address, birth date, location, photos, voice, contacts or advertising identifiers. The game has no chat, so a Young Player cannot send messages to other players. The only text a Young Player sends us is the reason chosen from a list when making a report.

5. How we use a Young Player's information

Only to run the game: keep the account and its devices signed in; save progress, stats and skins; match players and set how hard computer-controlled players play; deliver and restore purchases; keep matches fair and safe; review reports; apply the protections in this notice; and meet legal duties. We do not use it for advertising, do not sell it or share it for advertising, do not build marketing profiles, and do not make personalised offers to Young Players.

6. What other people can see

• Other players in a match see the generated name, the champ and skin, and how the player plays in that match.
• Anyone who has the player's tag can see the public profile: name, number of matches, wins, crowns and most-played champ. It never shows age, account details or match history.
• At a cabinet, people nearby see the player's name and skins on screen.

[ATTORNEY: we propose [KEEP / HIDE] public profiles for Young Players (lawyer question 28). Hiding them is the more protective choice; the names are generated, so the profile carries no personal details, but it does tie a child's play record to a tag anyone can look up.]

7. Purchases

7.1 Skins are cosmetic only: they change how a champ looks and give no advantage. There are no loot boxes, no random items and no in-game currency. Prices come from Apple or Google, and payment is always handled by Apple or Google; we never see card details.

7.2 Young Players can buy skins. Before a purchase, the shop shows: "Ask a parent or guardian before you buy. Your store may ask them to approve it." Parents can require approval for every purchase with Apple's Ask to Buy (Family Sharing) or Google's Family Link / Google Play purchase approvals. Refunds are handled by Apple or Google under their rules; when a purchase is refunded, we remove the skin.

7.3 Skins are lost if the account is deleted.

[ATTORNEY: is the "ask a parent" message plus the stores' parental controls enough, under the FTC's approach in FTC v. Epic, COPPA and Texas law (SB 2420 parental consent for minors' purchases; HB 18 section 509.052 bars purchases by known minors under 18 without a verified parent, if HB 18 applies to us)? The alternative is turning purchases off for under-13s or for all Young Players (lawyer question 27).]

8. Computer-controlled players

To keep matches full, matches may include computer-controlled players with player-style names. They are not labelled as computers. They never contact a child (there is no chat or friends system) and wear only free skins. Their difficulty is set from the player's own recent results. [ATTORNEY: is this disclosure enough with children playing (lawyer questions 13, 23)?]

9. Arcade cabinets

A Young Player can sign in at a cabinet by scanning its QR code with the app. The cabinet then shows the player's name and skins for one seat, for at most 2 hours, and the matches count toward the player's stats. No account can be created at a cabinet, and nothing is sold there. The venue's cabinet system receives the player's name, tag and skins for that seat only.

10. Children under 13 (COPPA)

10.1 Our position. Children under 13 play as guests, with every Young Player protection above. We collect no personal information from them beyond what the game needs to run: the random account ID, device key and install ID (persistent identifiers), the age group, a generated name, stats, purchase records, reports and blocks. We use these persistent identifiers only to support the internal operations of the game: to keep the child signed in, save progress, run and secure matches, deliver purchases, and protect the game against fraud and abuse. We do not use them to contact a child, for advertising, or to build a profile for any other purpose. We never ask a child under 13 for an email address, a real name or any other contact information.

10.2 For that reason we do not ask parents for verifiable parental consent today. If we ever offer accounts with more features to children under 13, we will first get a parent's verifiable consent in a way the law accepts, and update this notice.

10.3 If we learn that we have collected personal information from a child under 13 in a way the law does not allow, we will delete it.

[ATTORNEY: this is our proposal and the main question for you (lawyer question 6). It rests on COPPA's "support for the internal operations" exception for persistent identifiers. Points to test: (a) whether the game is "directed to children" (cartoon combat, family arcades) or a mixed-audience service that may age-screen; (b) whether stats tied to an ID, the public profile, the adaptive bot level and purchase records go beyond internal operations or count as "amassing a profile"; (c) whether the generated name is personal information (we believe not: it is picked from our list); (d) whether a report a child files is a "collection". The alternative is verifiable parental consent through a consent service (for example Epic's Kids Web Services) before a child under 13 can use some or all features.]

