How to read this draft. Everything outside the bracketed notes is written to be published as-is once the attorney approves it. [CAPITALISED BLANKS] are facts still to be filled in. [ATTORNEY: ...] notes give our proposed choice, the alternative and why it matters; delete every note before publishing. The facts come from the code and service contracts listed in the Drafting notes at the end. Companion drafts: childrens-privacy-notice.md and data-retention-schedule.md (same folder); the Terms of Service and Community Guidelines are drafted separately.

Wampus Privacy Policy

Effective [EFFECTIVE DATE] · Last updated [EFFECTIVE DATE]

1. Who we are and what this policy covers

1.1 Wampus Studios LLC, a Texas limited liability company doing business as "Wampus" ("Wampus", "we", "us"), makes games. Our address is 1734 E El Paso St. Ste 190, Fort Worth, TX 76102, and you can reach us at yo@wampus.games.

1.2 This policy explains what information we collect, why, who helps us handle it, how long we keep it, and the choices you have. It covers:

• Chaos Champs, our free-to-play online 3v3 action game, in its iPhone and Android apps;
• Chaos Champs on arcade cabinets at venues that host our cabinets, when you sign in there with the app;
• Wampus ID, the account shared by our games, and the account page at https://account.wampus.games;
• our website https://wampus.games and any web version of our games we run there; and
• future Wampus games that link to this policy (Space Race is next). If a new game collects something not listed here, we will update this policy before that game launches.

[ATTORNEY: We propose one company-wide policy for every Wampus game, with each game linking to it. The alternative is one policy per game. One policy is simpler for players and keeps the shared Wampus ID in one place, but every new game's data must be added here before its launch.]

1.3 Some words we use: a guest is an account the app makes for you automatically on your device. A Wampus ID is an optional account that uses your email address, so you can keep your progress on more than one device. A Young Player is a player who tells us they are under 16. Champs are the characters you play. Crowns are the ranking points you earn in matches. Skins are cosmetic looks for champs.

2. The short version

• You can play without giving us your name or email address. Everyone starts as a guest.
• We do not show ads. We do not sell your information or share it for advertising. We do not track you across other companies' apps or websites. Our app contains no advertising, analytics or crash-reporting software.
• We do not ask for your real name, phone number, home address, precise location, contacts, photos, camera or microphone, and we never see your payment card.
• We do not keep your email address in a form we can read, and we do not keep your birth month or year.
• Young Players (under 16) play as guests, choose from names we generate, and cannot create a Wampus ID.
• Matches can include computer-controlled players. Their difficulty is set from your recent results.
• You can delete your account in the game or at https://account.wampus.games/delete.

3. What we collect and why

3.1 Information we collect from you or your device. The table lists everything the app sends to us and keeps. "Until your account is deleted" means until the deletion described in section 12 runs. Exact periods for every item are in our Data Retention Schedule [LINK].

3.2 Information stored only on your device. The app keeps some things on your device and does not send them to us unless listed above: your device key and install ID (in secure storage); a copy of your account details and the skins you own, so the game starts quickly and works offline; which version of the terms you accepted; your chosen skins; and controller settings. On iPhone, the secure storage (Keychain) is kept by iOS when you delete the app and can move to a new iPhone in an encrypted backup, so your guest account can come back if you reinstall. On Android, it is not included in device backups. [ATTORNEY: is this disclosure enough? See lawyer question 34.]

3.3 Information from Apple, Google and RevenueCat. When you buy a skin, Apple or Google tells RevenueCat (our purchase service provider, section 8) and RevenueCat tells us about the purchase, refunds and cancellations. We keep only the purchase details listed in 3.1. We do not keep any other information RevenueCat sends us.

3.4 Information from venues. Cabinets are run by the venues that host them. When you sign in at a cabinet, the venue's cabinet system asks our service for a sign-in code to show as a QR code, and we tell it your player name, tag and skins for that seat (section 8).

4. What we do not collect

We do not ask for or keep: your real name, phone number, postal address, birth date, precise or approximate location (your currency comes from the app store, not from your IP address), contacts, photos, camera, microphone, payment card details, advertising identifiers (such as Apple's IDFA or Google's advertising ID), or information about the other apps and websites you use. There is no text or voice chat in Chaos Champs.

5. How we use information

We use information only to:

• run the games, your account and your devices' sign-in;
• deliver, restore and refund purchases, and keep business and tax records;
• match you with other players and computer-controlled players, and set how hard computer-controlled players play against you from your recent results;
• show your stats, your public profile and your name at cabinets;
• keep matches fair, prevent cheating, fraud and abuse, and protect the security of our services;
• moderate names and review reports;
• answer support requests and privacy requests;
• give Young Players the protections in section 10; and
• meet our legal duties and enforce our Terms of Service.

We do not use your information for advertising, we do not make personalised offers to Young Players, and we do not make decisions about you that have legal or similarly significant effects based only on automated processing.

Computer-controlled players. To keep matches full, a match may include computer-controlled players that have player-style names and play like people. They do not collect any information from you. Their difficulty is set from your own recent results, as described above. [ATTORNEY: our proposal is this plain disclosure here and in the Terms; bots carry no BOT label; see the Terms pack and lawyer questions 13 and 23.]

