Privacy Policy

Last updated: 9 October 2026

This Privacy Policy explains how personal data is processed when you use Fluffy Pets, the mobile game available on Google Play (package ID com.fluffypetsgame.com), its online features (account, cloud save, friends) and the website fluffypetsgame.com. It is written to meet the requirements of the EU General Data Protection Regulation (GDPR).

In short

You can play without an account. Your progress then stays on your phone and is not sent to us.
If you create an account, we store your e-mail address, nickname and game save, so that you can keep your progress, play on a new phone and add friends.
We do not sell your data and we do not send marketing e-mails.
Payments are handled by Google Play. We never see your card details.
Rewarded ads are always optional. In the EEA, the UK and Switzerland, personalised ads are shown only with your consent.
You can export or delete your data at any time, in the game or on our website.

1. Who is responsible for your data

The controller of your personal data is a natural person conducting unregistered business activity:

FastRabbitOn
Kacper Kwiek
Zielarska 96
62-064 Plewiska
Poland
E-mail: contact@fluffypetsgame.com

We have not appointed a Data Protection Officer. Please send any privacy questions or requests to the e-mail address above.

2. Playing without an account

Your pet, items, progress and settings are saved only on your device. We do not receive them.
The game does not contain analytics or tracking tools of its own.
If you watch a rewarded ad or make a purchase, the providers described in sections 6 and 7 process the data needed for that.

3. Data we process when you have an account

Data	Why we use it	Legal basis	How long we keep it
Account data: e-mail address, password (stored only as a salted hash, never in readable form), nickname, friend code, game language, time of last activity and a random installation identifier created by the game (not a hardware identifier). If you sign in with Google: your Google account identifier and e-mail address.	Creating and running your account, signing in, password reset, service e-mails.	Performance of the contract (Art. 6(1)(b) GDPR).	Until you delete your account.
Cloud save: the full state of your game (your pet's name and appearance, level, coins, Gems, items, rooms, quests and settings) and up to 10 automatic backups of it.	Keeping your progress safe, restoring it on a new phone and recovering from errors.	Art. 6(1)(b) GDPR.	Until you delete your account. Backups are replaced on a rolling basis.
Friends and visits: your friends list, friend requests, QR friend invitations (stored only as a cryptographic hash), visit settings, visit requests, and gifts and interactions between friends.	Friends, home visits and gifts.	Art. 6(1)(b) GDPR.	Friends: until either of you removes the other or deletes the account. QR invitations are valid for 10 minutes and are deleted within a few hours. Visit requests expire after 3 days. Gifts waiting in your inbox: up to 60 days. The log of interactions between friends: 30 days.
Purchases: the product, the Google Play order number, the purchase token, the status and date of the purchase.	Verifying and delivering purchases, restoring them on another device, handling refunds and preventing fraud; keeping records required by law.	Art. 6(1)(b) GDPR; Art. 6(1)(c) GDPR (tax and accounting obligations); Art. 6(1)(f) GDPR (preventing fraud).	As long as tax and accounting law requires (generally 5 years from the end of the calendar year of the purchase) and until any related claims are time-barred. These records are kept after account deletion, without your e-mail address or nickname.
Rewarded ads: when a signed-in player watches a rewarded ad, Google AdMob confirms it to our server: transaction ID, ad unit, reward and date.	Granting rewards once, daily limits, preventing abuse.	Art. 6(1)(b) and (f) GDPR.	30 days.
Security and technical logs: IP address, information sent by the app (platform, app version, user agent, installation identifier), the e-mail address used to sign in, and the time, type and result of requests. Sign-in sessions (stored only as hashes, with the installation identifier and IP address).	Keeping accounts and the service secure, preventing abuse (for example password guessing, cheating and fraud) and fixing errors.	Our legitimate interest in a secure and fair service (Art. 6(1)(f) GDPR).	Logs: 180 days. Sessions: up to 60 days after the last use, plus 7 days. Failed sign-in counters: about 15 minutes, in memory only.
Fair-play checks: the server compares new saves with earlier ones to detect impossible changes (for example edited game files).	Keeping the game fair for all players.	Art. 6(1)(f) GDPR.	Together with the cloud save.
Correspondence: your e-mail address and the content of your message.	Answering your questions, complaints and requests.	Art. 6(1)(b) or (f) GDPR.	As long as needed to handle the matter and any related claims.

We send only service e-mails: password reset links, account deletion confirmations, data exports and the confirmation that an account has been deleted. We do not send newsletters or marketing.

4. What other players can see

Players who are your friends can see your nickname, your friend code, your pet (its name, species, appearance and level) and your home, according to your visit settings. When you give someone your friend code or show them your QR code, they can send you a friend request or become your friend. Other players never see your e-mail address.

