Privacy Policy
Last updated: 2026-10-08
Mossgrove Isles ("the game") is operated by Tzoof Hassidoff ("we", "us"). This policy explains what personal data we process when you play, why, and the choices you have. Contact: tzoof.support@gmail.com.
1. What we collect
| Data | Source | Why |
|---|---|---|
| Google account ID, name, email address, profile-picture URL | Google sign-in (only if you choose "Continue with Google") | Create and secure your account, show your name to other players |
| Player name and public handle | Generated at sign-up; you may set your name once | Identify you in game, let friends find you |
| Characters and game progress | Your gameplay | Save your progress between sessions |
| Friends, friend requests, block list, online status | Your actions in the Friends panel | Social features |
| Chat messages and in-room position | Your gameplay | Relayed live to players in the same room; not stored by us |
| Technical logs (IP address, browser, request time) | Automatically, by our hosting provider | Security, abuse prevention and debugging |
Guest play stores progress only in your own browser and sends us no account data. We do not use analytics, advertising or tracking pixels, and we do not sell or share your data for advertising.
2. Cookies and browser storage
We do not use advertising or analytics cookies. The game stores strictly necessary data in your browser's local storage and IndexedDB: your sign-in session (managed by Firebase Authentication), a cached copy of your profile, guest saves, and a short-lived lock that prevents the same character being opened in two tabs. Because this storage is essential for the game to work, no consent banner is shown. You can clear it at any time from your browser settings, which signs you out and removes guest saves.
3. What other players can see
Other players can see your player name, handle, character, and online status, and can read chat messages you send in a room. Until you set your own name, your player name is taken from your Google account. Your email address is never shown to other players.
4. Service providers
- Google Firebase Authentication (Google LLC): sign-in and account security.
- Upstash (Redis database): stores profiles, saves and friends data, and relays chat between players.
- Vercel: website hosting and request logs.
These providers process data on our behalf and may store it outside Israel, including in the United States and the EU, under their own security and data-protection commitments.
5. How long we keep data
Account, save and friends data is kept until you delete your account. Online status expires after about one minute. Chat is not stored. Hosting logs are kept according to the hosting provider's retention period.
6. Your rights
Under the Israeli Protection of Privacy Law and, where applicable, the EU GDPR, you may ask to access, correct or delete your personal data, or object to its processing.
- Delete your account yourself: sign in, open the character-select screen and choose "Delete account". This permanently erases your profile, characters, friends data and sign-in record.
- Any other request: email tzoof.support@gmail.com. We will reply within 30 days.
You may also complain to the Israeli Privacy Protection Authority or your local data-protection authority.
7. Children
The game is not directed at children under 13, and Google sign-in requires an eligible Google account. If you believe a child has given us personal data, contact us and we will delete it.
8. Security
Traffic is encrypted with HTTPS. Sign-in tokens are verified on our servers, and access to the database is restricted. No system is perfectly secure, so please contact us if you notice a problem.
9. Changes
If we change this policy, we will update the date above. If the changes are significant, we will also tell you in the game.