6. Legal bases (players in places that require them)

We are launching in [LAUNCH REGIONS]. Where a law (such as the GDPR in the European Economic Area or the UK GDPR) asks us to name a legal basis, we rely on: performing our contract with you (running the game, your account, purchases and stats); our legitimate interests in keeping our games fair, safe and secure, moderating names and reports, keeping backups, and improving how computer-controlled players match your skill, balanced against your rights; and legal obligations (tax records, answering lawful requests). We do not rely on consent for anything today; if we ever do, you can withdraw it at any time.

[ATTORNEY: our proposal is a US-only launch first, in which case this section shrinks to one sentence or is removed. If the EEA or UK are included, the policy must add: the rights to object, restrict and port; the right to complain to a supervisory authority; an EU / UK representative; transfer safeguards (section 14); and the age of digital consent by country, which may be above or below our line of 16.]

7. What other players and venues can see

• Other players in a match see your player name, your champ and its skin, and how you play in that match. If your name is hidden after reports, they see a generic name.
• Anyone with your player tag can see your public profile (section 3.1).
• At a cabinet, people near the cabinet can see your player name and skins on screen.
• Players you have blocked see you as normal; you see them with a generic name. A blocked player is never told.

8. Who we share information with

8.1 We do not sell personal information, and we do not "share" it for cross-context behavioural (targeted) advertising, as those terms are used in US state privacy laws. We have not done so in the past 12 months.

8.2 Service providers. These companies process information for us, under contracts that limit how they may use it:

[ATTORNEY: COPPA's amended rule requires written assurances from service providers that handle children's information; we propose a data processing addendum with each provider above before launch.]

8.3 Apple and Google. Apple (App Store) and Google (Google Play) handle downloads, payments, refunds, family purchase approvals (such as Apple's Ask to Buy and Google's Family Link) and, where a law requires it, age signals. They act under their own privacy policies, not ours.

8.4 Venues that host our cabinets. When you sign in at a cabinet, the venue's cabinet system receives your player name, tag and the skins you own, for that seat, for at most 2 hours. [ATTORNEY: we propose treating venues as service providers under a written agreement that limits their use to running the seat; the alternative is treating them as third parties, which needs its own disclosure.]

8.5 Other Wampus games. Your Wampus ID, player tag and stats are shared across our own games so that one account works in all of them. This is use within Wampus, not a disclosure to another company.

8.6 Legal and safety reasons. We may disclose information if the law requires it, to respond to valid legal process, to protect the safety of players or others, to investigate fraud or abuse, or to protect our rights.

8.7 If our business changes hands. If Wampus is involved in a merger, acquisition or sale of assets, information may pass to the new owner, who must keep honouring this policy for the information it receives, or give you notice and a choice first.

9. How long we keep information

We keep information only as long as we need it for the reasons in section 5, and then delete it. The periods are in the table in section 3.1 and, item by item, in our Data Retention Schedule [LINK], which also explains how each item is deleted.

10. Young Players and children

10.1 Young Players. If you tell us you are under 16, you are a Young Player. Young Players:

• play as guests; they cannot create a Wampus ID, so we never receive their email address;
• choose from player names we generate; they cannot type a name;
• never get personalised offers; and
• can buy skins. The shop tells them to ask a parent or guardian first, and Apple's Ask to Buy or Google's Family Link can require a parent's approval.

[ATTORNEY: 16 is our proposed line everywhere; whether any launch region needs a different age; and whether purchases by Young Players with only an "ask a parent" note are enough (lawyer question 27). Note also that Texas law treats everyone under 18 as a minor for app-store purposes: see the Children's Privacy Notice.]

10.2 Children under 13. Children under 13 play as guests with the Young Player protections above. We collect no personal information from them beyond what the game needs to run: a random account ID, the device key and install ID, their age group, a generated name, their stats and purchases, and any reports or blocks they make. We do not collect their email address, real name or location. [ATTORNEY: this is our proposed COPPA position: that these identifiers are used only to support the internal operations of the game. The alternative is collecting verifiable parental consent; you decide.]

10.3 Parents. Our Children's Privacy Notice [LINK] explains, for parents, what a Young Player can do, what we collect, and how to review or delete a child's information. Parents can write to yo@wampus.games. If we learn we have collected personal information from a child under 13 in a way the law does not allow, we will delete it.

11. Your choices and rights

11.1 What you can do yourself.

• See your name, tag, stats and skins in the game's profile, and your name, tag and deletion status on the account page (Wampus ID only).
• Change your name: players 16 and over may type a new name once every 7 days; Young Players choose a new generated name.
• Block and unblock players from the game.
• Sign out your other devices from your Wampus ID.
• Delete your account (section 12).

