Privacy policy
Last updated: September 27, 2026
This policy covers www.foxtilo.com and the waitlist for the Foxtilo launch email. It does not cover accounts, gameplay or purchases in the mobile game.
Who is responsible for your data
The controller of your personal data is Norbert Nowacki, a sole trader based in Słupsk, Poland, NIP 8392975165, registered in CEIDG. Foxtilo is a product of the controller, operating under the Codapi brand.
For privacy questions, requests concerning your data or withdrawal from the waitlist, email kontakt@codapi.pl.
The launch waitlist
When you sign up, we send your email address and the language of the signup page to Resend, which stores the waitlist. We use these details to send one email when Foxtilo launches, in the language you selected.
The legal basis is your consent under Article 6(1)(a) GDPR. You give consent by entering your email address and choosing the notification button. Providing an email address is voluntary. Without it, we cannot send you the launch notification; you can still browse the website.
Joining the waitlist does not create a game account or subscribe you to an ongoing newsletter.
Website operation and enquiries
Our hosting provider, Vercel, processes technical request data to serve and protect the website. This can include your IP address, the requested URL, request time, browser information and error details. The signup endpoint also temporarily keeps your IP address and request timestamps in server memory to limit repeated submissions.
We process this data on the basis of our legitimate interest in operating a reliable website and preventing abuse, under Article 6(1)(f) GDPR.
If you email us, we process your address and the information in your message to answer your enquiry. The legal basis is our legitimate interest in handling correspondence, under Article 6(1)(f) GDPR. When your message concerns a data-protection request, we process it to meet our legal obligations under Article 6(1)(c) GDPR.
Service providers and transfers abroad
Vercel Inc. provides website hosting and runs the signup endpoint. Resend (Plus Five Five, Inc.) stores waitlist contacts and provides email delivery. If you contact us by email, our mailbox provider also processes the correspondence. We do not sell waitlist data or share it with other businesses for their own marketing.
These services may process personal data outside the European Economic Area, including in the United States. Resend's data-processing terms provide for EU Standard Contractual Clauses for transfers that are not covered by an adequacy decision. Vercel describes its transfer safeguards in its data-processing terms and privacy notice. You can contact us for information about the safeguards applicable to your data and a copy of them.
Withdrawal and retention
You can withdraw your consent at any time by emailing the privacy contact above from the address you used to sign up. Tell us that you want to leave the Foxtilo waitlist. We will stop using your address for the launch notification. Withdrawal does not affect processing carried out lawfully before it.
We keep your waitlist email and language for the launch notification, until you withdraw consent or the notification has been sent. We then remove these details from the waitlist. If we abandon the launch notification, we remove the list when it is no longer needed.
The signup form temporarily keeps IP addresses and request times in server memory to prevent repeated submissions. This data is discarded when that server process ends. Hosting logs follow the provider’s applicable retention cycle; records needed to investigate a specific security incident may be retained until the investigation is resolved.
We keep correspondence until the enquiry or request is resolved. Where particular records are needed to meet a legal obligation or establish, exercise or defend a legal claim, we keep only those records for the applicable statutory period or until the dispute is resolved. They are not used for further launch emails.
Cookies and analytics
The website does not use analytics or advertising trackers. Our site code does not store cookies or use your browser's local or session storage. Your language is determined by the page URL. Fonts and images are served with the website.
Technical request processing by the hosting provider still takes place when you visit, as described above.
Your rights
Subject to the conditions in the GDPR, you can request access to your personal data and a copy of it, correction, deletion or restriction of processing. You can request portability of data you provided where processing is based on consent and carried out by automated means.
You can object, on grounds relating to your particular situation, to processing based on our legitimate interests. You can withdraw consent to the launch email at any time. Withdrawal does not affect the lawfulness of processing before you withdrew it.
You can also complain to a data-protection supervisory authority, including the President of the Polish Personal Data Protection Office (UODO), or the authority in the EU country where you live or work.
We do not use your website or waitlist data for profiling or decisions based solely on automated processing that produce legal or similarly significant effects.
Changes to this policy
We will update this page when the way this website handles personal data changes. The date above identifies the current version.