Privacy.

Who this notice covers

Lynxwares is the parent platform for Iced Fox Studios and other projects. This notice covers the Lynxwares website and Lynxwares Account. Connected platforms keep their own records and explain their processing in their own privacy notices.

Information we handle

• Account and profile: an internal identifier, username, display name, an email address when provided, verification status, optional biography and profile colour.
• Authentication: a password hash if password sign-in is enabled, connected provider identifiers, and passkey public-key credentials and labels. We do not receive your device’s fingerprint or face scan.
• Security and history: session identifiers and timestamps, sign-in and account-change events, application permissions and deletion requests.
• Service requests: IP addresses are processed for abuse prevention.

Optional profile details are your choice. An account identifier and an available sign-in method are necessary to operate your account.

Signing in with Google

Google sign-in requests only openid, email and profile. Google may return your account identifier, email and verification status, name and profile picture. Lynxwares stores the identifier to recognise your connection; when creating an account, it uses your display name and verified email when available. The current implementation does not save your Google profile picture.

These permissions do not provide access to Gmail messages, Drive files, contacts or your Google password. Google tokens are used to complete sign-in and are not saved for later access to Google services.

This application uses Google sign-in data for authentication and your account, not for advertising, sale or AI model training. If you later approve a connected platform, selected details from your Lynxwares profile may be shared as described below.

You can disconnect Google in Account → Connections once another sign-in method is available. You can also review or remove access in your Google Account. Disconnecting does not delete your Lynxwares profile.

Discord and Twitch

Discord sign-in requests your account identity and email. Twitch sign-in requests its basic OpenID identity. We store the provider’s account identifier and use an available display name and verified email when creating a profile. Provider tokens are not saved for later API access.

A matching email does not automatically merge accounts. Sign into your existing profile first and use Connections to add a provider.

Connected platforms

Before approving a new connection, you see the application and requested information. The connection identifies your Lynxwares account. Optional profile access shares your username and display name; optional email access shares your email and verification status when available.

The platform receives Lynxwares credentials for that connection, not your password or Google, Discord or Twitch tokens. Administrative permissions do not transfer between platforms.

Revoking a connection in Account → Connections removes Lynxwares’ authorisation for that app. It does not erase data the platform already holds or automatically end a separate session there. Manage those records and sessions with that platform.

How we use your information

We use account information to let you sign in, maintain your profile, connect the applications you approve and respond to account requests. Security records help protect accounts and prevent abuse.

You choose which optional profile details to provide and which platform connections to approve. You can withdraw optional permissions in your account settings.

Cookies and passkeys

The necessary LYNXSESSION cookie supports your session and sign-in security. Sessions currently expire after eight hours of inactivity. Signing out invalidates the current session; other sessions can be revoked in Account → Security.

This version has no advertising or analytics integration. Sign-in providers process requests on their own screens under their own policies. Passkey private keys and biometric checks remain under the control of your device or passkey provider.

Retention and deletion

Account details and connections remain while the account is active or until the relevant data is removed. A deletion request is recorded for owner review; it is not immediate erasure and can be cancelled while pending.

Verification and recovery links expire after 30 minutes and can be used once. Expiry of a link or session does not delete your account or its history. Contact us if you have questions about records associated with your account.

Who can access your information

Sign-in providers process authentication on their services. Connected platforms receive the account scopes you approve. The site operator can access records to administer the service and respond to security and data requests.

Your controls and rights

You can edit your profile, manage connections and sessions, download an account-data export and request deletion from your account. Removing Lynxwares does not automatically delete profiles on connected platforms.

Where applicable, data-protection law provides rights of access, correction, erasure, restriction, portability and objection, withdrawal of consent and a complaint to the relevant supervisory authority. Contact lynxwares.mail@gmail.com to raise a request. Proportionate identity verification may be needed; do not send passwords or sign-in codes.

Changes to this notice will be reflected in the date shown above.