Privacy Policy
1. Overview
Uoma Labs LLC ("we," "our," or "us") built Axolittle as a virtual pet game for players of all ages. This Privacy Policy explains what we collect, why we collect it, and how we protect it. We collect as little as possible — especially from younger players.
2. Age Gate
When you first open Axolittle, we ask the year you were born. This answer is stored only on your device and is never sent to our servers. We use it to:
- Route players under 13 into a fully on-device, guest-only experience (see Section 6)
- Show a one-time math challenge before any account-creation path opens, so children can't sign up on their own
A parent or guardian who is setting up the app can pass the math challenge and create their own adult account.
3. Information We Collect
We collect only what's necessary to run the game, and only from players age 13 and older.
a. Account information (if you create an account)
- A username or display name you choose
- A password — we never see or store the plaintext (Supabase hashes it)
- A recovery email — optional, used only to send you a password-reset link if you forget your password
b. OAuth sign-in (if you use "Sign in with Apple" or "Sign in with Google")
- The identity returned by the provider: an opaque user ID, the email address Apple or Google releases to us (Apple may relay a private alias), and the display name configured with that provider. We do not request any other information from these providers.
c. Game data (signed-in users on devices age-gated as 13+ only)
This data is synced to our cloud servers via Supabase so you can restore your progress on a new device:
- Your axolotl's name, stage, lineage, color/pattern, and decorations
- Mini-game scores and achievements
- In-app currency balances (Coins and Opals)
- App settings and preferences
- Your friend list (identified by friend codes — random 8-character identifiers, never real names)
- Friend notifications you send or receive (gifts, pokes), labeled with your axolotl's name
What other signed-in players can see about you. To make social features work, certain fields are readable by any other signed-in player who knows your friend code:
- Your axolotl's name, appearance (color, pattern, rarity), and current stage
- Decorations and background you've equipped
- Achievements you've unlocked
Your username, recovery email, password, currency balances, mini-game scores, and friend list are not visible to other players. Only the friend you're directly interacting with sees your axolotl's name on a gift or poke notification — your username never appears in the social graph.
d. Guest data and under-13 data
- All game data for guest players, and all game data for players under 13, stays on your device in your browser/app's local storage. None of it is transmitted to our servers — even if a parent signs in their own account on that device.
e. Infrastructure data
- Our backend provider (Supabase) logs the IP address and User-Agent of HTTPS requests as standard server-infrastructure operations. We don't combine this with other data, and we don't use it for tracking, profiling, or advertising.
We do not collect your real name, physical address, phone number, geolocation, contacts, photos, microphone, camera, or payment information. The app does not include any third-party analytics, behavioral tracking, advertising, or marketing-attribution SDKs.
4. How We Use Your Information
| Purpose | Data Used |
|---|---|
| Save and restore your game progress (signed-in 13+ users) | Game data, account info |
| Cloud-sync your axolotl across devices | Game data (via Supabase) |
| Let you connect with friends | Friend codes, friend notifications |
| Send you a password-reset link if you forget your password | Recovery email (via Resend) |
| Authenticate "Sign in with Apple" or "Sign in with Google" | OAuth identity from the provider |
| Respond to support requests | The email you contact us from |
We do not use your data for advertising, retargeting, behavioral profiling, or any kind of sale or sharing for marketing.
5. Third-Party Services (Sub-Processors)
We use a small number of trusted services to run Axolittle:
| Service | Purpose | What they receive |
|---|---|---|
| Supabase, Inc. — privacy policy | Database, authentication, file storage | Your account info and game data (signed-in 13+ users only); request IP and User-Agent for users who reach the API |
| Resend — privacy policy | Sends transactional password-recovery emails | Your recovery email address and the email body, only when you request a password reset |
| Apple, Inc. | "Sign in with Apple" identity provider | What Apple itself sees during the sign-in flow |
| Google LLC | "Sign in with Google" identity provider | What Google itself sees during the sign-in flow |
Supabase and Resend store data on infrastructure located in the United States.
6. Children's Privacy (COPPA)
Axolittle is rated for all ages. We take children's privacy seriously.
For players whose age gate identifies them as under 13:
- No account creation. They play in guest mode only.
- No data leaves the device. Cloud sync, achievement sync, and profile publishing are all hard-disabled in the app code. Even if a parent later signs in their own account on the same device, the under-13 lock stays in place — gameplay on that device never syncs.
- No social features. Friend graph, breeding, and gifting are disabled in the user interface.
- No ads. We do not display ads of any kind. If we ever introduce ads in the future, they will be non-personalized for under-13 users (no behavioral targeting, no persistent identifiers).
- No third-party tracking, analytics, or marketing data sharing.
Parental controls. A parent or guardian may at any time:
- Email support@uomalabs.com to request deletion of any account or data we hold for their child
- Clear all on-device game data by uninstalling the app
If we ever learn that we've inadvertently collected personal information from a child under 13 beyond what's described here, we will delete it promptly.
7. Data Retention and Deletion
We retain your account data for as long as your account is active. You can delete your account and all associated cloud data at any time directly in the app: Settings → Data → Delete Account. Deletion is immediate and permanent on our cloud servers, and clears your on-device save.
You can also email support@uomalabs.com to request deletion. We respond within 30 days.
Guest data — and all under-13 data — lives only on your device. Uninstalling the app or clearing your browser's site data removes it.
8. Data Security
We protect your information with:
- HTTPS/TLS encryption for all data in transit
- Supabase Row-Level Security policies that prevent any user from modifying another user's data. (For the social-feature fields disclosed in Section 3c — axolotl appearance, achievements, friend code — read access is intentionally permitted to other signed-in players.)
- Hashed passwords — never stored in plaintext
- A math challenge before any account-creation path opens on devices age-gated as under 13
No system is perfectly secure. If you believe your account has been compromised, contact us immediately.
9. Your Rights
All users may:
- Request a copy of the data we hold about them
- Request correction of inaccurate data
- Delete their account and all associated cloud data — directly in the app under Settings → Data → Delete Account, or by emailing us
California (CCPA/CPRA): You have the right to know what personal information is collected, to request deletion, and to opt out of sale or sharing. We do not sell or share personal information.
EEA / UK (GDPR): You may additionally restrict or object to processing, and have the right to data portability.
To exercise any of these rights, email support@uomalabs.com. We respond within 30 days.
10. Changes to This Policy
We will post any changes to this page and update the Effective Date at the top. Continued use of the app after changes constitutes acceptance of the updated policy.
11. Contact
Uoma Labs LLC
support@uomalabs.com