Privacy Policy

To exercise a privacy right or report a concern, email privacy@fopull.com or see our full contact directory.

1. Scope & who we are

This Privacy Policy describes how Fopull LLC ("Fopull," "we," "us") handles personal information when you use the websites at fopull.com and its subdomains, the Foverse community platform, the Deviant game and its supporting APIs, and any related services (collectively, the "Services"). It does not cover services run by third parties (for example, an OAuth application you authorize, or a website we link to).

If you are an employee of Fopull LLC using the internal dashboard at internal.fopull.com, separate internal policies apply to that environment.

2. Information we collect

(a) Information you give us

• Account & identity: name (chosen display name), email address, password (stored only as a salted hash), date of birth, and your acceptance of these terms (timestamp + version).
• Profile content: avatar image, biography text, username color, font selection, custom profile CSS, and any other profile customization you submit.
• Two-factor authentication: if you enable 2FA, we store the TOTP secret (encrypted), one-time codes (hashed) you receive, and a list of devices you mark as trusted (token hash, IP, user-agent, last-used time, expiration).
• User-generated content: blogs, posts (and their attachments up to 20 MB each), comments, profile comments, reactions, trading-card and marketplace activity, friend / block lists, push-notification subscriptions, and notification preferences.
• Direct messages: the conversations you create, messages you send (text and attachments), read state, and your edit history. We can read message contents to operate the service, troubleshoot, enforce these terms, and respond to legal process — but we don't read messages for advertising or analytics.
• Contact form (fopull.com): name, email, optional company, subject, message.
• Job applications: name, email, optional phone, role applied for, LinkedIn URL, portfolio URL, cover letter, resume file.
• Deviant characters: character name, slot index, and the character data JSON (which may include race, level, stats, inventory, equipment, alignment, covenant, super cards, power, and other game-state attributes).

(b) Information collected automatically

• Sessions & cookies: a session cookie, a CSRF cookie, a "remember me" token if you choose, and 2FA trusted-device tokens (see §7).
• Technical metadata: IP address, user-agent string, request time, and basic device information needed to operate the Services securely.
• Security logs: login attempts, 2FA code issuance and verification, password resets, OAuth authorizations, admin actions, and similar security events. These logs include the IP address and user-agent at the time of the event.

(c) Information from third parties

• Email delivery: Mailgun (our transactional email provider) may report bounces, complaints, and delivery status for messages we send to you.

(d) What we do not collect

• We do not run Google Analytics, Facebook Pixel, advertising trackers, or any third-party analytics on the Services.
• We do not store payment-card data. Fobucks are not sold for real money and we do not process credit-card payments.
• We do not knowingly collect personal information from anyone under 13 (see §13).

3. How we use information

• Operate the Services: create and authenticate your account, deliver content you and other users post, run the marketplace and trading-card systems, sync Deviant character saves, send notifications you have enabled.
• Security & abuse prevention: detect and prevent fraud, account compromise, cheating in Deviant, spam, and other violations of the Terms.
• Communicate with you: send transactional messages (verification codes, password resets, account notices). We do not send marketing email today; if we ever do, we will obtain consent and provide an unsubscribe mechanism.
• Comply with law & protect rights: respond to lawful requests, enforce the Terms, defend legal claims, and (where required) report child-sexual-abuse material to NCMEC per 18 U.S.C. § 2258A.
• Improve the Services: investigate bugs, plan features, and understand aggregate (non-identifying) usage patterns.

4. Legal bases (for users in the EEA / UK)

• Contract — to provide the Services you registered for.
• Legitimate interests — to keep the Services secure, prevent abuse, and improve product quality, balanced against your rights.
• Consent — where we ask for it (for example, your acceptance of the Terms, or optional push notifications). You may withdraw consent at any time.
• Legal obligation — to comply with applicable laws.

5. How we share information

We do not sell personal information. We share information only as described below.

(a) With other users, by design

Some information is meant to be public on Foverse: your display name, avatar, profile, blogs, posts, comments, reactions, friend list (if you make it public), and inventory (if you make it public). Direct messages are only visible to the participants.

(b) With service providers ("subprocessors")

We use a small number of vendors to operate the Services. They process personal data only on our instructions and only as needed to provide their service:

Vendor	Purpose	Data shared
Mailgun (Sinch) policy	Transactional email delivery (verification codes, password resets, notifications).	Email address, message body.
Cloudflare policy	CDN, DDoS protection, and tunnel ingress for our self-hosted servers.	IP address, request metadata (standard HTTP headers).

(c) With third-party applications you authorize

If you authorize a third-party application via OAuth (for example, the Deviant Unity client), we share the data shown on the consent screen with that application. See §6 for details.

(d) For legal reasons

We may disclose information when we believe in good faith that disclosure is required by law, subpoena, court order, or other legal process, or is necessary to protect the rights, property, or safety of Fopull LLC, our users, or the public.

(e) In a business transfer

If Fopull LLC is involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred subject to standard confidentiality protections and notice where required.

