Privacy Policy for Where's Tess¶ ↑

Effective date: August 4, 2026
Last updated: August 4, 2026
Version: 1.1

This Privacy Policy explains how UNDEAD FOX STUDIO DOO, with its business address at Vladimira Rolovica 2, Bar, Montenegro, PIB / Tax ID 03432513 (“Undead Fox,” “we,” “us,” or “our”), processes personal data in connection with the mobile game Where's Tess (the “Game”), its online features, customer support, and the pages on undeadfox.com that link to this Privacy Policy (together, the “Services”).

This notice describes the behavior of the current release of the Game. As described below, some analytics, diagnostic, and advertising services may initialize and collect data automatically when the Game starts. This Privacy Policy provides information about that processing; acceptance of the Terms or continued use of the Game does not by itself constitute consent where applicable law requires a separate consent.

Our Terms of Service are available separately. The canonical URL for this Privacy Policy is undeadfox.com/privacy/.

1. Contact and Data Controller¶ ↑

The controller for Company-operated processing described in this Privacy Policy is:

UNDEAD FOX STUDIO DOO
Vladimira Rolovica 2
Bar, Montenegro
PIB / Tax ID: 03432513
Email: {support@undeadfox.com}[mailto:support@undeadfox.com]
Website: undeadfox.com/

Please use the subject line “Privacy Request” when contacting us about personal data. Do not send us an account password, complete payment-card number, card security code, government identifier, or unrelated sensitive information.

App stores, platform providers, analytics providers, and advertising providers may also process personal data under their own privacy notices. Their roles can vary by service and jurisdiction.

2. Data We Process¶ ↑

The data processed depends on your platform, device settings, country, account status, features used, and the services enabled in the release or advertising-mediation dashboard. We do not necessarily process every category below for every user.

2.1 Account and platform authentication data¶ ↑

When platform sign-in, Firebase authentication, or cloud save is used, we may receive or create:

• a Firebase user ID and internal player, installation, or session identifier;

• a Google Play Games or Apple Game Center identifier;

• a platform display name and email address, if the platform makes them available;

• authentication tokens or authorization codes needed to complete sign-in;

• sign-in status and timestamps; and

• account, synchronization, and authentication errors.

Google, Apple, and Firebase handle the credentials used to authenticate with their services. We do not ask for or receive your Google, Apple, Game Center, or Google Play Games account password.

2.2 Game progress and cloud-save data¶ ↑

The Game processes local and, where cloud save is active, remotely stored save data, including:

• story progress, chapters, scenes, routes, and choices;

• characters, relationships, unlocked content, outfits, gallery items, achievements, and event progress;

• virtual-currency balances and in-game transaction records;

• settings, language, content-download state, and save-file version;

• synchronization status and backup data; and

• integrity information used to identify corrupted or manipulated saves.

Cloud-save data is associated with a pseudonymous account or player identifier and is stored using Firebase services. Some gameplay can be used offline, and available data may synchronize after the device reconnects.

We do not intentionally use fictional story choices to determine a user's real-world health, sexual orientation, religion, political views, or other sensitive characteristics, and we do not intentionally provide a complete save file to advertising partners for ad targeting.

2.3 Purchases and entitlements¶ ↑

Purchases are processed by the relevant app store, such as Google Play or Apple's App Store. The Game, our backend at bundles2.undeadfox.com, and service providers may receive or process:

• product and offer identifiers;

• displayed price, currency, country, or storefront information;

• transaction identifiers, purchase tokens, receipts, and receipt fingerprints;

• purchase, refund, restoration, validation, and entitlement status; and

• fraud, error, analytics, and customer-support information associated with a transaction.

We do not receive or store your complete payment-card number, expiry date, or card security code. The app store independently processes payment credentials under its own privacy notice.

2.4 Device, network, and technical data¶ ↑

The Game, our servers, and SDK providers may process:

• IP address and country or approximate region inferred from it;

• device type, model, operating system, platform, and app version;

• language, time zone, screen or graphics characteristics, and connection type;

• device or build information exposed by platform diagnostic APIs;

• pseudonymous Firebase, user, installation, session, and device identifiers;

• a mobile advertising identifier, such as AAID or IDFA, when the operating system makes it available; and

• request timestamps, server logs, network errors, and SDK errors.

The Game does not request precise GPS location. Providers may infer an approximate location from an IP address.

