Privacy Notice

Who is responsible

Fidgetthings LLC operates didgetsthings.com and is the controller of the personal information described here. Contact fidgetthings@gmail.com or write to Fidgetthings LLC, 6592 N Decatur Blvd Unit 150#105, Las Vegas, NV 89131, United States.

This notice covers device registration and activation, optional website accounts, email preferences, support and security. Stores, payment providers and Patreon have separate notices for information they collect independently.

Information we use

Registration: your email, device ID, registration date, activation security records, and the version and date of your adult-age and website-terms acknowledgement. Registration does not create an account or establish legal ownership of a Didget.

Accounts: your email, username, account ID, verification status, account dates, sessions, linked registration records and terms acknowledgements. Supabase handles password authentication. The Didget application database does not store your account password. Password confirmation is sent to Supabase when you delete your account.

Email preferences: the verified email, your optional choice, consent wording/version and date, withdrawal information and an unsubscribe identifier. We keep a keyed email digest to honour an unsubscribe without retaining a plain-text address solely for that purpose. This is still protected information, not anonymous data.

Support and privacy requests: your correspondence and the proportionate details needed to help or verify a request. Do not send passwords, activation secrets or unnecessary identity documents.

To limit automated registration abuse, we use a keyed hash of the client IP address (grouping IPv6 addresses by network), an attempt count and an expiry time. We do not store the raw IP address in this application rate-limit table. The allowance resets after 15 minutes; expired entries are removed by daily cleanup.

Hosting, authentication and email providers process technical information such as IP addresses, timestamps, browser/device details, authentication events and delivery/security logs. We do not add advertising pixels or optional analytics to the Didget application.

The owner dashboard does not upload your Didget life totals, decks, game logs, microphone recordings or home Wi-Fi password. Information you choose to send to support is separate.

Why we use information

We use necessary information to provide the registration, activation and optional account services you request. Where EU/UK law applies, the legal basis for these necessary service functions is performance of our agreement with you.

We use proportionate security, abuse-prevention and troubleshooting records and answer general enquiries based on our legitimate interests in a reliable, secure service and helping users, balanced against their rights. We rely on applicable legal obligations when responding to mandatory requests or complying with a specific legal duty.

Optional promotional email relies on your separate consent. You can withdraw it at any time. Accepting our Website Terms or acknowledging this notice is not blanket consent to unrelated processing.

Email and device enrollment are required to register a Didget. An account is optional. Without necessary account information we cannot provide that account function. We do not make decisions with legal or similarly significant effects solely through automated profiling.

Didget emails

Registration and account creation do not subscribe you to marketing. Necessary verification, recovery, email-change, security and requested support messages are separate.

In a verified account you can separately opt in to Didget news, new releases, updates and upgrades from Fidgetthings LLC. This is optional and not required for activation or an account. Promotional mailings are not currently being sent; your saved preference will apply when they become available.

Withdraw your choice in account settings, use the unsubscribe link in a promotional email, or contact us. We do not automatically enrol existing registrations or accounts. Promotional messages must identify us, include our postal address and provide a working unsubscribe option.

Providers and disclosures

We use OpenAI Sites to host the website and application database/storage; Supabase Pte. Ltd for authentication and related account/security processing; Plus Five Five, Inc. (Resend) for account email delivery; and Google Gmail for correspondence at fidgetthings@gmail.com. Providers use infrastructure subprocessors as described in their own terms and privacy information.

OpenAI’s Sites-specific data-processing terms govern hosted end-user data on individual plans. They do not extend to the separate use of customer information in ordinary ChatGPT authoring conversations. We do not need to copy customer datasets into those conversations to operate the service.

We do not sell Didget website personal information or share it for cross-context behavioural advertising. We may disclose information to comply with law or where necessary and proportionate to protect legal rights or service security. A business transfer may involve relevant records subject to applicable notice and privacy obligations.

International processing

Fidgetthings LLC is based in the United States and our Supabase project uses a United States region. Providers may process information in the United States and other countries for hosting, support, security and delivery. A database region does not confine all provider processing to that region.

Where applicable, our providers’ data-processing terms address transfer safeguards such as EU standard contractual clauses and UK provisions. Contact us for information about safeguards applicable to your data and to request a copy, subject to necessary redactions.

