Shelf Fighters — Privacy Policy
Effective 12 September 2026 · Applies to the public release of Shelf Fighters
(dev.titleos.shelffighters)
Shelf Fighters is made by Sothis Gaming, the trading name of an independent developer. There is no company behind it and no team — one person is responsible for this app and for the data it holds.
This policy explains exactly what the game stores, what it does not, and how to have it erased. It is written to be read rather than to be defensible.
The short version. Shelf Fighters collects your Play Games player ID, your display name, and your game progress. It contains no advertising, no analytics, and no tracking of any kind. It never collects your location, your email address, your contacts, or any photograph. Nothing is ever sold or shared. You can delete everything from inside the app at any time.
What is collected
| Data | Why |
|---|---|
| Google Play Games player ID | To identify your account so your roster follows you between devices. This is the only identifier stored, and it is not your email address. |
| Display name | Supplied by Play Games. Shown on leaderboards and to nearby players during a proximity battle. |
| Scanned barcodes | The digits of product barcodes you scan, which the game turns into fighters and items. No photograph is stored or transmitted — the camera decodes the barcode on your phone and only the resulting number is sent. |
| Game progress | Energy balance, stat upgrades, story and Endless progress, Lexicon unlocks, chosen avatar, and the timestamps of those events. |
What is not collected
- No location. None, ever. See the note on Bluetooth below.
- No email address. The app never asks for one and the server has no field to store one.
- No advertising identifier, and no advertising of any kind.
- No analytics. There is no analytics or telemetry library in the app.
- No contacts, photos, files, microphone, or browsing history.
- No payment details. Google Play handles the purchase; Sothis Gaming never sees your card.
About the Bluetooth and location permissions
Proximity battles let two phones in the same room play each other directly. Android historically treated Bluetooth scanning as a location capability, so on some Android versions the system will ask for location permission in order to find a nearby phone.
Shelf Fighters does not read, store, or transmit your location. The permission is used solely to discover a nearby device. Proximity battles are exhibition matches: their results are never recorded, never uploaded, and never affect your account.
Crash reports
Sothis Gaming adds no crash-reporting library to the app. Google Play collects crash and performance data for apps installed through it, under Google's privacy policy and subject to the diagnostics setting on your device. Sothis Gaming sees aggregated crash reports through the Play Console but receives no personal data with them.
Who else receives data
Nothing is sold, and nothing is shared for advertising. The only third party involved is Google:
- Google Play Games — sign-in and, where used, achievements and leaderboards.
- Google Play — distribution, payment, and the crash reporting described above.
Game data is stored on a private server operated by Sothis Gaming and is transmitted over an encrypted HTTPS connection.
Deleting your account
In the app: Profile → Delete my account.
This is the complete route and the one to use. It erases your account and everything attached to it — roster, fighters, items, upgrades, energy, story and Endless progress, and Lexicon unlocks — from the server, and clears the copy held on your phone. It takes effect immediately and cannot be undone.
If you can no longer open the app — for example you have lost or replaced the device — email titleos@titleos.dev with the subject:
Shelf Fighters Account Deletion Request
Include your User ID. It is on the Profile screen under "Account" — tap it to copy it to your clipboard, then paste it into the email. It looks like this:
3f2a91c4-7b0e-4d18-9a55-1c6e2f4b8d03
The User ID is the only thing that reliably identifies an account. No email address is stored against your account, so a request without it usually cannot be matched to the right player. Where possible, send the email from the Google account you play on as well — it helps, though it is the User ID that does the work.
What is kept after deletion
Deletion removes everything described above. There is one narrow exception, and it is stated here because a policy claiming otherwise would be untrue:
- If an account is subject to an active ban when it is deleted, a one-way cryptographic hash of the Play Games player ID is retained, together with the reason and expiry, so the ban cannot be escaped by deleting the account and signing up again. No name, no game data, and no readable identifier is kept — the hash cannot be turned back into an account. It is deleted automatically once the ban expires, and in the case of a ban with no expiry it is deleted after five years at the latest.
- Administrative records of moderation actions are retained, with the reference to the deleted account removed.
Accounts that are not banned leave nothing behind at all.
Retention
Deleted data is removed from live systems immediately and purged from encrypted database backups within 30 days.
Your rights
If you are in the UK or the European Economic Area
Under the UK GDPR and EU GDPR you have the right to access your data, to have it corrected, to have it erased, to receive a copy in a portable format, to restrict or object to its processing, and to withdraw consent where processing relies on it.
The lawful bases relied on are performance of a contract — storing your roster and progress is the service the game provides — and legitimate interests, limited to preventing cheating and abuse.
You also have the right to complain to a supervisory authority. In the UK that is the Information Commissioner's Office; in the EEA it is the authority for your country.
If you are in California
Under the CCPA and CPRA you have the right to know what personal information is collected, to have it deleted, to have it corrected, and not to be discriminated against for exercising those rights.
Sothis Gaming does not sell or share personal information as those terms are defined by the CCPA, and has never done so. There is therefore no opt-out to offer.
Everyone
Whatever your location, the deletion route above is available to you, and questions may be sent to titleos@titleos.dev.
Children
Shelf Fighters is not directed to children under 13, and accounts are not knowingly created for them. If you believe a child has created an account, email the address above and it will be removed.
Security
Data is transmitted over HTTPS and stored on a server with restricted administrative access. No system is perfect, and no promise is made here that cannot be kept; if a breach affects your data you will be informed through the app and, where the law requires it, through the relevant authority.
Changes to this policy
If this policy changes materially, the effective date at the top will change and the change will be announced in the app before it takes effect. Past versions are available on request.