6. OAuth & third-party applications

You can grant third-party applications access to your Foverse account using our OAuth 2.0 / PKCE flow. When you authorize an application, we display a consent screen listing what the application will receive — typically your user ID, name, email address, avatar URL, and (when applicable to that integration) your Fobucks balance, two-factor-enabled flag, and inventory-visibility setting, along with the specific scopes/abilities the application requested.

Once an application has your data, it is governed by that application's terms and privacy policy. We are not responsible for how third-party applications use your data. You can revoke any authorization from your account settings.

7. Cookies & similar technologies

We use only the cookies and storage strictly necessary to provide the Services. We do not use third-party advertising or analytics cookies.

Name (prefix)	Purpose	Type
Session cookie	Keeps you signed in and remembers your session state.	First-party, strictly necessary.
CSRF cookie (XSRF-TOKEN)	Protects against cross-site request forgery.	First-party, strictly necessary.
"Remember me" cookie	If you check "remember me," keeps you signed in across browser restarts.	First-party, functional.
2FA trusted-device cookie	If you choose to trust a device, lets you skip the 2FA challenge on that device until it expires.	First-party, security.

Most browsers let you block or delete cookies. Blocking strictly-necessary cookies will prevent you from signing in.

8. Data retention

• Account data — retained while your account is active. When you delete your account, we delete or anonymize your personal information within a reasonable period, except where retention is required by law or for legitimate operational reasons (for example, fraud prevention, security logs, or backups that age out on their normal cycle).
• Direct messages — visible until you or the other participant deletes them. We delete old messages on a rolling schedule (currently 7 days for trashed messages, subject to change).
• Contact-form inquiries & job applications — retained for up to 24 months for record-keeping, then deleted. You may request earlier deletion by emailing us.
• Security logs & audit trails — retained for up to 24 months for security and fraud-prevention purposes.
• Backups — overwritten on their normal cycle. Deleted records may persist in backups until that cycle completes.

9. Security

We implement reasonable technical and organizational measures to protect personal information, including:

• Encryption in transit (HTTPS / TLS) across the public Services;
• Password hashing (industry-standard one-way hashing — we cannot recover your password);
• Optional two-factor authentication with TOTP, trusted-device management, and password-reset throttling;
• Audit logging for administrative actions;
• Separation of internal employee systems (internal.fopull.com) from the public Services at the session-cookie level;
• Server-authoritative validation for Deviant character data, with optimistic concurrency to prevent replayed saves.

No system is perfectly secure. You can help by using a strong, unique password and enabling 2FA.

10. Your rights & choices

Subject to applicable law, you can:

• Access & download a copy of your personal information;
• Correct inaccurate information;
• Delete your account and associated personal information (from your account settings, or by contacting us);
• Object to or restrict certain processing;
• Withdraw consent where we relied on it;
• Revoke OAuth authorizations at any time from your account settings;
• Opt out of push notifications from your browser or device settings, and from in-app notification preferences;
• Lodge a complaint with your local data-protection authority (EEA / UK users).

To exercise any right, contact privacy@fopull.com. We will respond within the timeframe required by applicable law.

11. U.S. state privacy rights

Residents of certain U.S. states (including California, Colorado, Connecticut, Virginia, Utah, Texas, and — beginning July 1, 2025 — Tennessee under the Tennessee Information Protection Act) may have additional rights, including the right to access, delete, correct, port, opt out of "targeted advertising" / "sale" / "profiling," and appeal denials of requests.

We do not "sell" or share personal information for targeted advertising as those terms are defined under those laws. You can exercise your rights by emailing privacy@fopull.com. If we deny a request, you may appeal by replying to our response.

12. International users & data transfers

The Services are hosted in the United States. If you access them from outside the U.S., your information will be transferred to and processed in the United States, where data-protection laws may differ from those of your country. By using the Services, you consent to that transfer.

13. Children & minors

The Services are not directed to children under 13, and we do not knowingly collect personal information from them. We require every user to confirm their date of birth at registration; existing users are prompted to confirm before continuing to use Foverse. If we learn that we have collected personal information from a child under 13 without verifiable parental consent, we will block the account and delete the information promptly.

Parents or guardians who believe their child has provided personal information without consent may contact privacy@fopull.com.

14. Breach notification

If we discover a security incident that compromises your personal information, we will notify you and any regulator as required by applicable law. For Tennessee residents, this includes the notification timeframe in Tenn. Code Ann. § 47-18-2107 (generally no later than 45 days after discovery, subject to law-enforcement delays).

15. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the "Version" and "Effective" dates above and, for material changes, post a notice in the Services or send you a notification. Your continued use of the Services after a change takes effect constitutes your acceptance of the revised policy.

16. Contact

• Privacy questions and rights requests: privacy@fopull.com
• General / legal: legal@fopull.com
• Mail: Fopull LLC 8913 Town and Country Circle #1132 Knoxville, TN 37923

Fopull LLC is a Tennessee limited liability company (TN Control # 001558671).