Privacy Policy

Operator: Final Boss Games ("we", "us") · Last updated: 9 October 2026
Privacy contact: privacy@bossfeed.fun · [mailing address]

1. What this policy covers

This policy explains what we collect when you use any of our "Services":

• bossfeed.fun and its other addresses (bossgames.fun, theboss.games, www.bossfeed.fun),
• surviversus.com (it forwards to bossfeed.fun),
• finalbossediting.com,
• our party games (played on a TV and phones), daily puzzles and browser games, our mobile app if you install it, and our Discord and Twitch bots, and
• versions of our games on game portals (itch.io, Viverse, CrazyGames, Poki and others) that send gameplay statistics back to us.

The short version: you can play without an account. We use a random ID so votes and progress work. Only if you say yes do we use analytics to see what is fun and what is broken. We do not sell your data, we do not show ads on our own sites, and you can delete your account.

2. Information we collect

2a. When you just visit or play (no account)

2b. Analytics (only with your consent)

The first time you visit, a banner asks. If you choose Accept (or switch analytics on in Cookie settings), we load:

• Google Analytics 4 (two measurement IDs, one for the site and one through Firebase), which sets _ga cookies and records pages, events, device and approximate location;
• our own activity record, stored in our database against your anonymous ID: pages and games you open, the labels of buttons you tap, puzzles solved, experience points earned, how you first arrived (the referring web address), visit counts, your approximate location (country, region, city, postal code area and metro area, worked out by our host from your IP address; never your precise location), your network (internet provider name, connection type), device class, screen and window size, language and time zone. We store a scrambled form of your IP address, never the IP itself;
• Surviversus game statistics when you play it on our site (see 2f);
• Microsoft Clarity, only if you also allow session recording: it records how pages are used (clicks, scrolling, taps and the text shown on screen, with what you type masked) to find bugs and confusing screens, and may link a recording to your anonymous ID. It never runs on account, admin or the most active game pages.

If you choose Reject, or your browser sends a Global Privacy Control signal and you have not chosen otherwise, none of these load, and the site works exactly the same. Our early-learner math practice page and our teachers page never load analytics, session recording or sign-up prompts, whatever you choose.

2c. When you create an account

You must be 13 or older to create an account, and you confirm that, and that you agree to our Terms and this policy, by ticking a box before the account is made. We record when you ticked it and which version you agreed to. You can sign in with Google or an emailed sign-in link (and, in the app, Apple). We collect:

• your email address and sign-in provider (from Google: your name and profile photo, kept only in the sign-in record);
• the username and avatar you choose, and your level, XP, streak, solve counts, badges, Sparks and Crowns: these appear on your public profile and leaderboards;
• your saved progress (unlocks, keys, collections, cosmetics) and the posts you have already seen, so the feed does not repeat itself on your other devices;
• your email preferences.

2d. When you post or take part

• Posts, comments, votes, poll answers, Sparks questions and answers, drawings, quest answers, Marble Rush tracks: public (except votes, which are counted, not shown by name).
• Images you upload: we re-encode them in your browser, which removes hidden location (EXIF) data, and store them with our host.
• Books or files you add to your personal library: stored privately for you.
• Submissions (puzzles, stories, art) with the name, email and links you give us, so we can reply and credit you.
• Reports you make, and moderation records about content that breaks our rules.
• Bluesky: if you connect your Bluesky account, we store the session token needed to post on your behalf until you disconnect.

2e. Party games

When you join a party game from your phone, the name you type and your in-game inputs pass through our real-time relay to the host screen. The relay does not keep them after the room closes. We keep session statistics (for example how many players and how long a round lasted), not what you typed.

2f. Surviversus and game portals

When you play Surviversus on bossfeed.fun, it sends gameplay statistics to us only if you allowed analytics. Our games published on portals (itch.io, Viverse, CrazyGames, Poki and others) send gameplay statistics to bossfeed.fun: a random per-browser player ID (not your portal account), a session ID, which portal and build, device type, country, and match and performance events. Portal builds respect Global Privacy Control and the in-game "no tracking" setting. The portal itself may also collect data (for example CrazyGames shows ads through its own software on its own site); its privacy policy applies to that.

2g. Emails

• Sign-in links: sent only when you ask.
• Daily puzzle email and Sunday newsletter: sent only if you switch them on (on your account page, or on a newsletter form). Every one has a one-click unsubscribe link, which stops both, and our postal address. We measure opens and clicks so we can pause the daily email for people who stop reading it.
• Replies to submissions and support requests.

2h. Optional widgets

• Weather and "nearby": if you allow location, your device rounds it to about 1 km and sends it to weather and events services (Open-Meteo, OpenStreetMap, Ticketmaster). We do not store it.
• Read-aloud voice, PDF and image text tools: run in your browser and download their models from public code libraries (Hugging Face, jsDelivr, cdnjs), which see your IP address.

2i. Bots

Our Twitch bot stores the Twitch name and lines of chatters who join a story so the finished story can be shown. Our Discord bot only posts puzzles; it does not collect Discord user data.

