Last updated: 22 September 2026

This Privacy Policy explains how ZOXX Pty Ltd, ABN 89 700 936 090 (ZOXX, we, us or our) collects, holds, uses and discloses personal information.

It applies when you visit zoxx.ai, create or use a ZOXX account or profile, build or play a game through ZOXX, communicate with us, or otherwise use a product or service that links to this Privacy Policy (together, the Service).

In this Privacy Policy, you and your refer to the individual whose interaction with ZOXX or personal information is being described. Depending on the context, this may include an account holder, a person associated with a profile, a visitor or player, a person who communicates or otherwise deals with us, or another individual whose personal information we handle.

We manage personal information in accordance with the Privacy Act 1988 (Cth), including the Australian Privacy Principles (APPs), to the extent they apply to us. We also choose to apply the standards described in this Privacy Policy generally to our handling of personal information.

This Privacy Policy should be read with our Terms of Service. It does not apply to a third-party website, service or user-created game that collects personal information independently of functionality controlled by ZOXX.

ZOXX mobile arcade

The first release of the ZOXX mobile arcade offers free, anonymous, online play of When Pigs Fly, Chopper Dropper and Paint Path. It has no account registration, profiles, advertising, payments, social features, uploads or game-creation tools. The account, billing, AI-creation and advertising-measurement descriptions elsewhere in this policy relate to those features of the wider ZOXX Service, not to playing in this mobile release.

Game delivery and technical information. The app connects to our hosting services to request the published game, its images, sound and other files. These requests disclose network information such as your IP address to the services delivering them. ZOXX and our infrastructure providers, including Convex and Cloudflare, may process request metadata and operational or security logs to deliver, protect and troubleshoot the service. Anonymous play does not mean that these network requests are anonymous to those providers.
Information on your device. The app stores your music and sound preferences locally. Games may store local scores and runtime settings; game storage may be temporary. These values are not linked to a ZOXX account or synchronised between devices. Clearing the app's data removes its local settings and stored game data; uninstalling normally removes them too, subject to your device's backup and restore settings.
Support and external links. Support opens your email app. If you send a message, we receive your email address and the information you include. Privacy and Terms open in your browser, where the website's privacy practices and browser settings apply. The mobile game does not include the website's optional analytics or advertising integrations.

Technical and support information is subject to the purposes, provider disclosures, overseas processing, retention and deletion practices in sections 5, 8, 9 and 12. Clearing app data does not delete server-side logs or support correspondence. You can contact privacy@zoxx.ai to ask about information we hold or request its deletion, as explained in sections 12–17. There is no mobile account to delete. Contact support@zoxx.ai for help using the app.

1. What is personal information?

Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable. It can include a name, email address, profile information, a photograph, an audio recording, online identifiers, or information contained in a prompt or game project.

Some types of personal information, such as health information, biometric information used for automated identification, racial or ethnic origin, religious or political beliefs, sexual orientation and criminal records, are sensitive information and receive additional protection under Australian law.

2. Personal information we collect and hold

The kinds of personal information we may collect and hold depend on how the Service is used.

2.1 Account and identity information

Only adults aged 18 or over may hold a ZOXX account. Account and identity information may include:

email address, name and profile image;
authentication identifiers, login session information and sign-in records;
information received when you sign in with Google or another authentication provider.

We use passwordless email codes and third-party sign-in. We do not store your Google password or complete credentials for a third-party sign-in service.

2.2 Profile information

An adult account holder may create profiles for people who use the account. Profile information may include:

public creator username;
creator badge; and
games, bookmarks, follows and other activity associated with the profile.

2.3 Prompts, uploads, projects and games

We collect and hold content provided to or created through the Service, including:

prompts, chat messages, instructions, feedback and voice transcripts;
images and other files uploaded to a project, including file names and technical metadata;
game ideas, titles, descriptions, characters, stories and settings;
generated code, images, audio, three-dimensional models and other assets;
project source files, game builds, versions, preview images, validation results and published games;
conversations and activity involving ZOXX's AI characters and build tools; and
records showing whether a game or asset was reviewed, accepted, published, bookmarked or followed.

