Stuffed: Two Foot Hero — Privacy Policy

Last updated: 5 September 2026

This Privacy Policy explains how Waving Bear Studio (“we”, “us”, “our”) collects, uses, and shares information when you play Stuffed: Two Foot Hero (the “Game”) on Meta Quest devices via the Meta Horizon Store.

By downloading and playing the Game, you agree to the practices described in this Policy. If you do not agree, please do not play the Game.

1. Who We Are

The Game is developed and operated by Waving Bear Studio. For any privacy questions or requests, contact us at info@wavingbearstudio.com.

2. Information We Collect

We aim to collect only what is needed to run the Game, sync your progress, enable multiplayer, and keep sessions safe. We collect the following categories of information:

a. Meta account information (Meta user ID and user profile)

When you launch the Game, Meta’s Platform services provide us with:

your Meta user ID (a numeric identifier), and
your display name / username.

We use your Meta user ID to identify you across play sessions and as the key to store and retrieve your game progress. We show your display name to the other players in your session (for example on the lobby player list, on the nameplate above your character, and on leaderboards). Your Meta user ID is also transmitted, through our networking provider, to the game clients of the other players in your session solely so that Meta block lists and mute preferences can be enforced between players; it is never displayed to them. We do not receive or use your profile picture. If we are unable to obtain a Meta user ID, we instead generate a random, anonymous installation identifier on your device and use that as your save key.

b. Multiplayer presence, invitations and deep links

When you host or join a multiplayer session, we send Meta’s Platform your group presence: the in-game destination you are in (for example, the lobby), a session identifier (your room code), and whether your session is joinable. Meta uses this so that your followers and players you have recently played with can see that you are joinable, and so that you can send and receive invitations through the Meta Quest menu. When you accept an invitation, join another player, or open a deep link into the Game, Meta provides us with the launch details (the destination and the session identifier or deep-link message), which we use only to place you in the correct session. We clear your group presence when you leave a session, and we do not store this information.

The list of people you can invite (your followers and recently-played-with users) is displayed by Meta’s own system interface. We do not receive, access, or store your followers or friends list.

c. Game progress and statistics

We store your gameplay data so it persists across sessions and devices, including:

player progression (level, unlocks, cosmetics),
map and weapon progression,
in-game scores and statistics (such as highest wave reached), and
settings and preferences related to your account.

This data is stored on our backend provider (Microsoft PlayFab — see Section 4) and synced as cloud saves.

d. Leaderboards

If you appear on a leaderboard, your display name, your player level, and your relevant scores and statistics (such as highest wave reached) are stored on our backend and shown to other players.

e. Achievements

Achievement progress and unlocks are processed through Meta’s Platform achievements service.

f. Voice chat (microphone)

The Game includes optional in-game voice chat. When voice chat is active, your microphone audio is captured and transmitted in real time to the other players in your session through our networking provider (Photon Voice by Exit Games — see Section 4). We do not record, store, or otherwise retain your voice audio. You can mute other players locally at any time, mute your own microphone, and you can decline the microphone permission on your device.

g. Headset and controller tracking data

To run the Game and to show your character to the other players in your session, the Game processes your headset, controller and (if enabled) hand-tracking positions from your device. This movement data is used in real time to render the Game and is transmitted to the other players in your session through our networking provider (see Section 4). We do not record or store it.

h. Multiplayer networking data

To connect you to other players, our networking provider (Photon Fusion / Photon Voice by Exit Games) processes technical connection data, which may include your IP address and in-session gameplay state, for the duration of your multiplayer session.

i. Moderation data (blocked users)

To support a safe multiplayer experience, we:

read your blocked-users list from Meta’s Platform (the Meta user IDs of players you have blocked who also own the Game) so that the Game can honour your Meta blocks;
keep an in-game block list on your account when you block a player from within the Game. It contains the Meta user IDs and display names of the players you have blocked, is stored with your game progress on our backend provider (Microsoft PlayFab — see Section 4) so it follows you across devices, and is deleted with your other data on request (see Section 7);
enforce both lists by hiding sessions that contain a blocked player from the session browser and Quick Play, refusing a blocked player’s connection to a session you host, and separating you if you meet in a session. To make this work, each session listing includes a hashed, non-reversible form of the Meta user IDs of the players present, never the IDs themselves; and
store your per-player mute preferences locally on your device. So that we can remember who you have muted between sessions, these preferences include the Meta user IDs of the players you mute; this information stays on your device and is removed when you uninstall the Game.

j. Local device settings

Comfort, locomotion, calibration, and audio preferences are stored locally on your device (and are removed when you uninstall the Game).

k. Analytics and diagnostics

The Game includes a third-party analytics SDK (GameAnalytics — see Section 4) that helps us understand how the Game is played and where it breaks, so that we can balance and fix it. This data is anonymous and is not linked to your Meta account.

We collect:

an anonymous, randomly generated identifier created by the analytics SDK on your device. We never send your Meta user ID, display name, email address, or any other identifying information to our analytics provider, and we do not set a custom user identifier;
gameplay events: which map and game mode you played, which wave you reached, how long a match lasted, aggregated counts of shots fired and enemies defeated per weapon, in-game points earned and spent, and how often your character was downed or revived;
your comfort and accessibility settings (such as locomotion type, turn mode, and vignette options), reported once per session as a summary, so that we can see which options players actually use;
technical device and session information collected automatically by the SDK: device model, operating system version, Game build version, session count and length, and an approximate country derived from your IP address; and
error diagnostics: the first line of an error message when the Game encounters a fault, de-duplicated and capped per session. We deliberately strip stack traces before sending these.