Microsoft Clarity session recording, in detail

Clarity is a Microsoft service. It runs only if you allow session recording in Cookie settings (or press Accept all). When it runs, it makes a session replay of the page (what was on screen, clicks, scrolling and taps; anything you type into a form is masked) and builds heatmaps of where people tap, so we can find buttons that confuse people. If you keep clicking the same spot (repeated clicking), that session is tagged as a frustrated click so we can find it.

So we can find one player's recording when they report a bug, your browser tells Clarity your anonymous account identifier; Clarity's script scrambles (hashes) it in your browser before it is sent, and the first 8 characters are sent as a short label. Your email address is never sent to Clarity. It never runs on /account/, on the admin and analytics pages, or on our busiest real-time games.

3. How we use information

To run the Services and save your progress; to show leaderboards, profiles and posts; to send the emails you asked for; to keep the Services safe (spam, cheating, abuse, bots); to understand and improve the games (only with your consent for analytics); to respond to you; and to comply with law. We do not sell your personal information and we do not share it for cross-context behavioural advertising. We do not use your personal information to train AI models.

4. Who we share it with

• Service providers that host and run the Services for us, listed in full on our Subprocessors page: mainly Google (Firebase, Firestore, Analytics, BigQuery), Cloudflare (hosting, storage, security checks), Microsoft (Clarity, only with consent), Brevo (email) and Supabase (puzzle content).
• Other players and the public: anything public by design (username, avatar, level, scores, posts, comments).
• Services you connect: Bluesky, Google, Apple, Twitch.
• Legal and safety: if required by law, or to protect people, the Services or our rights.
• Business change: if we form a company or the Services are transferred, your data moves with them under this policy.

5. Cookies and similar technology

See our Cookie Policy. Strictly necessary storage is always on; analytics only with consent. Change your choice any time with Cookie settings at the bottom of any page.

6. How long we keep it

7. Your choices and rights

Everyone can:

• Delete your account from your Account page (Delete account). This removes your profile, username, saved progress, email preferences, private vote and comment lists and your sign-in record straight away. To also have your posts, comments, activity record, leaderboard names, uploads, newsletter entry or Bluesky connection removed, email privacy@bossfeed.fun and we will do it within 45 days.
• Download your data from your Account page (Download my data): a file with your profile, saved progress, email preferences, votes, seen history and visit summary. For a copy of what is held only on our servers (posts, comments, leaderboard rows, game statistics), email privacy@bossfeed.fun from the address on your account.
• Correct your username, avatar and email preferences on your Account page.
• Unsubscribe from any email with one click.
• Reject or withdraw analytics consent at any time with Cookie settings at the bottom of any page.

California residents (CCPA/CPRA) have the right to know what personal information we collect, use and disclose; to access it; to delete it; to correct it; to opt out of the sale or sharing of personal information; to limit the use of sensitive personal information; and not to be discriminated against for exercising these rights.

• We do not sell personal information. Because some analytics tools could be seen as "sharing" under California law, we provide a "Do Not Sell or Share My Personal Information" link at the bottom of every page, which turns analytics off for your browser. We honour Global Privacy Control signals as an opt-out in the same way.
• We do not collect sensitive personal information as defined by the CCPA, other than account sign-in credentials used only to log you in.
• To make a request, use the Account page tools or email privacy@bossfeed.fun. We will verify the request (usually by confirming from the email on the account) and respond within 45 days. You may use an authorised agent.
• We have no actual knowledge of selling or sharing personal information of consumers under 16.

Visitors from the EU, UK and elsewhere: you have similar rights (access, correction, deletion, portability, objection, withdrawing consent) and may complain to your local data protection authority. Our legal bases are: performance of our Terms (accounts, progress, emails you ask for), consent (analytics, optional emails), and legitimate interests (security, abuse prevention).

8. Children

The Services are for a general audience and are not directed at children under 13. Some puzzles are suitable for younger players and teachers may use them in class, but accounts, posting, uploads and email sign-ups are for people 13 and older, and our early-learner math practice page and teachers page do not load analytics, session recording or sign-up prompts. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has given us personal information, email privacy@bossfeed.fun and we will delete it.

9. Security

We use encrypted connections (HTTPS), access rules on our databases, encrypted storage by our providers, bot checks and rate limits. No system is perfectly secure. We will notify you of a breach affecting your data as the law requires.

10. International users

We are based in the United States and our providers store data in the US and other countries. By using the Services you understand your data will be processed there, with the protections described here.

11. Third-party links and embeds

YouTube videos, Bluesky posts, RSS headlines and links to other sites are governed by those sites' policies. Videos load only when you press play.

12. Notice at collection (California summary)

13. Changes

We will post changes here and update the date. For material changes we will give notice on the site and, if you have an account with an email, by email, before they apply.

14. Contact

Final Boss Games · privacy@bossfeed.fun · [mailing address]

See also: Terms of Use · Cookie Policy · Service providers · About