This material may contain personal information about the account holder, a profile user or another person. Do not submit another person's personal information unless you have permission and it is reasonably necessary to use the Service.

2.4 Voice information

If voice input is enabled, we collect the audio you choose to record and send it to a transcription provider. ZOXX uses the resulting text as your message. ZOXX does not intentionally use voice input to identify a person or create a biometric voiceprint.

2.5 Billing and transaction information

This may include:

billing name, email and billing address;
subscription plan, status, renewal and cancellation information;
Stripe customer, subscription and transaction identifiers; and
payment, refund, fraud-prevention and customer-support records.

Payments are processed by Stripe. We do not ordinarily receive or store complete payment card numbers.

2.6 Technical, usage and diagnostic information

We and our service providers may automatically collect:

IP address and approximate location derived from it;
browser, device, operating system and language information;
cookie, session and similar online identifiers;
pages, features, links and games accessed, and the date and time of activity;
referring domains, campaign parameters and approximate engagement duration;
advertising attribution and conversion information for adult account-holder actions, such as account setup, checkout and subscription purchase;
project, build, model-usage, token, cost and subscription-metering information;
error messages, security events, system logs and performance information; and
diagnostic records and build transcripts used to investigate faults, abuse or support requests.

2.7 Communications and business records

We collect information in emails, support requests, privacy requests, complaints, feedback, surveys and other communications with us. If you interact with us as a supplier, adviser or business contact, we may also collect your professional contact and relationship information.

If you join a product launch list, we store your email address, the page where you signed up, the signup date and the wording version of your request. We use this information to send the launch notification you requested and manage the list. Joining does not create an account or opt you into advertising measurement or enhanced matching. You can leave the list by contacting support@zoxx.ai.

2.8 Sensitive information

ZOXX is not designed to collect sensitive information, and we ask users not to include it in prompts, uploads or games unless it is genuinely necessary and they have the required consent or other legal authority. If sensitive information is submitted, we will handle it only as permitted by law and for purposes reasonably connected with providing, securing or supporting the requested feature.

3. How we collect personal information

We may collect personal information:

directly from you when you register, create a profile or project, send a prompt, upload a file, use voice input, publish or play a game, subscribe, request support, or contact us;
from the adult account holder about another person who uses a profile on the account;
automatically from browsers, devices, cookies, local storage, servers and security or diagnostic tools when the Service is used;
from authentication, payment and other service providers, such as Google and Stripe;
from another user who submits information or content involving you; and
from publicly available sources where reasonably necessary for support, safety, rights management, fraud prevention or legal compliance.

Where it is lawful and practicable, you may browse public pages or play public games without identifying yourself. A profile may use a nickname. We need an email address or supported third-party identity to register and secure an account, and our payment provider needs billing information for a paid subscription. If required information is not provided, we may be unable to provide the relevant account, payment, AI, publishing or support feature.

4. How we hold and protect personal information

We hold personal information electronically in ZOXX systems and in systems operated for us by cloud database, storage, hosting, authentication, communications, payment, AI and infrastructure providers.

We take reasonable technical and organisational steps appropriate to the nature of the information and the risks involved. These may include access controls, authentication, encryption in transit, logging, environment separation, provider due diligence, backups, monitoring and procedures for responding to security incidents.

No internet service or storage system is completely secure. Users should protect their email account, sign-in sessions and devices, and promptly tell us if they suspect unauthorised use of a ZOXX account.

5. Why we collect, hold, use and disclose personal information

We may handle personal information to:

provide, operate and maintain the Service;
create, authenticate and manage accounts and profiles;
remember the active profile and user preferences;
receive prompts and uploads and generate, design, build, test, save, publish and play games;
provide voice transcription, text-to-speech, image, audio, video, three-dimensional model and other media features;
personalise the Service to the selected profile and project;
process subscriptions, payments, cancellations and billing support;
measure and improve the effectiveness of advertising directed to adult account holders;
communicate about accounts, transactions, projects, service changes and support;
monitor usage limits, allocate computing resources and calculate service costs;
administer game review, publication, safety, moderation, audience-suitability assessments, reports and applicable distribution-platform requirements;
detect, investigate and prevent security threats, fraud, harmful content, abuse and breaches of our Terms or Child Safety and Content Rules;
diagnose errors, provide support, and improve the reliability, safety, accessibility and performance of the Service using feedback and technical, usage and diagnostic information;
conduct internal evaluations and human reviews of Account Content, Games and Output only as reasonably necessary to provide, maintain, secure, support, debug or improve the Service;
index and reuse eligible generated assets across accounts under the limited licence and safeguards described in the Terms of Service;
create aggregated or de-identified statistics, research and product insights;
establish, exercise or defend legal rights, resolve disputes and enforce agreements;
comply with laws, court orders and lawful requests from authorities; and
carry out a corporate transaction such as a financing, restructure, merger, acquisition or sale, subject to appropriate safeguards.

