FATHOMFALL Privacy Policy

Effective date: 2026-10-30

Version: 1.3

FATHOMFALL (the "Game") is operated by Venture Returns LLC, a Missouri limited liability company ("Venture Returns," "we," "us," or "our"). This Privacy Policy explains what information we collect when you play the FATHOMFALL game (the "Game"), how we use it, who can see it, how long we keep it, and the choices and rights you have. FATHOMFALL is a browser-based social-deduction battle-royale game delivered as a Progressive Web App (PWA).

We designed FATHOMFALL to collect as little personal information as possible. We do not require you to create an account to play, we do not use third-party analytics or advertising, we do not embed third-party trackers, and we do not sell or share your personal information.

What changed in version 1.3 (2026-10-30). If you play as a guest and do not save your progress, we now delete your guest profile after 30 days without a visit (Section 8). Your guest key is now kept in a cookie that page scripts cannot read, or in the iPhone Keychain (Section 3.2). If you save your progress, you can make backup codes, and we keep only a scrambled form of them and of your phone number (Section 3.6).

What changed in version 1.2 (2026-10-15). You can now sign in with your phone number to keep your progress across devices. Section 3.6 explains what this collects, and Section 7 names the sign-in provider. Your profile now lives in our managed database instead of a file on our server. You can now export and delete your analytics events in the Game.

Questions or requests: privacy@fathomfallgame.com.

1. The short version

• You can play as a guest without creating an account.
• We collect a display name you choose and a random, server-issued session identifier stored in your browser.
• Only if you choose to sign in, we collect your phone number to send you a one-time code. Our sign-in provider, Stytch, processes the number; we keep only its last two digits. See Section 3.6.
• Your display name and gameplay statistics appear publicly on the leaderboard. Choose a name accordingly.
• We derive and store gameplay statistics (rating, renown, in-game currency, level, progress) on our own server.
• We use only first-party browser storage (cookies/localStorage/sessionStorage) for functional and preference purposes. See our Cookie & Local Storage Policy.
• Only if you consent, we collect anonymous, first-party product analytics (how the Game is used: e.g. matches started, the "First Resolution" moment) to improve it. These are pseudonymous (keyed to your session identifier), contain no personal information, are never used for advertising and never shared or sold. You can decline or withdraw at any time, and we honor Global Privacy Control.
• We use no third-party analytics, no advertising pixels, and no external content delivery networks. The Game runs on a single origin. Two providers process data for us: our cloud hosting and database provider, and Stytch for optional phone sign-in (Section 7).
• There is no payment processing. In-game "Pearls" are earned through play and cannot be purchased; no real-money purchases exist.
• You can access, export, and delete your data at any time from Settings → "Manage my data," and correct your display name any time by editing it in the Dive-Locker.
• We honor the Global Privacy Control (GPC) browser signal.

2. Who this applies to and the age requirement

FATHOMFALL presents an age gate the first time you run the Game. The Game is intended for players who meet the minimum age described in our Children's Privacy Notice. We do not knowingly collect personal information from children below the applicable minimum age. If you believe a child has provided us personal information, contact privacy@fathomfallgame.com and we will delete it. See the Children's Privacy Notice for full details, including how we apply age-appropriate design.

3. Information we collect

We only collect what the Game actually uses. We do not collect your real name, email address, precise location, contacts, photos, or biometric data. We collect a phone number only if you choose to sign in (Section 3.6).

3.1 Information you provide

3.2 Session identifier stored on your device

3.3 Information we derive and store on our server

When you play, we calculate and store gameplay statistics in our managed database, keyed to your server-issued session identifier:

• Sleuth Rating (SR / Elo) and rating tier
• Renown
• Pearls and other in-game currency (earned in-game; non-purchasable)
• Account level
• Contracts progress and unlocks
• Ranked games count
• Chosen Sleuth character
• Match history: for each match you finish, the match identifier, season, mode and time, and a keyed code that tells us whether you saw the same mystery solution before. The code cannot be turned back into the solution without a secret key that only our server holds. We use it to measure whether the Game stays fresh.

These statistics, together with your display name, are used to power matchmaking, progression, and the public leaderboard.

3.4 Connection and technical data

To deliver real-time gameplay, the Game communicates with our server over a secure WebSocket connection (wss, port 443), with a Server-Sent Events (SSE) fallback, all on a single origin. As with any internet service, our server processes standard connection data (such as your IP address) transiently to route traffic, maintain your game session, and protect the service against abuse. We do not use this data to build advertising or marketing profiles.

