Endz privacy

Your character and progress

Endz stores your character, wardrobe, progress, jobs and settings on your device, or in browser storage when you play on the web. You do not need an Endz account to play, and the game does not provide cross-device cloud saves. Your device or browser backup settings may keep copies separately. Clearing local storage can erase progress; turning gameplay stats off does not reset your game.

The in-game phone contains prepared character messages and choices. It does not read your phone’s contacts or real text messages. Music, ambience, effects and voice notes use prepared recordings. Playing a voice note does not record your microphone.

Waitlist emails

If you join the Endz waitlist on playendz.app, we store your email address, whether you asked about the game, the Season 1 episodes or both, the wording you agreed to and when you joined. We also store your device type (iPhone, Android or desktop, read from your browser’s user-agent header), any campaign tags or referring website in the link you arrived from, and a keyed one-way hash of your network address that we use only to limit repeated sign-ups. You must be 13 or older to join.

We use this information, with your consent, to email you when the Endz game launches and when Season 1 episodes are released. Every email has an unsubscribe link. Unsubscribing stops waitlist emails; we keep a record that you unsubscribed so we do not email you again. To have your entry deleted, email hello@chewybytes.com. We keep waitlist entries until you unsubscribe or ask us to delete them, or until we stop sending launch and episode emails.

The waitlist is stored in a Neon Postgres database, and emails are sent through Resend, an email delivery service. We do not sell the list or share it for other companies’ marketing.

Website analytics

playendz.app uses Vercel Web Analytics to count page views and three interactions on the waitlist page: answering the call, joining (with whether you chose the game, the episodes or both) and sharing. Endz does not add your email address or an identifier of its own to these events. Vercel receives the page address, referrer and technical browser and network information with each request. This is separate from the optional gameplay stats described below.

Optional sharing

Endz is intended for players aged 13 and older. You can play the full game without declaring an age band or enabling optional sharing. On mobile, gameplay stats and crash/performance reporting are separate choices and both start off. Browser gameplay stats have their own local choice; browser crash reporting remains off.

Optional gameplay stats

Gameplay stats start off. A local ‘18 or over’ declaration makes this separate setting available; it does not turn sharing on. You then choose On in Credits. You can play the full game without declaring an age band. Under-18, unknown and unverifiable settings keep optional sharing off. Mobile and browser choices are stored separately. When you turn sharing on and the analytics service is configured, Endz can send PostHog events about character setup, wardrobe visits, jobs, choices, outcomes, upgrades, estates and progression. Events include game item, job and area identifiers, counts, durations, rank, XP, fictional currency and gameplay results, together with app and platform information.

On mobile, PostHog adds technical information and random installation or session identifiers. This can include device model, operating system, screen size, app and build version, language and time zone. On the web, Endz sends explicit gameplay properties, an event timestamp and a random analytics identifier stored with your sharing choice in browser local storage. That identifier is reused while sharing stays on and replaced after turning sharing off and on. Earlier browser On choices do not establish eligibility or enable sharing under the current policy. These identifiers can associate events; the data is not necessarily anonymous. Endz does not intentionally include your character name, full save, raw messages or movement coordinates in gameplay events.

Age-band choices stay locally on the mobile installation or in this browser storage. No date of birth or identity document is needed, and the age band is not sent in gameplay events. A saved Under 18 choice stays protective for the current policy and storage scope; it cannot be changed through these settings. This is not age verification, does not identify who is using a shared device and does not automatically reconsider birthdays. Changing an age choice turns the affected sharing off.

On the web, optional event bodies pass through our Vercel-hosted service, which immediately forwards valid events to PostHog’s EU collection endpoint. The relay does not forward incoming cookie, IP-address, user-agent, referrer or proxy headers. Vercel still receives your network address and technical browser request information; PostHog receives the relay’s server request information.

The mobile gameplay-analytics adapter disables automatic session replay, lifecycle and error capture, surveys and remote feature flags, and suppresses the SDK’s remote project-configuration request. The current web adapter does not initialize the PostHog browser SDK, set analytics cookies or add page URLs, queries, fragments, referrers, campaign parameters, browser/device details or SDK session/window identifiers to gameplay payloads. Earlier versions may have stored SDK cookies or identifiers which the current adapter does not reuse. Endz requests disabled PostHog GeoIP enrichment and, on the web, disabled person-profile processing. Network services still receive network addresses and technical request information.

