This Privacy Policy describes how Off Court Creations LLC, the publisher, service operator, and sole data controller for pngwin, collects, uses, discloses, and protects your personal information when you use pngwin, Sweaty Shooter, and related services (collectively, the "Service"). In this Policy, "we," "us," and "our" mean Off Court Creations LLC. Kairuku Studios LLC develops the Service and licenses its game IP to OCC; OCC remains the data controller.
This Policy is a notice of practices, not blanket consent to processing. Mandatory privacy rights and any legally required consent or authorization remain applicable, including for children.
Off Court Creations LLC operates the Kairuku account service. Ordinary accounts provide an email, username and credentials. Cabined accounts use a curated username, password and recovery credentials without requiring a child's contact email. Authentication uses password hashes, account identifiers, sessions and security records; a pseudonym or account ID can still be personal information when linked to a person or their activity.
At signup we use the entered date of birth transiently with the selected country to classify the account. Current signup does not save that birthday, a derived threshold birthday or an automatic age-out date in the player profile or signup-recovery record. We retain country, account classification, the evaluation source/time and policy revision, and records of account setup and legal-document acknowledgement. These are not independent verification of age or identity. Historical records and backups are addressed in Section 4.
For Cabined signup we collect a parent's email to deliver a notice and management code. A responding parent supplies their own contact and credentials for a management login. We record the linked account, notice/attestation versions, explicit responses and limited delivery, expiry and retry state. Section 8 explains this process.
Gameplay records include participation, match outcomes, scores, challenge and Battle Pass progress, XP, balances, currency transactions, inventory, equipment, cosmetic selections and saved tutorial/account progression. Necessary party invitations, membership, public names and in-game presence support available social features. Ordinary-account communications, player reports and support messages may create moderation and support records. Cabined accounts cannot use chat, direct messages or friend lists.
For payments, Stripe processes payment-method, billing and fraud-prevention information. OCC stores account-linked checkout and transaction identifiers, pack/price/amount/currency, delivery, receipt, refund and dispute information. Our game systems do not store full card numbers or card security codes. Information sent to support or supplied in processor disputes may also form part of a support record; do not send full payment credentials.
Technical information includes necessary network identifiers such as IP addresses, session/connection identifiers, browser/device information, room state, timestamps, errors and performance measurements. Operational records and ordinary-account activity analytics help run, secure and diagnose the Service. Cabined activity is excluded from behavioral analytics and personalization; that does not eliminate necessary gameplay, security or financial records, or identity-free operational counts.
The tutorial may be used as a guest without creating a persistent player account. Temporary identifiers, tutorial-completion/recovery state and necessary operational or security records can exist. Guest access is not a promise that all records vanish when a session ends. Browser storage is explained in Section 7.
We use information to create and authenticate accounts, classify and enforce account restrictions, run matches and parties, save progress, deliver purchases and rewards, resolve interrupted operations, maintain account security and provide support.
We use parent contact and response records to deliver the initial notice, let a parent manage linked accounts, enforce disapproval and process confirmed deletion. A missing response is not consent, and approval does not enable additional child features. The parent invitation address is not a marketing list.
We use technical and ordinary-account activity information to diagnose faults, measure performance, improve game balance and detect abuse. We do not use Cabined information for marketing, behavioral personalization or behavioral analytics. Necessary game rules, account security and anti-fraud processing are distinct from advertising or tailoring promotional offers.
We send transactional messages, security alerts, receipts, support responses and appropriate policy notices through available account/contact channels. This Policy does not enroll anyone in marketing or authorize marketing to a Cabined player.
We use relevant records to meet legal obligations, handle refunds and disputes, respond to lawful requests and establish or defend legal claims. Where data-protection law requires a legal basis, we rely on the basis applicable to that specific purpose: performance of a valid agreement where applicable, legal obligations, legitimate interests in delivering and protecting the Service subject to individual rights, or specific consent where required. We do not treat a minor's click, parental silence or acknowledgement of this Policy as blanket consent or proof of a valid adult contract. Contact us for information about the basis applicable to a particular use.