If you use the Game's save-to-gallery or system-sharing feature, the selected image is passed to your device's gallery or operating-system share sheet at your direction. We do not receive a copy merely because you use that feature.

The Game schedules gameplay notifications locally on the device. The current feature does not read or transmit calendar events and does not require us to receive a push-notification token.

2.5 Gameplay, analytics, and remote-configuration data¶ ↑

Firebase Analytics, Amplitude, Unity services, and related components may automatically process events such as:

• app launches, sessions, screens, and feature interactions;

• chapter, scene, progression, choice, route, relationship, and gameplay events;

• virtual-economy, content, offer, purchase, and rewarded-ad interactions;

• campaign, attribution, and referral information;

• ad-impression and revenue measurements;

• experiment or remote-configuration assignments; and

• user, installation, session, event, and device identifiers linked to these events.

The current release may initialize analytics as part of application startup. Analytics data is generally pseudonymous, but pseudonymous information can still be personal data when it can be linked to a user or device.

2.6 Advertising data¶ ↑

The current release uses Unity LevelPlay advertising mediation. Depending on the active mediation configuration, Unity and enabled advertising partners may automatically process:

• IP address, approximate location, device and app information, and language;

• advertising, device, installation, user, and session identifiers;

• operating-system privacy settings and advertising-limit signals available to the SDK;

• ad requests, bids, impressions, views, completion, clicks, frequency, and rewards;

• campaign, creative, attribution, fraud-prevention, and revenue information; and

• gameplay or app-interaction events associated with requesting, displaying, or rewarding an ad.

Advertising services may initialize as part of application startup. Availability of a particular advertising partner may depend on the release build, location, device, and remotely managed mediation configuration.

Advertising providers may use data to serve, select, measure, secure, limit, and report advertising and, where permitted by their terms, device settings, and applicable law, to personalize advertising.

2.7 Diagnostics, security, and fraud-prevention data¶ ↑

Firebase Crashlytics, Unity services, platform services, our servers, and other providers may process crash reports, application-not-responding reports, stack traces, performance information, device and app state at the time of an error, security events, integrity checks, suspected fraud or cheating, and related identifiers.

Crash and diagnostic collection can begin automatically. We do not intentionally place support messages or survey free-text responses in diagnostic reports, but automatically generated reports can include technical context present at the time of an error.

2.8 Surveys, support, and communications¶ ↑

If you voluntarily complete the in-game questionnaire, the submitted data can include:

• your email address;

• favorite character or episode selections;

• ratings, selections, and other survey answers; and

• free-form feedback written by you.

The current questionnaire sends its submitted fields, including free-form feedback and any email address entered, to Amplitude as analytics event data. Survey participation is optional. The Game does not provide a user-to-user chat or treat this questionnaire as an in-app messaging service.

If you contact support, we may also process your email address, display name, message, attachments, relevant Game or account identifiers, technical information you provide, and the history and outcome of the request. Please do not include sensitive personal data unless it is necessary for us to handle your request.

2.9 Website data¶ ↑

The pages at undeadfox.com are served from infrastructure configured for Undead Fox. When you visit the website, the web server, hosting provider, and network providers may process an IP address, browser and device information, requested URL, referring page, timestamps, HTTP headers, and security or access-log information.

If third-party analytics, cookies, or advertising technologies are added to the website, we will update this notice and provide any choices required by applicable law.

3. Sources of Data¶ ↑

We receive personal data:

• directly from you, such as questionnaire answers, an email address you enter, and support communications;

• automatically from the Game, your device, or our servers;

• from Google Play, Apple, Game Center, Google Play Games, and other platform services you use;

• from authentication, cloud-storage, purchase, analytics, diagnostic, advertising, and fraud-prevention providers; and

• from legal or security sources where permitted by law.

4. How We Use Data¶ ↑

We use data to:

• operate the Game, authenticate players, synchronize saves, deliver content, and restore entitlements;

• process, validate, record, and support purchases;

• measure use, understand progression and feature performance, analyze questionnaire responses, and improve the Game;

• request, display, reward, measure, and secure advertising;

• configure content and experiments;

• diagnose crashes and performance problems;

• prevent fraud, cheating, abuse, and invalid advertising activity;

• respond to support and privacy requests;

• maintain, secure, and troubleshoot the Game, website, and backend; and

• meet tax, accounting, consumer-protection, litigation, and regulatory obligations.