We do not collect your location beyond country level, and we do not integrate any advertising SDK, advertising identifier, or advertising profile. The analytics SDK’s advertising-identifier component has been removed from the Game.

You can turn this off. Analytics is enabled by default, and you may opt out at any time using the “Share anonymous analytics” toggle in the Game’s settings menu. Turning it off stops all analytics transmission immediately and does not affect anything else in the Game.

Aside from the analytics SDK described above, we do not integrate any third-party advertising or crash-reporting SDKs of our own in the Game. (Meta’s own platform software may separately collect limited technical and diagnostic data as described in Meta’s Privacy Policy, linked in Section 4.)

3. How We Use Your Information

We use the information above to:

identify your account and load the correct save data;
save and synchronize your game progress across sessions and devices;
match you with other players and run multiplayer sessions;
publish your group presence so that friends can join you, and route invitations and deep links into the correct session;
show your display name and your character’s movements to the other players in your session;
display leaderboards and award achievements;
provide in-game voice chat;
enforce blocking and muting for a safer experience;
understand which maps, modes, weapons, and difficulty points players actually reach, so we can balance the Game;
measure which comfort and accessibility options are used, so we can improve them;
diagnose crashes, errors, and performance problems; and
respond to your support requests.

We process this data to provide the Game you have requested (performance of a contract) and to maintain a functioning, safe service (our legitimate interests). The anonymous analytics and diagnostics described in Section 2k are processed on the basis of our legitimate interest in understanding and improving the Game — and you can object to this at any time simply by using the opt-out toggle in the settings menu.

4. How We Share Your Information

We do not sell your personal information. Other players in your session see your display name and your character’s movements, and hear your voice if you enable voice chat. Beyond that, we share information only with the service providers that make the Game work, and they may use it only to provide their services to us:

Provider: Meta Platforms Technologies (Meta)

Purpose: Account identity (Meta user ID, display name), group presence, invitations and deep links, achievements, blocking

Their Privacy Policy: https://www.meta.com/legal/privacy-policy/

Provider: Microsoft (PlayFab)

Purpose: Backend services: progression, cloud saves, leaderboards

Their Privacy Policy: https://privacy.microsoft.com/privacystatement

Provider: Exit Games (Photon Fusion & Photon Voice)

Purpose: Real-time multiplayer networking, character movement and voice transport

Their Privacy Policy: https://www.photonengine.com/terms/privacyandcookiepolicy

Provider: GameAnalytics A/S (Denmark)

Purpose: Anonymous gameplay analytics and error diagnostics (Section 2k)

Their Privacy Policy: https://www.gameanalytics.com/trust

We share only anonymous, aggregated gameplay data with GameAnalytics. We do not send them your Meta user ID, display name, or any other information that identifies you, and the data they hold cannot be linked back to your account by us or by them.

Consistent with Meta’s Developer Data Use Policy, we use the information we receive from Meta (your Meta user ID, display name, blocked-users list, group presence and launch details) only to run, support and maintain the Game as described in this Policy. We do not sell or rent it, use it for advertising or ad targeting, use it to build profiles or to discriminate, use it for surveillance, or combine it with data from other sources except as described here.

We may also disclose information if required by law, or to protect the rights, safety, and security of our users, our service, or the public.

5. Data Retention

We retain your account-linked game data (progression, cloud saves, leaderboard entries, and your in-game block list) for as long as your account is active or as needed to provide the Game. Voice audio, headset and controller movement data, group presence, and invitation or deep-link launch details are not stored. Networking connection data is processed only for the duration of your session. Local settings and locally stored mute preferences remain on your device until you uninstall the Game. Anonymous analytics data (Section 2k) is retained by our analytics provider in aggregated form according to their own retention schedule; because it is not linked to your account or device identity, it is not information we can look up for a specific person — you can stop any further collection at any time using the opt-out toggle in the settings menu. We delete account-linked data upon a deletion request (see Section 7).

6. Your Rights

Depending on where you live (for example under the EU/UK GDPR or the California CCPA/CPRA), you may have the right to:

access the personal data we hold about you,
request correction of inaccurate data,
request deletion of your data,
object to or restrict certain processing, and
request a copy of your data in a portable format.

Regardless of where you live, you can always ask us to delete your data — see Section 7. To exercise any of these rights, contact us at info@wavingbearstudio.com.

7. How to Request Deletion of Your Data

All players can request deletion of their data at any time, free of charge, by emailing info@wavingbearstudio.com with the subject line “Data Deletion Request”. Please include your in-game display name (and, if possible, your Meta username) so that we can find your records.

We will delete your stored progression, cloud saves, leaderboard entries, and in-game block list from our backend (PlayFab) within 30 days and confirm by email. You can additionally remove all locally stored settings and mute preferences at any time by uninstalling the Game. Please note that deleting your data will permanently erase your game progress. Data held by Meta itself (such as your Meta account, achievements, and block list) is controlled by Meta and can be managed through your Meta account settings.

8. Children’s Privacy

Stuffed: Two Foot Hero is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us at info@wavingbearstudio.com and we will delete it. Use of Meta Quest devices is also subject to Meta’s own age requirements.

9. Data Security

We use industry-standard safeguards, and rely on the security measures of our service providers (Meta, Microsoft, Exit Games, GameAnalytics), to protect your information. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

10. International Data Transfers

Our service providers may process and store information in countries other than your own, including the United States. Our analytics provider, GameAnalytics A/S, is established in Denmark (EU) and may process data in the EU and the United States. Where required, such transfers are governed by appropriate safeguards under applicable data-protection law.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and, where appropriate, provide additional notice. Your continued use of the Game after changes take effect constitutes acceptance of the updated Policy.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your data, contact:

Waving Bear Studio Email: info@wavingbearstudio.com