11.2 Your privacy rights. Depending on where you live, you may have the right to: know what personal information we have about you and how we use it; get a copy of it, in a portable form where the law gives that right; correct it; delete it; opt out of its sale, of its use for targeted advertising, and of profiling that has legal or similarly significant effects (we do none of these); and not be treated differently for using these rights. Texas residents have these rights under the Texas Data Privacy and Security Act where it applies, and residents of California and other states have similar rights under their laws. We will honour these requests from every player, wherever they live. [ATTORNEY: our proposal is to offer these rights to everyone; we believe Wampus is below the CCPA thresholds and is a "small business" under the Texas act, so those laws may not apply to us yet; please confirm which state laws apply and whether a voluntary offer creates obligations we should avoid.]

11.3 How to make a request. Email yo@wampus.games with your player tag and what you are asking for. To protect your account, we have to confirm the request comes from the account's owner:

• for a Wampus ID, we will ask you to sign in or to confirm a code we send to your Wampus ID email address;
• for a guest account, we cannot email you, so we will ask for your player tag and for proof that you control the device, such as a screenshot of your profile, and we may ask you to make a deletion request in the game instead. We answer within 45 days, and will tell you if we need up to 45 more days. An authorised agent may make a request for you with your signed permission; we may still ask you to confirm your identity. A parent or guardian can make requests for a child (section 10.3). [ATTORNEY: no "download my data" button exists; access requests are answered by hand. Is the guest verification method above reasonable? 45 days is the period in both the Texas and California laws.]

11.4 Appeals. If we turn down your request, you can appeal by replying to our answer or by emailing yo@wampus.games with "Appeal" in the subject. We will answer within 60 days. If we turn down the appeal, you can complain to your state's attorney general (in Texas: https://www.texasattorneygeneral.gov/consumer-protection).

12. Deleting your account

12.1 How. In the game: title screen → your profile card → DELETE ACCOUNT → DELETE, then tap again to confirm. On the web: https://account.wampus.games/delete, sign in with your Wampus ID (we email you a code), then delete. Guest accounts have no email, so they are deleted in the game. A banned Wampus ID can still sign in to the account page to delete itself. If you cannot use either way, write to yo@wampus.games. [ATTORNEY: older drafts (lawyer question 32, STORE-READINESS G1) say a banned account cannot sign in on the web page; the current service contracts (platform/accounts/README.md "Account web page", platform/web/README.md) and their tests let it sign in there to delete. This draft follows the code.]

12.2 When.

• A guest account is deleted straight away.
• A Wampus ID account is signed out on every device and deleted after 30 days. Signing in again in the game during those 30 days cancels the deletion, and so does choosing "cancel the deletion" on a device it signed out, or on the account page.
• A guest account that never answered the age question and has not been used for 90 days is deleted automatically.

12.3 What is deleted. Your account, name history, stats and match history, public profile, blocks, owned skins and terms acceptance. You lose your progress and the skins you bought. Refunds follow Apple's and Google's rules.

12.4 What we keep after deletion.

• A record that your account ID existed and the date it was deleted (section 3.1).
• Purchase transaction records without your account ID, for [N YEARS], for tax, refund and chargeback records. RevenueCat, Apple and Google keep their own purchase records under their own policies. [ATTORNEY: we can ask RevenueCat to delete its customer record when an account is deleted; this is built but switched off; we propose [ON / OFF].]
• Reports you made, without anything that points back to you; reports about you, and our moderation records.
• If your account was banned: the scrambled form of your email address, for 365 days.
• For a guest: the separate install record described in section 3.1.
• Backup copies, until they are replaced: up to 7 days on our server and up to [30] days off-site.

13. Security

We protect information with measures that fit how sensitive it is, including: encrypted connections (TLS) between the app and our servers; storing device keys, sign-in codes and email addresses only in scrambled (hashed) form; keeping your device key in your device's secure storage; logs that do not record email addresses, codes, keys, account IDs or IP addresses; limiting staff access to the tools they need; and regular backups. We maintain a written information security program [TO BE ADOPTED BEFORE LAUNCH]. No system is perfectly secure. If a breach affects your information, we will tell you and the authorities as the law requires.

[ATTORNEY: COPPA's amended rule (compliance date 2026-04-22) requires a written information security program with a named coordinator, at least annual risk assessments and tested safeguards, and a written data retention policy published in the children's notice. We propose adopting both before launch; templates requested (lawyer question 11).]

14. Where information is stored

Our servers are in the United States [CONFIRM: Dallas, Texas, for the online game servers; region for the account services when the host is chosen]. If you play from outside the United States, your information is transferred to and handled in the United States, whose laws may differ from those where you live. [ATTORNEY: if the EEA or UK are launch regions, name the transfer mechanism here (for example the EU-US Data Privacy Framework or standard contractual clauses).]

15. Changes to this policy

We may update this policy. We will change the "Last updated" date above. For important changes, we will tell you in the game before they take effect, and where the law requires it we will ask you to agree again (the I AGREE step). If a change would let us use information we already have in a materially different way, we will ask for your consent first where the law requires it.

16. Contact us

Wampus Studios LLC (Wampus) · 1734 E El Paso St. Ste 190, Fort Worth, TX 76102 · yo@wampus.games (privacy and support) · https://wampus.games