5. Legal Bases¶ ↑

Where data-protection law requires a legal basis, the basis depends on the processing and your location. It may include:

• performance of our agreement with you, for example to provide the Game, cloud saves, content, or purchased entitlements;

• our legitimate interests, where permitted, in operating, securing, diagnosing, and improving the Services and preventing fraud;

• compliance with legal obligations, including accounting, tax, consumer-protection, and valid legal requests; and

• consent where applicable law requires it.

If applicable law requires prior consent for a particular activity, that activity cannot be based solely on acceptance of the Terms or continued use of the Game. Device and app-store controls may limit advertising identifiers or personalized advertising, but they do not replace a separate consent where one is legally required.

Where we rely on legitimate interests, you may object where applicable. Where processing lawfully relies on consent, you may withdraw that consent without affecting processing already carried out before withdrawal.

6. Service Providers and Other Recipients¶ ↑

We disclose data to providers when needed for the purposes above. A provider may act as our processor, an independent controller, or both, depending on the service and applicable terms.

6.1 Game, platform, cloud, analytics, and diagnostics providers¶ ↑

• Google LLC and its affiliates — Google Play, Google Play Games, Firebase Authentication, Firebase Storage, Firebase Remote Config, Firebase Crashlytics, Firebase Analytics, and, where active, Google advertising services. See Google’s Privacy Policy and Firebase Privacy and Security.

• Apple Inc. and its affiliates — App Store, Game Center, purchases, and device privacy controls. See Apple’s Privacy Policy.

• Amplitude, Inc. — product analytics and storage or analysis of questionnaire event data. See Amplitude’s Privacy Notice.

• Unity Technologies and its affiliates — Unity services, analytics components, advertising, and Unity LevelPlay / ironSource mediation. See Unity’s Privacy Policy.

• Our hosting and backend infrastructure providers — content delivery, purchase validation, server logs, and operation of undeadfox.com and bundles2.undeadfox.com.

6.2 Advertising partners¶ ↑

Only advertising partners present in the release and enabled in the active mediation configuration can receive an ad request. The configured or packaged partner set may include:

• Google AdMob;

• AppLovin;

• Amazon Publisher Services;

• BIGO Ads;

• InMobi;

• Pangle;

• Unity Ads;

• Verve Group / HyBid; and

• Liftoff Monetize / Vungle.

The exact active set can vary by platform, country, ad availability, and dashboard configuration. Advertising partners can receive device, approximate-location, identifier, and app- or ad-interaction data in an ad request and may process that data under their own notices.

6.3 Other disclosures¶ ↑

We may also disclose relevant information:

• to app stores, payment platforms, authentication providers, professional advisers, and vendors supporting the Services;

• to competent authorities or other parties when required by law or reasonably necessary to protect rights, safety, security, and service integrity;

• in connection with a merger, financing, reorganization, sale of assets, or transfer of the Services, subject to applicable requirements; and

• at your direction or with your separate permission.

External communities and links, such as Discord or social networks, are operated independently. Information submitted there is governed by the relevant provider's notice.

7. Sale, Sharing, and Targeted Advertising¶ ↑

We do not sell personal data in exchange for money. Under some U.S. state privacy laws, however, disclosure of device identifiers, approximate location, and app- or ad-interaction information to advertising partners may be considered a “sale,” “sharing,” or “targeted advertising” even when no money is exchanged.

You can use advertising and tracking controls provided by your device or app store. You may also email support@undeadfox.com with the subject “Privacy Request” to exercise an applicable legal right. We will respond and take the steps required by applicable law, although some requests may require verification and may not affect data that a third party processes independently under its own legal obligations.

8. International Data Transfers¶ ↑

Undead Fox is established in Montenegro. Our providers may process data in Montenegro, the European Economic Area, the United States, and other countries where they or their service providers operate. Privacy laws in those countries may differ from those where you live.

Where required for a restricted international transfer, we use or require an available lawful transfer mechanism, such as an adequacy decision, approved standard contractual clauses, or another legally recognized safeguard. Provider-specific mechanisms are described in the providers' terms and privacy notices.

9. Retention¶ ↑

Retention varies by data category, account status, provider configuration, operational need, and legal obligation. In general:

• account and cloud-save data can remain while the associated account or save is active;

• purchase and entitlement records can remain as needed to provide entitlements, process refunds, prevent fraud, and meet tax, accounting, consumer-protection, and limitation-period requirements;

• analytics, advertising, crash, diagnostic, and server-log data is retained according to our settings and the relevant provider's retention rules;

• support records and questionnaire responses can remain while useful for handling the request, analyzing feedback, maintaining records, or resolving a dispute; and

• backup copies can remain until they are overwritten or expire under the relevant backup cycle.