We do not sell personal information or share it for cross-context behavioral advertising.
Off Court Creations LLC is the service operator and sole controller for the practices in this Policy. Kairuku Studios LLC, the game developer and IP licensor, accesses player information only on OCC's instructions for development, maintenance, security, moderation or support. Kairuku is not a separate controller for advertising or unrelated use of this account data.
We use Appwrite technology for account authentication and data storage; a software name does not mean every database is hosted by that vendor. Self-hosted systems run our game servers, web serving, storage, logging, monitoring and operational tools. Mailgun processes recipients and message content for transactional email. Stripe processes checkout, payment and fraud/dispute information, including information it processes under its own applicable payment/privacy disclosures. Instructed personnel and providers receive information relevant to their work; those disclosures are not a claim that no personal information leaves the game.
Other players may see public usernames, appearance, scores, relevant game presence and party information. A curated child username is a safeguard against directly identifying names, not a guarantee of anonymity. Party invitations do not enable Cabined chat or persistent friendships.
We may disclose relevant information when required by law or legal process, to address fraud or genuine safety/security threats, or to establish or defend legal claims. A lawful corporate transaction may involve a transfer of relevant records, subject to required protections and notices; it does not remove child-data restrictions or mandatory rights.
A new optional disclosure requiring consent will be presented separately. Merely using the Service or approving a Cabined account does not authorize advertising disclosure or a new unrelated purpose.
We retain account and gameplay information to provide the active account, preserve progress and fulfill service obligations. Retention is based on the purpose and applicable requirements, not a blanket permission to keep all information indefinitely. Gem balances do not expire and are not forfeited solely for inactivity; we do not promise an automatic inactive-account deletion schedule.
A pending parent invitation expires after 30 days if unclaimed. The application clears the pending recipient and code data through its cleanup process; an expired code cannot be used while cleanup is pending. Claiming an invitation removes the pending recipient/code and instead links the parent's separately supplied management identity. Management codes expire after 15 minutes and replacement codes invalidate earlier codes. Invitation expiry does not stop the child's restricted gameplay. A child may request a fresh notice.
An established parent's contact, linked-child records, explicit responses and limited response/retry evidence are separate from unclaimed invitation contact. Deleting one child does not automatically close a parent's login or remove other child links. Contact support about parent-account closure, correction or disputed links.
Confirmed deliberate player/parent erasure removes the live player profile and associated player-owned gameplay and inventory records without creating a full recoverable account snapshot. Minimal transaction, financial ledger, support, security, enforcement, parent-response and deletion/anti-replay evidence may remain. These records can retain an account identifier even after the login and profile have been removed; they are not necessarily anonymous. They support payment obligations, fraud prevention, legal claims and preventing deleted or refunded operations from running again. Their retention depends on the relevant obligation and purpose; we do not apply a blanket seven-year or 18-month period to every record.
New signup does not retain birthday or threshold-date evidence. Historical live records require explicit cleanup; our completed production cleanup does not establish that every historical backup, development record or provider copy has been erased. Backups, earlier recovery snapshots and provider delivery/security records can have separate retention and deletion handling. Removing an address from the game does not erase an already delivered email. Restored data must have applicable deletion requests and age minimization reapplied before serving players.
Contact info@offcourtcreations.com for access or deletion requests and information about the records retained for your account, their purpose and applicable retention criteria. A service outage or a pending cleanup is not a new right to use expired contact data.
We use safeguards including encrypted browser transport, password hashing, authenticated requests, access restrictions, isolated sessions and game rooms, validation, transaction integrity checks and restricted server-side account/parent records. Management codes are stored as a digest rather than reusable plaintext in the pending invitation record; delivery necessarily processes the code in the message.
Access to operational infrastructure and player information is restricted to its service purposes. No transmission or storage system is perfectly secure. Protect passwords, recovery credentials and parent codes. Contact support if you suspect misuse; do not send unsolicited identity documents or full payment credentials.