5. Device permissions

Camera is used only to scan a friend's QR code. The picture is analysed on your device in real time and is never saved or sent to us. You can refuse or withdraw this permission in your device settings and still add friends with a friend code.
Internet is needed for online features, purchases and ads.

6. Purchases through Google Play

In-app purchases are processed by Google Play under Google's own terms and privacy policy. Google acts as an independent controller of your payment data. We do not receive your payment card details or billing address, only the purchase information listed in section 3.

7. Advertising (Google AdMob)

The game offers optional rewarded ads: you decide whether to watch an ad in exchange for an in-game reward. The ads are provided by Google AdMob (Google Ireland Limited and Google LLC). To show ads, measure them and prevent fraud, Google may collect your device's advertising ID, IP address, device and app information and information about your interactions with ads. Google's use of this data is described at How Google uses information from sites or apps that use its services.

In the EEA, the UK and Switzerland, the game asks for your consent through Google's consent form before Google may use your data for personalised ads (Art. 6(1)(a) GDPR). You can change your choice at any time in the game settings.
If you do not consent, Google may show non-personalised or limited ads, which still use some data, for example to limit how often an ad is shown and to detect fraud.
You can reset or delete your advertising ID in your Android settings.
If you are below the age at which you can give consent yourself in your country (in the EU, between 13 and 16; in Poland, 16), please involve a parent or guardian before agreeing to personalised ads.

8. Sign in with Google

If you choose to sign in with Google, Google shares your Google account identifier and e-mail address with us. We use them only to sign you in. We never receive your Google password.

9. Who receives your data

Hetzner Online GmbH (Germany), as our processor, which hosts our server, database and website.
Mailjet (Sinch Mailjet SAS, France), as our processor, to deliver service e-mails.
Google: Google Play (distribution, payments and refunds), Google Sign-In and Google AdMob, as described above.
Other players, only to the extent described in section 4.
Public authorities, when we are legally required to share data.

We do not sell your personal data and we do not share it for third-party marketing.

10. Transfers outside the European Economic Area

Some providers, in particular Google, may process data outside the EEA, including in the United States. Such transfers are based on an adequacy decision (for example the EU–US Data Privacy Framework, for certified companies) or on the European Commission's Standard Contractual Clauses.

11. This website

This website does not use cookies, analytics or tracking. Fonts and images are served from the website itself. If you choose a language, your choice is stored only in your browser's local storage. Our hosting provider processes technical access data, such as IP addresses, to deliver and protect the website.

12. Age

Fluffy Pets is intended for players aged 13 and over. The game is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe that a child under 13 has created an account, please contact us and we will delete it.

13. Your rights

Under the GDPR you have the right to:

access your data and receive a copy of it;
rectify it (you can change your nickname in the game yourself);
erasure (see section 14);
restrict processing;
data portability: in the game, open Settings → Account → E-mail me my data to receive your account data, save, friends, purchases and inbox as a JSON file;
object to processing based on our legitimate interests;
withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal;
lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl). You can also contact the authority in the EU country where you live or work.

To exercise your rights, write to contact@fluffypetsgame.com. We will answer within one month. In complex cases this can be extended by two more months, and we will tell you if it is. We may ask you to confirm that you control the account, for example by replying from its e-mail address.

14. Deleting your account

In the game: Settings → Account → Delete account.
Without the game: use the form at fluffypetsgame.com/delete-account. We will e-mail you a confirmation link that is valid for one hour.

We delete: your account data, cloud save and backups, friends, invitations, visit settings and requests, gifts and interactions, rewarded-ad records and sign-in sessions.

We keep: purchase records, linked to an anonymised account entry without your e-mail address or nickname (see section 3), and security logs for up to 180 days.

Progress saved on your phone stays there until you uninstall the game or start a new game.

15. Security

Connections to our server are encrypted (HTTPS). Passwords are stored only as salted hashes (PBKDF2). Session, password reset, account deletion and QR invitation tokens are stored only as hashes. Access to data is limited, and sign-in attempts and requests are rate-limited. No system is completely secure, but we work to protect your data and will inform you and the authorities of a data breach where the law requires it.

16. Automated decisions

We do not make decisions that have legal or similarly significant effects on you based solely on automated processing. Automated fair-play checks may reject a save with impossible values. If that happens to you, contact us and a person will review it.

17. Changes to this policy

We will update this policy when the game or the law changes. The date at the top shows the latest version. We will announce significant changes in the game or on this website.

18. Contact

Questions about privacy: contact@fluffypetsgame.com, subject “Privacy”. We answer in English and Polish.