To request deletion, email support@undeadfox.com with the subject “Delete My Data”. Revoking Google or Apple access does not by itself delete information held by us or our providers. We will assess and process verified requests as required by applicable law, subject to data we must retain or cannot reasonably identify, provider limitations, security needs, and legal exceptions.

Aggregated or irreversibly anonymized information may be retained because it is no longer personal data.

10. Security¶ ↑

We use technical and organizational measures intended to protect data, including access controls, restricted administrative permissions, provider security features, and encrypted transmission where appropriate.

No transmission or storage method can be guaranteed completely secure. You are responsible for protecting your device and platform account. Contact us promptly if you believe your account or personal data has been compromised.

11. Children and Teen Users¶ ↑

The Game is intended for users aged 13 and older. A higher minimum age may apply where required by local law, platform rules, or the ability to enter into an agreement or consent to particular processing.

We do not knowingly invite children under 13 to use the Services. If we learn that we processed personal data from a child in a manner not permitted by applicable law, we will take steps required by that law, which may include restricting processing or deleting identifiable data. A parent or guardian may contact support@undeadfox.com with the subject “Child Privacy Request”. We may request limited information needed to verify the request and relationship.

12. Your Privacy Rights¶ ↑

Depending on where you live and the processing involved, you may have rights to:

• obtain information about and access personal data;

• correct inaccurate or incomplete data;

• request deletion of personal data;

• restrict or object to processing;

• receive certain data in a portable format;

• withdraw consent where processing is based on consent;

• opt out of sale, sharing, targeted advertising, or qualifying profiling where applicable;

• appeal a denied request where applicable;

• not be discriminated against for exercising a privacy right; and

• complain to a competent data-protection authority.

Email support@undeadfox.com with the subject “Privacy Request” and provide enough information to locate the relevant data, such as your platform, Game user ID or installation ID if available, and approximate last-use date. Do not send a password or complete payment-card details.

We may request proportionate verification before disclosing, correcting, or deleting data. We respond within the period required by applicable law and may deny or limit a request where a lawful exception applies or where we cannot reasonably identify the requested data.

You may lodge a complaint with the Agency for Personal Data Protection and Free Access to Information of Montenegro (AZLP) through its official website, or with another competent authority where applicable.

13. Additional U.S. State Privacy Information¶ ↑

This section applies only to the extent a U.S. state privacy law applies to Undead Fox or the relevant processing.

During the preceding 12 months, we may have collected the categories described in Section 2, including identifiers; commercial and entitlement information; internet or electronic-network activity; approximate geolocation; questionnaire and support content; gameplay activity; and advertising, diagnostic, and technical data. Sources are listed in Section 3, purposes in Section 4, and recipient categories in Section 6.

We may disclose those categories to service providers for business purposes. Advertising partners may also receive identifiers, approximate location, device information, and app- or ad-interaction data for advertising, measurement, attribution, frequency management, and fraud prevention. As explained in Section 7, this can be considered sale, sharing, or targeted advertising under some state laws even though we do not sell data for money.

Residents of an applicable state may submit a request using the method in Section 12. If an appeal right applies, reply to our decision with “Privacy Appeal” in the subject line.

14. Automated Processing¶ ↑

Advertising providers may use automated systems to select, personalize, measure, and prevent fraud in advertising. We and our providers may use automated integrity or purchase-validation checks to identify invalid transactions or suspicious activity. If an automated check incorrectly affects a purchase or account feature, contact support for review.

15. Changes to This Privacy Policy¶ ↑

We may update this Privacy Policy when the Game, providers, website, law, or our processing changes. The date and version at the top identify the current text. When appropriate or legally required, we will provide notice through the Game, website, store listing, email, or another reasonable channel.

Previous versions may be requested from support@undeadfox.com.

16. Contact Us¶ ↑

Questions, concerns, or requests concerning this Privacy Policy can be sent to:

UNDEAD FOX STUDIO DOO
Vladimira Rolovica 2, Bar, Montenegro
PIB / Tax ID: 03432513
Email: {support@undeadfox.com}[mailto:support@undeadfox.com]
Website: undeadfox.com/