3.5 Product analytics (first-party, consent-based)

Only if you consent (via the consent banner or Settings → "Manage my data"), we collect a small set of anonymous, first-party product-analytics events to understand how the Game is used and improve it. These events:

• are limited to a fixed list of gameplay-funnel events: for example, opening the Game, passing the age gate, queuing for and starting a match, reaching your First Resolution (a correct Unmask or the final ring), and finishing a match;
• are pseudonymous, keyed only to your random server-issued session identifier: they contain no display name, IP, or other personal information;
• may include attribution context from the link you arrived on (UTM campaign parameters, a referral code, and the referring site's domain), captured in memory for the session;
• are sent to our own server only (no third party) over the same secure connection as gameplay, and are never used for advertising and never sold or shared.

If you decline, or if your browser sends Global Privacy Control, we do not collect these analytics at all. You can withdraw consent at any time in Settings → "Manage my data"; we stop immediately. The in-app Export my data includes your analytics events, and Delete my data erases them together with your profile.

3.6 Optional phone sign-in

You can play without signing in. If you choose to sign in so that your progress follows you to another device:

• What we collect. Your phone number and the channel you pick (SMS or WhatsApp). We send the number to our sign-in provider, Stytch, which sends you a one-time code and verifies it. We do not store your full number. We store the last two digits, the channel, Stytch's identifier for your sign-in, and the time you linked it.
• Your acceptance of our terms. When you sign in, you tick a box to accept the Terms of Service and this Privacy Policy. We record which versions you accepted and when, so we can show what you agreed to.
• Purpose. To verify that you control the number, to link your progress to it, and to let you recover it on another device. We never use your number for marketing, and we send you nothing except the code you asked for.
• Message consent. Requesting a code is consent to receive that one message. Message and data rates may apply.
• Backup codes and recovery. After you save your progress you can make 10 backup codes, for the day you lose your phone. We keep only a scrambled form (a hash) of each code, and of your full phone number, so that "Lost your phone?" can find your saved progress without us keeping the number itself.

4. How we use your information

We use your information only for the following purposes:

• To run the Game: load your profile, place you in matches, run real-time gameplay, and save your progress.
• To sign you in, only if you choose to: verify your phone number and link your progress to it (Section 3.6).
• To operate the leaderboard: publicly display your chosen display name alongside your ranking and statistics.
• To maintain preferences: remember your settings on your device.
• To improve the Game (only with your consent): anonymous, first-party product analytics about how the Game is used (see Section 3.5).
• To keep the Game fair and secure: matchmaking integrity, detecting and preventing cheating and abuse, and protecting the service.
• To respond to you: handle your data-rights requests and support inquiries.

We do not use your information for advertising, and we do not sell or share it.

5. Public display of your display name (important)

Your chosen display name appears publicly on the leaderboard and is visible to other players during matches, together with your gameplay statistics (such as your Sleuth Rating and tier). The display name is the only user-generated content FATHOMFALL displays to other users.

Because this is a public surface, please do not include personal information (such as your real name, email, phone number, or address) in your display name, and follow our Community Guidelines / Acceptable Use Policy. We provide a notice-and-action process for reporting display names that violate our rules, including under the EU Digital Services Act (DSA). You can change your display name at any time, and you can delete your profile (which removes your name from the leaderboard) from Settings → "Manage my data."

6. Cookies and local storage

FATHOMFALL uses only first-party browser storage, all for functional or preference purposes:

ff_token, ff_guest (a cookie that only our server can read), ff_consent, ff_consent_gpc, ff_age, ff_age_refused, ff_seen_intro, ff_reduce, ff_cb, ff_scheme, ff_tc_pad, ff_name, ff_sleuth, ff_mode, ff_ranked, ff_watch, ff_cb_helper, ff_muted, ff_sens, ff_season_seen (and ff_pid, a legacy identifier no longer written but still swept by export/erase on devices that hold one). The Cookie & Local Storage Policy describes what each one holds and which are essential.

We use no third-party cookies, advertising cookies, or tracking pixels. We present a consent banner for any non-essential storage and honor the Global Privacy Control (GPC) signal. Full details, including the purpose of each key, are in our Cookie & Local Storage Policy.

