Shelf Fighters (Canary) — Privacy Policy

Effective 15 September 2026 · Applies to the private test build, Shelf Fighters (Canary) (dev.titleos.shelffighters.canary)

Shelf Fighters is made by Sothis Gaming, the trading name of an independent developer. There is no company behind it and no team — one person is responsible for this app and for the data it holds.

This policy explains exactly what the game stores, what it does not, and how to have it erased. It is written to be read rather than to be defensible.

What is collected

What other players can see

Tapping a player's name on a leaderboard, in a challenge, or during an online battle opens their player card. Yours shows exactly this, and nothing else:

• Your display name and chosen avatar.
• The number of barcodes you have scanned — a count, never the barcodes themselves.
• The month and year you joined, never the day.
• Your badges, such as clearing story mode or Endless stage milestones.
• Your online battle record (wins and losses) and, once you have played enough ranked matches, your rating.

A player you are battling online also sees the fighter and items you brought, including their upgrades, once the battle begins. When you challenge someone, they can see whether you are in the arena, or in a battle, while your challenge is waiting for them. Nobody else can see that.

Your Google Play Games player ID and your account number are never shown to another player. You can block any player from their card. Blocking is silent: the other player is not told, and they can no longer challenge you.

What is not collected

• No location. None, ever. See the note on Bluetooth below.
• No email address. The app never asks for one and the server has no field to store one.
• No advertising identifier, and no advertising of any kind.
• No analytics. There is no analytics or telemetry library in the app.
• No contacts, photos, files, microphone, or browsing history.
• No payment details. Google Play handles the purchase; Sothis Gaming never sees your card.

About the Bluetooth and location permissions

Proximity battles let two phones in the same room play each other directly. Android historically treated Bluetooth scanning as a location capability, so on some Android versions the system will ask for location permission in order to find a nearby phone.

Shelf Fighters does not read, store, or transmit your location. The permission is used solely to discover a nearby device. Proximity battles are exhibition matches: their results are never recorded, never uploaded, and never affect your account.

Screenshots

Every screen in this build carries an invisible watermark. It encodes a one-way hash of your device identifier, the build version, and the dates the app was installed and built. The hash is computed on your phone and mixed with the app's package name, so the raw identifier is never stored, never transmitted, and cannot be recovered from the image. Nothing about the watermark reaches the server — it exists only in the pixels on screen, so that an image which does leak can be traced back to the build and device it came from.

The public release of Shelf Fighters carries no watermark.

Crash reports

Sothis Gaming adds no crash-reporting library to the app. Google Play collects crash and performance data for apps installed through it, under Google's privacy policy and subject to the diagnostics setting on your device. Sothis Gaming sees aggregated crash reports through the Play Console but receives no personal data with them.

Who else receives data

Nothing is sold, and nothing is shared for advertising. The only third party involved is Google:

• Google Play Games — sign-in and, where used, achievements and leaderboards.
• Google Play — distribution, payment, and the crash reporting described above.

Canary game data is stored on private infrastructure operated by Sothis Gaming. The test server is not exposed to the public internet: it is reachable only across an authenticated WireGuard VPN tunnel, which encrypts all traffic between the app and the server before it leaves the device.

Deleting your account

If you can no longer open the app — for example you have left the test, or lost or replaced the device — email [email protected] with the subject:

SHELF FIGHTERS CANARY: DELETION REQUEST

Include your User ID. It is on the Profile screen under "Account" — tap it to copy it to your clipboard, then paste it into the email. It looks like this:

3f2a91c4-7b0e-4d18-9a55-1c6e2f4b8d03

The User ID is the only thing that reliably identifies an account. No email address is stored against your account, so a request without it usually cannot be matched to the right tester. Where possible, send the email from the Google account you play on as well — it helps, though it is the User ID that does the work.

This subject line is deliberately different from the one used for the public game. The two run on separate servers, and a request has to name which set of data it means.

What is kept after deletion

Deletion removes everything described above. There is one narrow exception, and it is stated here because a policy claiming otherwise would be untrue:

• If an account is subject to an active ban when it is deleted, a one-way cryptographic hash of the Play Games player ID is retained, together with the reason and expiry, so the ban cannot be escaped by deleting the account and signing up again. No name, no game data, and no readable identifier is kept — the hash cannot be turned back into an account. It is deleted automatically once the ban expires, and in the case of a ban with no expiry it is deleted after five years at the latest.
• Administrative records of moderation actions are retained, with the reference to the deleted account removed.

Accounts that are not banned leave nothing behind at all.

Retention

Deleted data is removed from live systems immediately and purged from encrypted database backups within 30 days.

Your rights

If you are in the UK or the European Economic Area

Under the UK GDPR and EU GDPR you have the right to access your data, to have it corrected, to have it erased, to receive a copy in a portable format, to restrict or object to its processing, and to withdraw consent where processing relies on it.

The lawful bases relied on are performance of a contract — storing your roster and progress is the service the game provides — and legitimate interests, limited to preventing cheating and abuse.

You also have the right to complain to a supervisory authority. In the UK that is the Information Commissioner's Office; in the EEA it is the authority for your country.

If you are in California

Under the CCPA and CPRA you have the right to know what personal information is collected, to have it deleted, to have it corrected, and not to be discriminated against for exercising those rights.

Sothis Gaming does not sell or share personal information as those terms are defined by the CCPA, and has never done so. There is therefore no opt-out to offer.

Everyone

Whatever your location, the deletion route above is available to you, and questions may be sent to [email protected].

Age: 13 and over

Shelf Fighters (Canary) is for testers aged 13 and over. It is not directed to children under 13, is distributed only to testers invited directly by Sothis Gaming, and is not publicly available. If you believe a child under 13 has an account, email the address above and it will be deleted.

Security

Data is transmitted inside an encrypted WireGuard tunnel and stored on private infrastructure with restricted administrative access. No system is perfect, and no promise is made here that cannot be kept; if a breach affects your data you will be informed through the app and, where the law requires it, through the relevant authority.

Changes to this policy

If this policy changes materially, the effective date at the top will change and the change will be announced in the app before it takes effect. Past versions are available on request.