Depending on applicable law, you may request access, a copy, correction, deletion, restriction, portability or objection to processing, withdraw consent where it is the basis, or complain to a competent data-protection authority. Contact info@offcourtcreations.com. We respond within applicable legal deadlines and explain any permitted extension or exception. We do not discriminate against you for exercising a right.
We may verify identity and authority before disclosing information or taking irreversible action, using information appropriate to the request rather than demanding unrelated personal data. Cabined players can request deletion through their account. Linked parents can use Parent Management for available account details, responses and confirmed deletion; fuller access/correction requests, disputed parent links and parent-login closure go through support.
Withdrawing consent does not retroactively make prior lawful processing unlawful, and a request may not remove records we must retain for a specific legal or transaction-integrity purpose. We explain applicable limitations rather than treating this Policy as a waiver of your rights.
We use browser/session storage, authentication cookies or tokens, and similar necessary storage for sign-in, account acknowledgement, game preferences, connection/recovery state and purchase or operator-request recovery where those features are used. Server-side security/session records also support these functions. An opaque signup-recovery token is not a stored birthday or a permission to expose credentials.
These features do not require advertising cookies or third-party behavioral-advertising trackers. Operational telemetry is described separately above; absence of analytics cookies does not mean absence of all service measurements. Cabined users remain excluded from behavioral analytics and personalization.
You can manage cookies and local storage through your browser, but clearing or disabling necessary storage can sign you out, remove preferences or interrupt recovery. We do not currently interpret the browser's Do Not Track header as a specific account setting. This does not waive applicable privacy rights or any legally required opt-out signal handling.
Children may use the supported Service through Cabined accounts under our country-based account policy. We process account identifiers, country/classification, necessary gameplay, technical/security information and parent-management information for these accounts. We do not claim that pseudonymous gameplay collects no personal information.
Cabined accounts can continue basic gameplay and progression without a parent responding. They cannot use text/voice chat, direct messages, friend requests or persistent friend lists, free-text public names, real-money checkout, purchased-currency spending, marketing or behavioral personalization. Available parties remain invitation-based, with the Cabined player's own party locked Invite Only; joining another party does not change these restrictions.
We require a parent's email at signup to send a notice and single-use management code. A parent creates or signs into their own management account, enters the code sent to the supplied address and confirms they are the parent or legal guardian. The code lasts 15 minutes and attempts are limited. Email control and that statement are not independent proof of adulthood or guardianship. This flow requests no payment or identity document. We do not describe it as a blanket authorization for every data use.
A parent may review linked account information, explicitly approve or disapprove play, or separately confirm deletion. Approval grants no new capability. Disapproval stops gameplay and blocks reconnect until resolved; later approval can clear that play restriction but cannot cancel a deletion request. Opening an email or page does not approve or delete an account. Contact info@offcourtcreations.com if the email reached the wrong person, the linkage is disputed, or you want fuller access, correction or deletion assistance.
Failure to deliver a notice, silence or expiry of an unclaimed invitation does not count as approval and does not itself stop restricted gameplay. Pending contact retention is described in Section 4. Legacy accounts are not assigned invented parent contact or approval. Parental feature upgrades and account graduation are not currently offered; restrictions do not automatically disappear with age.
If you believe a child's information has been collected or used improperly, contact us. We will review the circumstances, authenticate the request as appropriate, and take the action required by applicable law. The availability of restricted gameplay does not remove our obligations concerning children's information.
Our self-hosted servers are located in Bloomington, Indiana, United States. Players outside the United States may have information processed in the United States through game hosting, operational access and the providers used for the Service. Mailgun and Stripe may process information in locations covered by their own applicable disclosures.
The applicable protections depend on the location, provider and processing purpose. This Policy does not claim a particular certification, adequacy decision or signed transfer agreement solely because we use a provider's software. Contact info@offcourtcreations.com for information about the arrangements applicable to your data and any safeguards required by law. Acknowledging this Policy or simply using the Service is not consent to an otherwise unlawful transfer and does not waive local rights.
The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. Review their privacy policies before providing personal information.