11. App-store age signals (Texas SB 2420 and similar laws): NOT BUILT YET

11.1 What the law asks. Texas's App Store Accountability Act (SB 2420, effective 2026-01-01) requires app stores to verify users' age categories and get a parent's consent for minors' downloads and purchases, and requires app developers to: give an age rating to the app and to each in-app purchase; use the store's information to check each user's age category and whether a parent has consented; tell the store about significant changes (new data uses, rating changes, new ways of charging, major feature changes) so the store can ask the parent again; use the store's age information only to enforce age limits, comply with law and set safety defaults; and delete that information once the check is done. A federal court blocked the law in December 2025; the Fifth Circuit stayed that order on 2026-05-28 and 2026-06-04, so the law is currently enforceable while the appeal continues. Utah, Louisiana and Alabama have similar laws starting in 2027.

11.2 What we have today. Our own age screen (section 2). We have not yet connected Apple's Declared Age Range feature or Google's Play Age Signals, which are how the stores share age categories and parental consent with apps.

11.3 How we propose to plug them in (for the attorney to approve before it is built):

1. When the store provides an age category, it sets the player's age group; if our own screen gave a younger answer, the younger one wins. Our screen stays as the fallback where no store signal exists.
2. We keep only the age group and the date, as today, and discard the rest of the store's answer once the check is done.
3. The store's categories are under 13, 13-15, 16-17 and 18 and over. We would add a 16-17 group, because Texas treats 16- and 17-year-olds as minors while our current rules treat them like adults (Wampus ID, typed names).
4. If the store says a parent has not consented, or a parent withdraws consent, the app would [PROPOSAL: stop purchases and online play for that account on that device until consent is given].
5. Every skin gets the same age rating as the app (our draft: 13+ on Apple, ESRB Everyone 10+ on Google), because skins add no new kind of content.
6. We tell both stores about significant changes before they ship.

[ATTORNEY: please confirm the developer duties and these six choices (lawyer question 10), and whether our own age screen alone is lawful in the meantime for Texas users.]

12. Texas SCOPE Act (HB 18)

[ATTORNEY: this whole section is for you; we propose no player-facing text until you rule. HB 18 (Business & Commerce Code chapter 509, in effect 2024-09-01) applies to digital services that let users socially interact, create a public or semi-public profile, and post content others can see; a "known minor" is under 18. Points: (a) Wampus is likely a "small business" under the SBA definition, which the chapter exempts; (b) whether a game with no chat, generated names for Young Players and a public stats profile is covered at all; (c) if covered: section 509.051 requires an age to be registered before an account is created (our guest account is created a moment before the age question), 509.052 limits data use and bars purchases by known minors without a verified parent, and 509.054 requires parental tools; (d) large parts of the act have been enjoined in CCIA v. Paxton and SEAT v. Paxton, and the Fifth Circuit granted Texas a rehearing on 2026-10-28, so the status may change.]

13. Your rights as a parent

13.1 You can ask us to show you the information we hold about your child, to delete it, and to stop collecting or using it. Because a guest account has no email address, stopping collection means deleting the account.

13.2 The quickest way to delete is in the game, on your child's device: title screen → profile card → DELETE ACCOUNT → DELETE, then tap again. A Young Player's account is a guest account, so it is deleted straight away. What we keep afterwards is listed in section 14.

13.3 To ask us instead, email yo@wampus.games with "Parent request" in the subject, your child's player tag (shown on the profile screen) and what you want us to do. Because we do not know who owns a guest account, we will ask you to show that you have the child's device, for example with a screenshot of the profile screen, before we share or delete anything. We answer within [10 BUSINESS DAYS]. [ATTORNEY: is this verification method reasonable for a guest account with no email? Is our proposed response time right?]

13.4 Parents can also use the stores' tools: Apple's Screen Time and Ask to Buy, and Google's Family Link, to control purchases and screen time.

14. How long we keep a child's information (our retention policy)

COPPA requires us to say why we collect children's information, why we need to keep it, and when we delete it. For every item in section 4 the details are in our Data Retention Schedule [LINK]. In short:

15. Who receives a child's information

Only our service providers, under contracts that limit their use (hosting, backup storage, and RevenueCat for purchase records), Apple or Google for purchases, and the venue's cabinet system for a cabinet seat. Young Players never give us an email address, so our email delivery provider receives nothing about them. We do not sell children's information or share it for advertising. Details: Privacy Policy section 8 [LINK].

16. Security

We keep children's information safe with encrypted connections, scrambled (hashed) storage of keys and codes, the device's secure storage, logs that do not record personal information, and limited staff access, under a written information security program [TO BE ADOPTED BEFORE LAUNCH].

17. Changes and contact

If we change this notice in a way that affects what we collect from children or how we use it, we will update it before the change takes effect and, where the law requires, get a parent's consent first. Questions: yo@wampus.games · Wampus Studios LLC, 1734 E El Paso St. Ste 190, Fort Worth, TX 76102.