Shopping with FidgetThings

The Didget shop displays products from our FidgetThings Shopify store and sends product, variant and quantity requests to Shopify. Shopify and its product-image infrastructure receive technical connection information such as your IP address when the catalog and cart load.

An essential cart identifier is stored in your browser under didget-shop-cart-v1 for up to seven days after a successful cart update. It lets you resume shopping on this browser. No Didget account is required, and your Didget account session is not sent to Shopify.

Checkout opens our FidgetThings Shopify checkout, where payment, contact and shipping information is collected for your order. Those details are not copied into the Didget application database. Shopify checkout has its own storage, privacy and email-choice controls; consult the FidgetThings store policies at checkout. Shopping does not automatically subscribe your Didget account to marketing.

Cookies and browser storage

The account service stores the Didget sign-in session in browser local storage under didget-customer-session. Supabase may use related authentication entries for token coordination. The session remains until sign-out, browser storage removal, expiry or provider revocation; tokens may refresh while a valid session continues.

Authentication and hosting services may use necessary session/security cookies. The application does not set optional advertising or analytics cookies. Browser settings can block or clear storage, but sign-in may then stop working. Signing out on a shared browser is recommended.

An activation QR contains private enrollment information. The page removes its enrollment parameter from the visible URL after loading it. Avoid sharing the original QR/link or your account/security links.

How long we keep information

We keep active account and registration records while needed for the requested service, subject to deletion requests and a review of continuing need. Re-registering a device replaces its current contact/enrollment association; it does not create a permanent ownership lock.

Our retention policy calls for removal of unverified signups after 30 days, routine security/admin audit records after 90 days, and ordinary support correspondence 12 months after resolution. Provider-controlled logs and backups follow separate provider limits. A justified legal hold or unresolved security matter may require longer retention; we limit and review those exceptions.

Successful account deletion removes live website account, associated registration, terms-acknowledgement and marketing-preference records and requests deletion of the Supabase sign-in account. A minimal hashed account-ID lock and completion date protect against recreation by in-flight requests. Completed locks are eligible for removal after 90 days; an unresolved deletion remains protected until resolved.

We retain only the consent/withdrawal evidence needed to respect your email choice and demonstrate compliance. A keyed suppression digest may remain after account deletion to prevent further marketing. It is not used to send messages or build an advertising profile.

We keep private website recovery snapshots and registration CSV backups. Older snapshots are eligible for deletion after 30 days during backup checks, while the newest successful snapshot remains while needed for recovery. Encrypted recovery copies downloaded by the operator are also subject to retention and deletion handling. Firmware mirrors contain software, not customer records.

Deleting the live account does not instantly erase separate support emails, provider security/delivery logs, backups or previously authorised exports. Contact us to include those in a request; we apply applicable retention limits, legal exceptions and provider processes. We do not restore deleted customer records to active use from a backup without reapplying deletion.

Your choices and privacy rights

In account settings you can request an email change, recover your password, download account/registration information and permanently delete your account and associated registration records. Deletion requires password confirmation and typing DELETE. The physical Didget is not wiped or remotely disabled. A later wipe/activation may require registering again with its current QR.

Contact fidgetthings@gmail.com for access, correction, deletion, restriction, portability, an objection, withdrawal of consent or other applicable rights, including registration-only records or a broader request covering support/provider information. Tell us enough to locate the record; do not send your password. We verify requests proportionately and protect other people’s information.

We respond without undue delay and within the deadline that applies to your request and jurisdiction. Rights and exceptions vary. Where EU/UK law applies, you can complain to your local data-protection authority, including the UK Information Commissioner where relevant. We will explain any justified refusal and available complaint options.

There is no individual device-removal button in the dashboard. That product rule does not limit your privacy rights. A fresh QR registration can change the email associated with a device.

Adults and children

Website registration and accounts are for adults aged at least 18 who have reached the age of majority where they live. A parent or guardian may register using the adult’s own details. Do not submit a child’s personal information. Didget is not advertised to children or as a toy.

If you believe a child has supplied information, contact us. We will investigate and take appropriate action. An age acknowledgement is not identity verification; we continue to assess likely use and relevant children’s privacy duties.

Security and notice changes

We use access controls, verified account email and purpose-limited security controls. No system can guarantee absolute security. Keep passwords, activation QR codes and recovery links private.

We identify the version/date of this notice and provide notice of material changes where required before applying a new practice. Contact us with questions.