Turning sharing off stops future gameplay-event capture. The mobile adapter discards gameplay queues left by earlier processes before sending, applies the current eligible choice and discards waiting optional events on withdrawal. The web adapter has no event buffer or retry queue and attempts to abort outstanding requests when withdrawal is observed. Events already handed to a transport or received by a service cannot be recalled. The browser also rechecks its local choice before sending. If saving Off or an age change fails, sharing stays off for that visit and a retry is offered, but a previous saved choice may apply after reopening. An unwritten choice cannot be guaranteed in other open pages. Older browser pages need a reload to use these controls; the current relay refuses requests from adapters that predate them. Endz does not send your past save history simply because you turn sharing on. Turning sharing off does not delete information already sent or disable the separate diagnostics described below.

Mobile app updates

The mobile app can check for compatible updates after opening and when returning to the foreground, and download them through Expo/EAS services. These requests can include a random installation identifier, platform, app-update and compatibility details, and technical network information. Previous update failures can also send limited error details. Neither optional-sharing setting controls update delivery.

Crash and performance diagnostics

Mobile crash and performance reporting to Sentry and Expo/EAS Observe starts off. After a local 18-or-over declaration, choose separately in Credits → Diagnostic settings. Allow becomes effective only after local preparation and a full close and reopen; switching apps or applying an in-app update does not activate it. Turning diagnostics off stops new reporting and requests cancellation and cleanup. Endz checks for leftover report files again when it starts with diagnostics off. A failed settings save or cleanup remains visible with retry controls; a previous saved choice may apply after reopening if Off could not be saved. Cleanup completion describes that attempt, not erasure of every local or provider copy. The gameplay-stats switch does not control this separate choice.

Browser crash reporting remains off in this version. Website server and edge errors may still be reported to Sentry when configured, separately from gameplay stats. Mobile choices do not control browser or server reporting. Hosting and compatible-update requests also remain separate.

Mobile reports can include app, build and SDK versions, device and operating-system information, language, random installation or session identifiers, error messages and stack traces, technical operation labels, and startup, navigation or performance timings. Approximate location derived from a network IP address can also appear. This is not GPS tracking. While mobile reporting remains enabled, some reports queue locally while offline and can be sent when connectivity returns.

Mobile reporting disables Sentry’s default personal-information and log options. Its JavaScript error filter removes user, request and extra fields, and handled failures use bounded labels. Its JavaScript breadcrumb filter drops console and HTTP breadcrumbs. Native diagnostics can still include technical navigation, app-state and network breadcrumbs, including URL, method or status metadata. These filters do not guarantee identical handling for every native or performance report, or prevent a service from adding network metadata.

Services and local storage

PostHog receives optional gameplay stats in our EU Cloud project. Sentry receives diagnostics through our US-region organization; Expo/EAS provides mobile diagnostics and compatible-update delivery. Vercel hosts the website, provides its page-view analytics and processes optional web event bodies through the relay. Neon stores the waitlist and Resend sends waitlist emails. Google’s mail service handles support email. These services can process information internationally, including in the United States; an EU analytics region does not make every service EU-only. Contact hello@chewybytes.com for information about the applicable transfer arrangements and safeguards.

The configured collection endpoints use HTTPS. Loading the website or browser game also makes requests to its hosting service, carrying a network address and technical request information.

Local game data remains until it is replaced or removed through device or browser storage controls, subject to platform backups. Removing local data or switching gameplay stats off does not delete reports already held by diagnostic or analytics services. If you need help with information sent to these services, use the privacy contact below.

Information sent to analytics, diagnostic and email services may remain there after sharing is turned off. Service retention settings and backups can affect how long copies remain. Contact hello@chewybytes.com about retention or a request concerning your information. We do not sell gameplay information or use it to target advertising to you.

Support and privacy requests

If you email support, we receive what you choose to send, such as your reply address, problem description and optional screenshot. We use that information to respond and investigate your request. Please avoid sending passwords, payment details, full save files or unrelated personal information.

For privacy questions, email hello@chewybytes.com. Depending on the law that applies, you may request access, correction, deletion, restriction or a portable copy of your information, object to legitimate-interest processing, and withdraw consent. These rights have conditions and exceptions. You can complain to the UK Information Commissioner’s Office or your local data-protection authority. Turning off optional sharing is separate from a privacy request and does not delete reports already received.

You do not need an Endz account or an exact report ID to contact us. Start with the approximate date, platform, app version and a description. We may ask for limited further information to associate records safely; a shared IP address or device model alone is not proof. If we cannot safely associate a report with you, we explain what we checked and what information could help. We still handle the parts we can identify, such as your support correspondence. We respond within the time required by applicable law; ordinary game support has no promised response deadline.