Privacy Policy

Last updated: 13 August 2026

This Privacy Policy explains how ZOXX Pty Ltd, ABN 89 700 936 090 (ZOXX, we, us or our) collects, holds, uses and discloses personal information.

It applies when you visit zoxx.ai, create or use a ZOXX account or profile, build or play a game through ZOXX, communicate with us, or otherwise use a product or service that links to this Privacy Policy (together, the Service).

We manage personal information in accordance with the Privacy Act 1988 (Cth), including the Australian Privacy Principles (APPs), to the extent they apply to us. We also choose to apply the standards described in this Privacy Policy generally to our handling of personal information.

This Privacy Policy should be read with our Terms of Service. It does not apply to a third-party website, service or user-created game that collects personal information independently of functionality controlled by ZOXX.

1. What is personal information?

Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable. It can include a name, email address, profile information, a photograph, an audio recording, online identifiers, or information contained in a prompt or game project.

Some types of personal information, such as health information, biometric information used for automated identification, racial or ethnic origin, religious or political beliefs, sexual orientation and criminal records, are sensitive information and receive additional protection under Australian law.

2. Personal information we collect and hold

The kinds of personal information we may collect and hold depend on how the Service is used.

2.1 Account and identity information

Only adults aged 18 or over may hold a ZOXX account. Account and identity information may include:

  • email address, name and profile image;
  • authentication identifiers, login session information and sign-in records;
  • information received when you sign in with Google or another authentication provider.

We use passwordless email codes and third-party sign-in. We do not store your Google password or complete credentials for a third-party sign-in service.

2.2 Profile information

An adult account holder may create profiles for people who use the account. Profile information may include:

  • nickname;
  • profile colour and optional profile image; and
  • games, bookmarks, follows and other activity associated with the profile.

2.3 Prompts, uploads, projects and games

We collect and hold content provided to or created through the Service, including:

  • prompts, chat messages, instructions, feedback and voice transcripts;
  • images and other files uploaded to a project, including file names and technical metadata;
  • game ideas, titles, descriptions, characters, stories and settings;
  • generated code, images, audio, three-dimensional models and other assets;
  • project source files, game builds, versions, preview images, validation results and published games;
  • conversations and activity involving ZOXX's AI characters and build tools; and
  • records showing whether a game or asset was reviewed, accepted, published, bookmarked or followed.

This material may contain personal information about the account holder, a profile user or another person. Do not submit another person's personal information unless you have permission and it is reasonably necessary to use the Service.

2.4 Voice information

If voice input is enabled, we collect the audio you choose to record and send it to a transcription provider. ZOXX uses the resulting text as your message. ZOXX does not intentionally use voice input to identify a person or create a biometric voiceprint.

2.5 Billing and transaction information

This may include:

  • billing name, email and billing address;
  • subscription plan, status, renewal and cancellation information;
  • Stripe customer, subscription and transaction identifiers; and
  • payment, refund, fraud-prevention and customer-support records.

Payments are processed by Stripe. We do not ordinarily receive or store complete payment card numbers.

2.6 Technical, usage and diagnostic information

We and our service providers may automatically collect:

  • IP address and approximate location derived from it;
  • browser, device, operating system and language information;
  • cookie, session and similar online identifiers;
  • pages, features, links and games accessed, and the date and time of activity;
  • referring domains, campaign parameters and approximate engagement duration;
  • project, build, model-usage, token, cost and subscription-metering information;
  • error messages, security events, system logs and performance information; and
  • diagnostic records and build transcripts used to investigate faults, abuse or support requests.

2.7 Communications and business records

We collect information in emails, support requests, privacy requests, complaints, feedback, surveys and other communications with us. If you interact with us as a supplier, adviser or business contact, we may also collect your professional contact and relationship information.

2.8 Sensitive information

ZOXX is not designed to collect sensitive information, and we ask users not to include it in prompts, uploads or games unless it is genuinely necessary and they have the required consent or other legal authority. If sensitive information is submitted, we will handle it only as permitted by law and for purposes reasonably connected with providing, securing or supporting the requested feature.