We may also use account-holder contact details for direct marketing where permitted by law. Section 11 explains your choices.

6. AI and automated processing

6.1 Providing AI features

ZOXX uses generative AI and automated tools to respond to prompts and help plan, design, generate, build, test and improve games. Depending on the feature, we may send prompts, conversation history, project information, uploaded images, game content and generated output to AI, model-routing, media-generation and cloud-computing providers.

Third-party AI and media providers may process inputs and outputs under their applicable business terms, including provider-specific retention practices. Where a provider offers a choice, we use commercially reasonable settings appropriate to the Service. Do not submit personal information that is unnecessary for the feature you are using.

6.2 Automated decisions affecting access or interests

Computer programs may use account identifiers, profile information, subscription status, usage information, device or security signals, and content or moderation signals to:

authenticate an account and apply trial, plan, usage or rate limits;
decide whether a feature or published item is available;
flag suspected fraud, abuse, security risk or prohibited content; and
support a decision to restrict, review or restore access to an account, project or feature.

Some of these steps are rule-based and some may use automated assessment. Where an automated process makes, or is substantially and directly related to making, a decision that could reasonably be expected to significantly affect a person's rights or interests, you may ask us to explain the outcome and arrange appropriate human review by contacting us.

7. Users under 18

An account must be opened and managed by an adult. The adult account holder may create and manage profiles for users under 18 and is responsible for providing supervision and any permission required by law.

We aim to minimise the personal information collected about users under 18, and allow a profile to use a nickname. We do not use their profile activity for targeted advertising or send direct marketing to them. Advertising conversion measurement is limited to adult account-holder actions such as account setup, checkout and subscription purchase, and does not include profile or game activity.

Please do not submit unnecessary personal information about anyone under 18 to ZOXX or include it in prompts, uploads, games or other use of the Service. If you do so inadvertently, please contact us promptly so we can take appropriate steps, including deleting or de-identifying the information where appropriate.

8. When we disclose personal information

We disclose personal information only where reasonably necessary for the purposes described in this Privacy Policy, at your direction or with consent, or as required or permitted by law. This may include disclosure to:

cloud, hosting and storage providers, including Convex, Cloudflare and Vercel;
AI, model-routing and media providers, including OpenRouter, Vercel AI Gateway, OpenAI, Google, xAI, ElevenLabs and fal.ai, depending on the feature used;
authentication and communications providers, including Google and Resend;
payment providers, including Stripe;
advertising measurement providers, including Google and Meta, for measuring and improving advertising directed to adult account holders;
professional advisers and contractors, such as lawyers, accountants, auditors, insurers, security specialists and support providers, where they need the information for their work;
law-enforcement bodies, regulators, courts and other authorities where required or authorised by law or reasonably necessary to protect rights, safety or security;
a buyer, investor or successor in connection with a proposed or completed corporate transaction, subject to confidentiality and applicable law;
other people at your direction; and
other parties with consent or as otherwise permitted by law.

We do not sell or rent personal information. We do not disclose personal information to another business so that it can independently market its products to you without consent.

Service providers can change as the Service develops. The categories above and our current information flows, rather than the inclusion or omission of a particular provider name, determine when this Privacy Policy applies.

9. Overseas disclosure and processing

ZOXX is based in Australia, but many providers that support the Service operate overseas. We are likely to disclose personal information to recipients in the United States. Global network and cloud providers may also process limited personal information in Australia, the United Kingdom, countries in the European Economic Area, Singapore, and other locations in which they or their subprocessors operate.