7. Who we share information with

We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising (as those terms are defined under California law). We do not transfer your personal information to advertisers, data brokers, third-party analytics providers, or social networks, because the Game integrates none of them.

We may disclose information only:

• To you, when you exercise a data right.
• Publicly on the leaderboard, limited to your display name and gameplay statistics, as described above.
• If legally required: to comply with a valid legal obligation, court order, or lawful request, or to protect the rights, safety, and security of our players, the public, or FATHOMFALL.
• In a business transfer: if FATHOMFALL is involved in a merger, acquisition, or sale of assets, in which case we will require the recipient to honor this Policy and will notify affected users where required by law.

We use two processors, each bound by a data-processing agreement and allowed to use the data only to provide its service to us:

• Stytch, Inc. (United States), our sign-in provider. It receives your phone number only if you choose to sign in, to send and verify the one-time code.
• Our cloud hosting and database provider, which runs the Game's server and stores your profile, sign-in link, terms acceptances, match history and (with consent) analytics events on our behalf.

We will update this Policy before we add or change a processor. Our operational monitoring (timing traces of server requests and matches) carries no personal information: no display name, phone number, session credential or IP address. A monitoring service that receives these traces therefore receives no personal data.

8. How long we keep your information

• Gameplay profiles and match history: retained while you remain active, and automatically purged after 12 months of inactivity.
• Guest profiles you did not save: if you play as a guest and do not save your progress with a phone number, we delete the guest profile, its match history and its other records after 30 days without a visit. A visit on that device restarts the 30 days.
• Sign-in link and terms acceptances (only if you signed in): retained while your profile exists, and deleted with it, either when you delete your data or by the 12-month inactivity purge.
• Product-analytics events (Section 3.5, only if you consented): retained for no more than 14 months, then automatically deleted. Withdrawing consent stops all new collection immediately.
• Preferences (browser storage on your device): kept until you clear them, delete your data, or your browser removes them.
• Connection data: processed transiently and not retained beyond what is needed to operate and secure the Game.

You can delete your profile and local data at any time from Settings → "Manage my data" without waiting for the inactivity period.

9. How we protect your information

We build FATHOMFALL to a high security baseline. Measures include: encryption of all traffic in transit (TLS 1.2+/1.3) over the standard secure port (443); a single origin, with personal data leaving it only to the two processors in Section 7; minimal data collection, including storing only the last two digits of a phone number; access controls and least-privilege handling of profile data; operational logs and traces that are filtered so they carry no display name, phone number or session credential; and protections against abuse and cheating. No method of transmission or storage is perfectly secure, but we work to protect your information appropriately to its sensitivity.

10. International data transfers

Venture Returns LLC is in the United States, and our processors (Section 7) may process your data in the United States. If you are outside the United States, your data is transferred there. Where the law of your region requires it, we rely on an appropriate transfer mechanism, such as the European Commission's Standard Contractual Clauses or the UK International Data Transfer Addendum.

11. Your privacy rights

You can exercise the rights below at any time. The fastest way is in the Game: Settings → "Manage my data," which lets you access, export, and delete your data directly; you can correct your display name by editing it in the Dive-Locker. You can also contact privacy@fathomfallgame.com.

Because guest play is anonymous and keyed to a server-issued session identifier, we may verify a request by reference to the session identifier (token) associated with your profile (for example, from the device that created it). We will not discriminate against you for exercising your rights.

11.1 California residents (CCPA / CPRA)

Your California Privacy Rights

If you are a California resident, you have the right to:

• Know / Access the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and any disclosures.

• Delete the personal information we have collected from you.

• Correct inaccurate personal information we maintain about you.

• Opt out of the sale or sharing of your personal information: note: FATHOMFALL does not sell or share personal information, so there is nothing to opt out of, but we honor the Global Privacy Control (GPC) signal regardless.

• Limit the use of sensitive personal information: note: we do not collect sensitive personal information as defined by California law.

• Non-discrimination for exercising any of these rights.

How to exercise: Settings → "Manage my data," or email privacy@fathomfallgame.com.

Authorized agents may submit requests on your behalf with proof of authorization. We will respond within the timeframes required by law (generally within 45 days, extendable once where permitted).