3. How we collect personal information

We may collect personal information:

  • directly from you when you register, create a profile or project, send a prompt, upload a file, use voice input, publish or play a game, subscribe, request support, or contact us;
  • from the adult account holder about another person who uses a profile on the account;
  • automatically from browsers, devices, cookies, local storage, servers and security or diagnostic tools when the Service is used;
  • from authentication, payment and other service providers, such as Google and Stripe;
  • from another user who submits information or content involving you; and
  • from publicly available sources where reasonably necessary for support, safety, rights management, fraud prevention or legal compliance.

Where it is lawful and practicable, you may browse public pages or play public games without identifying yourself. A profile may use a nickname. We need an email address or supported third-party identity to register and secure an account, and our payment provider needs billing information for a paid subscription. If required information is not provided, we may be unable to provide the relevant account, payment, AI, publishing or support feature.

4. How we hold and protect personal information

We hold personal information electronically in ZOXX systems and in systems operated for us by cloud database, storage, hosting, authentication, communications, payment, AI and infrastructure providers.

We take reasonable technical and organisational steps appropriate to the nature of the information and the risks involved. These may include access controls, authentication, encryption in transit, logging, environment separation, provider due diligence, backups, monitoring and procedures for responding to security incidents.

No internet service or storage system is completely secure. Users should protect their email account, sign-in sessions and devices, and promptly tell us if they suspect unauthorised use of a ZOXX account.

5. Why we collect, hold, use and disclose personal information

We may handle personal information to:

  • provide, operate and maintain the Service;
  • create, authenticate and manage accounts and profiles;
  • remember the active profile and user preferences;
  • receive prompts and uploads and generate, design, build, test, save, publish and play games;
  • provide voice transcription, text-to-speech, image, audio, video, three-dimensional model and other media features;
  • personalise the Service to the selected profile and project;
  • process subscriptions, payments, cancellations and billing support;
  • communicate about accounts, transactions, projects, service changes and support;
  • monitor usage limits, allocate computing resources and calculate service costs;
  • administer game review, publication, safety, moderation, audience-suitability assessments, reports and applicable distribution-platform requirements;
  • detect, investigate and prevent security threats, fraud, harmful content, abuse and breaches of our Terms or Child Safety and Content Rules;
  • diagnose errors, provide support, and improve the reliability, safety, accessibility and performance of the Service using feedback and technical, usage and diagnostic information;
  • conduct internal evaluations and human reviews of Account Content, Games and Output only as reasonably necessary to provide, maintain, secure, support, debug or improve the Service;
  • index and reuse eligible generated assets across accounts under the limited licence and safeguards described in the Terms of Service;
  • create aggregated or de-identified statistics, research and product insights;
  • establish, exercise or defend legal rights, resolve disputes and enforce agreements;
  • comply with laws, court orders and lawful requests from authorities; and
  • carry out a corporate transaction such as a financing, restructure, merger, acquisition or sale, subject to appropriate safeguards.

We may also use account-holder contact details for direct marketing where permitted by law. Section 11 explains your choices.

6. AI and automated processing

6.1 Providing AI features

ZOXX uses generative AI and automated tools to respond to prompts and help plan, design, generate, build, test and improve games. Depending on the feature, we may send prompts, conversation history, project information, uploaded images, game content and generated output to AI, model-routing, media-generation and cloud-computing providers.

Third-party AI and media providers may process inputs and outputs under their applicable business terms, including provider-specific retention practices. Where a provider offers a choice, we use commercially reasonable settings appropriate to the Service. Do not submit personal information that is unnecessary for the feature you are using.

6.2 Automated decisions affecting access or interests

Computer programs may use account identifiers, profile information, subscription status, usage information, device or security signals, and content or moderation signals to:

  • authenticate an account and apply trial, plan, usage or rate limits;
  • decide whether a feature or published item is available;
  • flag suspected fraud, abuse, security risk or prohibited content; and
  • support a decision to restrict, review or restore access to an account, project or feature.

Some of these steps are rule-based and some may use automated assessment. Where an automated process makes, or is substantially and directly related to making, a decision that could reasonably be expected to significantly affect a person's rights or interests, you may ask us to explain the outcome and arrange appropriate human review by contacting us.