The exact location can depend on the feature, provider, model route, network conditions and the provider's current infrastructure, and it is not always practicable for us to identify every country in advance. Overseas privacy laws may differ from Australian law.

Where required, we take reasonable steps in the circumstances to ensure an overseas recipient handles personal information consistently with the APPs. Those steps may include reviewing provider privacy and security terms, using appropriate contractual protections, limiting the information sent, and using business or API data controls where available.

10. The ZOXX Catalogue and public information

Projects are not made public merely because they are created or submitted for review. If an account holder or authorised user submits a game and ZOXX approves it for the curated ZOXX Catalogue, the following may become publicly accessible through zoxx.ai, our apps and other ZOXX-operated channels:

the game and material intentionally included in it;
its title, description, cover images and public link;
the selected creator profile's nickname, colour and profile image; and
related public interactions or attribution supported by the Service.

Do not publish personal information unless you are comfortable making it public and have permission from anyone else it concerns. Search engines, caches, archives and other users may retain copies after a game is changed or unpublished. We will take reasonable steps to stop serving unpublished material through ZOXX, but we cannot control copies made by third parties while it was public.

11. Cookies, local storage and direct marketing

We use cookies, browser storage and similar technologies that are reasonably necessary to:

keep users signed in and protect sessions;
remember the selected profile and preferences;
operate requested features;
prevent fraud and secure the Service; and
understand and improve performance and reliability.

Some of these technologies are set by providers involved in authentication, payments, hosting or embedded content. Blocking them in a browser may prevent parts of the Service from working.

We also offer choices for optional analytics and advertising technologies. A data-collection notice is displayed to visitors in all regions and provides controls to accept, reject or customise optional collection. For visitors detected in Australia, New Zealand or the United States, optional analytics and ordinary advertising measurement are initially on, subject to Global Privacy Control and the controls in the notice. For visitors in other or unknown regions, optional technologies are initially off until the visitor accepts or enables them. Location is determined approximately from network information and may not always be accurate.

Optional analytics include ZOXX's first-party site and conversion-funnel analytics and Google Analytics 4. They help us understand marketing-page visits, campaign sources, broad device and approximate location information, engagement, account setup and the commercial checkout journey. Google Analytics receives recommended events such as page views, pricing views, plan selections, sign-up, login, checkout and purchase. We do not send account email, profile details, prompts, project content, game activity or payment-card details to Google Analytics.

Optional advertising measurement includes the Google Ads tag, Meta Pixel and Meta's server-to-server Conversions API. These tools measure marketing-page visits and adult account-holder commercial events such as account setup, checkout and subscription purchase, and may support campaign attribution, audience measurement and advertising personalisation when enabled. Depending on the event and choices, Google or Meta may receive browser and device information, advertising-click and cookie identifiers, a privacy-limited page URL, IP address and browser user-agent, plan, transaction identifier, currency and value. Browser and server Meta events use the same event identifier where applicable so Meta can deduplicate them. We do not send profile or game activity, creator usernames, prompts, messages, private project identifiers or project content through these advertising integrations.

Advanced matching is separate from the regional default. It remains off unless a visitor affirmatively accepts all optional technologies or enables advanced matching in the custom controls. If advanced matching is enabled and the visitor later signs in, we may send Google and Meta a normalised or one-way hashed account email and account identifier to help match account setup, checkout and purchase events. Accepting the Terms of Service, acknowledging this Privacy Policy, registering or signing in does not by itself enable advanced matching. Google and Meta apply their own matching, security and retention practices to data they receive.

We honour an active Global Privacy Control signal by disabling advertising measurement, advertising personalisation and advanced matching in that browser. You can change or withdraw optional choices at any time using the Privacy choices control displayed on the Service. Withdrawing a choice stops future optional events from that browser and removes measurement cookies that ZOXX can remove from its own domain; it does not undo processing that occurred before the change or remove records that a provider must retain for lawful purposes.

We may send account and service messages that are necessary to provide the Service. If we send marketing emails or other commercial electronic messages, we will do so where permitted by law and provide a simple way to unsubscribe. You can opt out using the link in the message or by contacting us. Opting out of marketing does not stop necessary account, security, billing or service messages.