EEA and UK: if you are in the EEA or UK, you may have GDPR or UK GDPR rights, including access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and the right to lodge a complaint with a supervisory authority. Off Court Creations LLC is the sole data controller for player information governed by this Privacy Policy. Kairuku Studios LLC acts only as its processor where development or support requires access to that information.
California: if you are a California resident, you may have CCPA or CPRA rights to know, delete, correct, opt out of sale or sharing where applicable, limit use of sensitive personal information where applicable, and avoid discrimination for exercising rights. We do not sell personal information or share it for cross-context behavioral advertising.
Other U.S. states: residents of Virginia, Colorado, Connecticut, Utah, and other states with privacy laws may have similar rights. Contact info@offcourtcreations.com to exercise your rights.
Brazil: if you are in Brazil, you may have LGPD rights including access, correction, deletion, and portability. Contact info@offcourtcreations.com to exercise your rights.
Other jurisdictions: if your jurisdiction provides additional data protection rights, those rights apply to the extent required by applicable law.
We may update this Policy and identify the effective date of the revision. Material changes require appropriate notice through the Service or a valid account/contact channel. Where law requires fresh consent or another authorization for a new purpose, we obtain it before relying on that use.
A recorded document acknowledgement is not parental approval or blanket consent to processing. We do not backfill agreement for historical accounts, treat silence as approval, or use an expired pending parent address for a policy campaign. Contact us with questions about a change or your rights.
If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us at info@offcourtcreations.com.
Data controller and publisher:
Off Court Creations LLC
254 Chapman Rd, 208
Newark, DE 19702
United States
Telephone: +1 (812) 329-5540
We aim to respond to privacy inquiries within 30 days. Complex requests may require additional time, and we will notify you if an extension is needed.
Automated systems enforce account classification and capability restrictions, support matchmaking and game rules, detect suspected abuse, and check or recover purchases and other transactions. Stripe also performs payment/fraud checks. A restriction or payment refusal can affect access; we do not make a blanket claim that automated decisions can never significantly affect you. Contact info@offcourtcreations.com to request review of an account or transaction decision and exercise applicable rights.
Game rules and security processing differ from behavioral advertising or personalization. We do not use Cabined information for behavioral analytics, marketing or personalization. Necessary security/integrity records and identity-free operational measurements are not a promise of zero processing.
We minimize information for the purposes described in this Policy. We do not request biometric or identity-document verification in the parent-management flow. Do not submit unnecessary sensitive information in usernames, chat where available, or support messages. If you submit it, we may need to process the message to respond and handle it appropriately; this is not a request for that information.
Accounts: ordinary accounts use email; Cabined accounts use curated usernames and recovery credentials. Current signup evaluates birthday transiently and keeps classification rather than a birthday or automatic age-out date.
Parents: mandatory invitation contact, a management code and explicit responses; no response is not approval. Approval grants no features, disapproval stops play, and deletion is separately confirmed.
Money: only Gem packs for real money; OCC is the merchant and Stripe processes payments. Cabined accounts spend earned currency only. Gems do not expire.
Data: account/gameplay, transaction, necessary technical/security and parent-management records. No Cabined marketing or behavioral personalization; necessary records and other-player visibility still exist.
Retention: unclaimed invitation contact expires after 30 days; claimed parent, transaction, security and provider records have separate purposes. Deliberate erasure makes no new full-account snapshot.
Rights and questions: contact info@offcourtcreations.com. OCC is the controller; Kairuku is the developer/IP licensor and processes player information on OCC's instructions.
PLEASE REVIEW THIS POLICY. IT DESCRIBES OUR PRACTICES; IT DOES NOT REPLACE ANY CONSENT OR AUTHORIZATION REQUIRED BY LAW.
Publisher and operator: Off Court Creations LLC
Data controller: Off Court Creations LLC
Developer, IP licensor and instructed data processor: Kairuku Studios LLC
254 Chapman Rd, 208, Newark, DE 19702, United States
Contact: info@offcourtcreations.com
Telephone: +1 (812) 329-5540