7. Users under 18

An account must be opened and managed by an adult. The adult account holder may create and manage profiles for users under 18 and is responsible for providing supervision and any permission required by law.

We aim to minimise the personal information collected about users under 18, and allow a profile to use a nickname. We do not use their profile activity for targeted advertising or send direct marketing to them.

Please do not submit unnecessary personal information about anyone under 18 to ZOXX or include it in prompts, uploads, games or other use of the Service. If you do so inadvertently, please contact us promptly so we can take appropriate steps, including deleting or de-identifying the information where appropriate.

8. When we disclose personal information

We disclose personal information only where reasonably necessary for the purposes described in this Privacy Policy, at your direction or with consent, or as required or permitted by law. This may include disclosure to:

  • cloud, hosting and storage providers, including Convex, Cloudflare and Vercel;
  • AI, model-routing and media providers, including OpenRouter, Vercel AI Gateway, OpenAI, Google, xAI, ElevenLabs and fal.ai, depending on the feature used;
  • authentication and communications providers, including Google and Resend;
  • payment providers, including Stripe;
  • professional advisers and contractors, such as lawyers, accountants, auditors, insurers, security specialists and support providers, where they need the information for their work;
  • law-enforcement bodies, regulators, courts and other authorities where required or authorised by law or reasonably necessary to protect rights, safety or security;
  • a buyer, investor or successor in connection with a proposed or completed corporate transaction, subject to confidentiality and applicable law;
  • other people at your direction; and
  • other parties with consent or as otherwise permitted by law.

We do not sell or rent personal information. We do not disclose personal information to another business so that it can independently market its products to you without consent.

Service providers can change as the Service develops. The categories above and our current information flows, rather than the inclusion or omission of a particular provider name, determine when this Privacy Policy applies.

9. Overseas disclosure and processing

ZOXX is based in Australia, but many providers that support the Service operate overseas. We are likely to disclose personal information to recipients in the United States. Global network and cloud providers may also process limited personal information in Australia, the United Kingdom, countries in the European Economic Area, Singapore, and other locations in which they or their subprocessors operate.

The exact location can depend on the feature, provider, model route, network conditions and the provider's current infrastructure, and it is not always practicable for us to identify every country in advance. Overseas privacy laws may differ from Australian law.

Where required, we take reasonable steps in the circumstances to ensure an overseas recipient handles personal information consistently with the APPs. Those steps may include reviewing provider privacy and security terms, using appropriate contractual protections, limiting the information sent, and using business or API data controls where available.

10. The ZOXX Catalogue and public information

Projects are not made public merely because they are created or submitted for review. If an account holder or authorised user submits a game and ZOXX approves it for the curated ZOXX Catalogue, the following may become publicly accessible through zoxx.ai, our apps and other ZOXX-operated channels:

  • the game and material intentionally included in it;
  • its title, description, cover images and public link;
  • the selected creator profile's nickname, colour and profile image; and
  • related public interactions or attribution supported by the Service.

Do not publish personal information unless you are comfortable making it public and have permission from anyone else it concerns. Search engines, caches, archives and other users may retain copies after a game is changed or unpublished. We will take reasonable steps to stop serving unpublished material through ZOXX, but we cannot control copies made by third parties while it was public.

11. Cookies, local storage and direct marketing

We use cookies, browser storage and similar technologies that are reasonably necessary to:

  • keep users signed in and protect sessions;
  • remember the selected profile and preferences;
  • operate requested features;
  • prevent fraud and secure the Service; and
  • understand and improve performance and reliability.

Some of these technologies are set by providers involved in authentication, payments, hosting or embedded content. Blocking them in a browser may prevent parts of the Service from working. At the date of this policy, ZOXX does not use personal information for third-party interest-based advertising.

We may send account and service messages that are necessary to provide the Service. If we send marketing emails or other commercial electronic messages, we will do so where permitted by law and provide a simple way to unsubscribe. You can opt out using the link in the message or by contacting us. Opting out of marketing does not stop necessary account, security, billing or service messages.