12. Retention and deletion

We keep personal information only for as long as it is reasonably needed for a permitted purpose, including to provide the Service, maintain security and business records, resolve disputes, enforce agreements and comply with law. Retention depends on the type of information and why it is held. In general:

account, profile, project and conversation information is kept while the account or relevant project remains active and for a reasonable period afterwards;
linked uploads, generated assets, game versions and build records are generally kept with the relevant project until deleted or no longer reasonably needed; a copy of an eligible generated asset may remain in a reusable library after project or account deletion under the limited perpetual licence in the Terms of Service, but this does not permit us to retain personal information when applicable privacy law requires its destruction or de-identification;
ZOXX does not intentionally retain the raw voice recording after it has been sent for transcription and the transcription response has been returned, although the transcription provider may apply its own retention practices;
published material is kept while it remains published and for a reasonable period after it is unpublished, and limited moderation, safety, audience-suitability and platform records may be retained for longer where reasonably necessary;
billing, transaction, security, complaint and legal records may be kept for longer where reasonably necessary or required by law; and
backups and systems operated by our providers may temporarily retain residual copies until routine deletion or overwriting processes remove them.

When personal information is no longer required for a purpose permitted by law, we take reasonable steps to destroy it or ensure it is de-identified. Aggregated or effectively de-identified information may be retained because it is no longer personal information.

You may request account or profile deletion using an available account control or by contacting us. Deleting an account is different from cancelling a subscription. We may need to verify the request and may retain limited information where required or permitted by law. We will also take reasonable steps to instruct relevant providers to delete personal information where appropriate, but provider retention and backups may not be immediate.

13. Accessing and correcting personal information

You may ask us to give you access to personal information we hold about you or to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading. You do not need to use a particular form. Contact our Privacy Officer using the details in section 17 and tell us what information or correction you are seeking.

We may need to verify your identity and authority to make the request. We will respond within a reasonable period, generally within 30 days. There is no fee to make a request. If permitted by law, we may charge a reasonable, non-excessive cost for providing access after first telling you.

In limited circumstances, Australian law permits or requires us to refuse access or correction, including where giving access would unreasonably affect another person's privacy or be unlawful. If we refuse a request, we will give written reasons where required and explain available complaint options. If we refuse a correction request, you may ask us to associate a statement with the information.

14. Privacy complaints

If you believe we have mishandled personal information or breached the APPs or a binding registered privacy code, please send a written complaint to our Privacy Officer using the details in section 17. Include enough information for us to understand what happened, the impact on you and the outcome you are seeking.

We will:

acknowledge the complaint within a reasonable period;
investigate it fairly, which may involve asking for more information;
keep you informed if the investigation will take longer than expected; and
aim to provide a written outcome within 30 days.

If you are not satisfied with our response, or we have not responded within 30 days, you may complain to the Office of the Australian Information Commissioner (OAIC). Information about making a complaint is available at oaic.gov.au/privacy/privacy-complaints. The OAIC can also be contacted on 1300 363 992 within Australia.

15. Data breaches

We maintain procedures for responding to suspected data breaches. If a breach is likely to result in serious harm and the Notifiable Data Breaches scheme applies, we will notify the affected individuals and the OAIC as soon as practicable and provide information about recommended protective steps, unless an exception applies.

16. Changes to this Privacy Policy

We may update this Privacy Policy when our Service, providers, practices or legal obligations change. We will publish the updated policy and change the “Last updated” date. If a change is material, we will take reasonable steps to give additional notice, such as by email or an in-product message, before or when the change takes effect.

We recommend checking this page periodically. Where consent is required for a new use or disclosure, an update to this Privacy Policy alone does not replace that consent.

17. Contact us

Questions, access or correction requests, deletion requests and privacy complaints may be sent to:

Privacy Officer
ZOXX Pty Ltd
ABN: 89 700 936 090
Address: Unit 113, 4 Columbia Court, Norwest NSW 2153, Australia
Email: privacy@zoxx.ai

You may request a copy of this Privacy Policy in another reasonably accessible form by contacting the Privacy Officer.