Notice at collection (California). At or before collection, we inform you that we collect the categories described in Section 3, an identifier (your server-issued session identifier and chosen display name, and, only if you sign in, your phone number) and internet/usage activity related to gameplay, for the gameplay, leaderboard, preference, security, and support purposes described in Section 4. We retain this information for the periods in Section 8. We do not sell or share personal information, and we do not collect sensitive personal information.

11.2 Other U.S. states

If you reside in a U.S. state with a comprehensive consumer privacy law (for example, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with laws in force), you have rights similar to the California rights above: typically to access/confirm, correct, delete, obtain a portable copy, and to opt out of targeted advertising, sale, and certain profiling. FATHOMFALL does not engage in targeted advertising, the sale of personal data, or profiling that produces legal or similarly significant effects. We honor universal opt-out signals such as GPC. To exercise any right, use Settings → "Manage my data" or email privacy@fathomfallgame.com. Where a state provides an appeal process, you may appeal a decision by replying to our response or contacting privacy@fathomfallgame.com.

11.3 European Union, EEA, and United Kingdom (GDPR / UK GDPR)

If you are in the EU, EEA, or UK, the following applies.

Controller. Venture Returns LLC is the controller of the personal data described in this Policy. Contact: privacy@fathomfallgame.com, or by mail at Venture Returns LLC, 117 S. Lexington St., Ste. 100, Harrisonville, MO 64701, USA.

Lawful bases for processing (Article 6 GDPR):

Where we rely on legitimate interests, we have weighed those interests against your rights and freedoms; you may object as described below.

Your rights. You have the right to access, rectification (correction), erasure ("right to be forgotten"), restriction of processing, data portability, and to object to processing based on legitimate interests. Where we rely on consent, you may withdraw consent at any time without affecting prior processing. You may exercise these via Settings → "Manage my data" or privacy@fathomfallgame.com.

Automated decision-making. We do not carry out automated decision-making that produces legal or similarly significant effects on you. Matchmaking uses your rating to create balanced games and does not have such effects.

International transfers. As described in Section 10, our processors may process your data in the United States. We rely on Standard Contractual Clauses (or the UK Addendum) for those transfers.

Retention. See Section 8. Profiles are purged after 12 months of inactivity.

Complaints. You have the right to lodge a complaint with your local supervisory authority. In the UK, this is the Information Commissioner's Office (ICO, ico.org.uk). We would, however, appreciate the chance to address your concern first: please contact privacy@fathomfallgame.com.

Digital Services Act (DSA). Because the public leaderboard displays user-chosen display names, we operate a notice-and-action mechanism so anyone can report an unlawful or rule-breaking display name. See our Community Guidelines / Acceptable Use Policy and DMCA / Copyright Policy for how to report.

12. Do Not Track and Global Privacy Control

FATHOMFALL does not track users across third-party websites or services, so there is no cross-site tracking to disable. We honor the Global Privacy Control (GPC) signal: where your browser sends GPC, we treat it as a valid opt-out of any sale/sharing (we do neither) and decline non-essential storage that would otherwise depend on consent.

13. Changes to this Policy

We may update this Policy as the Game evolves (for example, if optional account creation is introduced). When we do, we will revise the version number and effective date below and, for material changes, provide a more prominent notice in the Game. Your continued play after an update means you accept the revised Policy to the extent permitted by law.

14. Contact us

Operator / data controller: Venture Returns LLC, 117 S. Lexington St., Ste. 100, Harrisonville, MO 64701, USA

Privacy questions and data-rights requests: privacy@fathomfallgame.com

Copyright / DMCA notices: dmca@fathomfallgame.com

© 2026 Venture Returns LLC. All rights reserved.

Changelog

• 1.3, 2026-10-30: Unsaved guest profiles are deleted after 30 days without a visit (Section 8). The guest key is a cookie that page scripts cannot read, or a Keychain item on iPhone (Section 3.2). Backup codes and the hashed phone number for recovery (Section 3.6).
• 1.2, 2026-10-15: Optional phone sign-in, the sign-in provider, the managed database, and in-game export and deletion of analytics events.

• 2026-10-17, editorial: Punctuation only (each dash became a colon or a comma). No change in meaning, so the version is unchanged and no new acceptance is needed.
• 1.1, 2026-06-23: Named Venture Returns LLC (a Missouri limited liability company) as the operator of the Game and the data controller; added the controller's postal address and the copyright notice.
• 1.0, 2026-06-21: Initial publication.