12. Retention and deletion

We keep personal information only for as long as it is reasonably needed for a permitted purpose, including to provide the Service, maintain security and business records, resolve disputes, enforce agreements and comply with law. Retention depends on the type of information and why it is held. In general:

  • account, profile, project and conversation information is kept while the account or relevant project remains active and for a reasonable period afterwards;
  • linked uploads, generated assets, game versions and build records are generally kept with the relevant project until deleted or no longer reasonably needed; a copy of an eligible generated asset may remain in a reusable library after project or account deletion under the limited perpetual licence in the Terms of Service, but this does not permit us to retain personal information when applicable privacy law requires its destruction or de-identification;
  • ZOXX does not intentionally retain the raw voice recording after it has been sent for transcription and the transcription response has been returned, although the transcription provider may apply its own retention practices;
  • published material is kept while it remains published and for a reasonable period after it is unpublished, and limited moderation, safety, audience-suitability and platform records may be retained for longer where reasonably necessary;
  • billing, transaction, security, complaint and legal records may be kept for longer where reasonably necessary or required by law; and
  • backups and provider systems may retain residual copies for a limited period before they are overwritten or deleted in the ordinary course.

When personal information is no longer required for a purpose permitted by law, we take reasonable steps to destroy it or ensure it is de-identified. Aggregated or effectively de-identified information may be retained because it is no longer personal information.

You may request account or profile deletion using an available account control or by contacting us. Deleting an account is different from cancelling a subscription. We may need to verify the request and may retain limited information where required or permitted by law. We will also take reasonable steps to instruct relevant providers to delete personal information where appropriate, but provider retention and backups may not be immediate.

13. Accessing and correcting personal information

You may ask us to give you access to personal information we hold about you or to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading. You do not need to use a particular form. Contact our Privacy Officer using the details in section 17 and tell us what information or correction you are seeking.

We may need to verify your identity and authority to make the request. We will respond within a reasonable period, generally within 30 days. There is no fee to make a request. If permitted by law, we may charge a reasonable, non-excessive cost for providing access after first telling you.

In limited circumstances, Australian law permits or requires us to refuse access or correction, including where giving access would unreasonably affect another person's privacy or be unlawful. If we refuse a request, we will give written reasons where required and explain available complaint options. If we refuse a correction request, you may ask us to associate a statement with the information.

14. Privacy complaints

If you believe we have mishandled personal information or breached the APPs or a binding registered privacy code, please send a written complaint to our Privacy Officer using the details in section 17. Include enough information for us to understand what happened, the impact on you and the outcome you are seeking.

We will:

  1. acknowledge the complaint within a reasonable period;
  2. investigate it fairly, which may involve asking for more information;
  3. keep you informed if the investigation will take longer than expected; and
  4. aim to provide a written outcome within 30 days.

If you are not satisfied with our response, or we have not responded within 30 days, you may complain to the Office of the Australian Information Commissioner (OAIC). Information about making a complaint is available at oaic.gov.au/privacy/privacy-complaints. The OAIC can also be contacted on 1300 363 992 within Australia.

15. Data breaches

We maintain procedures for responding to suspected data breaches. If a breach is likely to result in serious harm and the Notifiable Data Breaches scheme applies, we will notify the affected individuals and the OAIC as soon as practicable and provide information about recommended protective steps, unless an exception applies.

16. Changes to this Privacy Policy

We may update this Privacy Policy when our Service, providers, practices or legal obligations change. We will publish the updated policy and change the “Last updated” date. If a change is material, we will take reasonable steps to give additional notice, such as by email or an in-product message, before or when the change takes effect.

We recommend checking this page periodically. Where consent is required for a new use or disclosure, an update to this Privacy Policy alone does not replace that consent.

17. Contact us

Questions, access or correction requests, deletion requests and privacy complaints may be sent to:

Privacy Officer
ZOXX Pty Ltd
ABN: 89 700 936 090
Address: Unit 113, 4 Columbia Court, Norwest NSW 2153, Australia
Email: privacy@zoxx.ai

You may request a copy of this Privacy Policy in another reasonably accessible form by contacting the Privacy Officer.