Privacy policy

Who we are

Nudge Reality Limited is responsible for the personal information described here. Registered in England and Wales, company number 12548462. Email info@nudgereality.com or write to our registered office: 9 Garrison Close, Chester, CH3 6GS, United Kingdom.

This notice covers Jab & Move and its supporting pages at jabmove.com. It explains what happens when you browse, play, join a friend, use the optional public leaderboard or contact us.

Playing and visiting the site

CPU fights and training do not require an online account. Progress, fighter and arena preferences and training scores are saved in your browser. These saves are not automatically synchronised to a cloud account.

Our hosting provider, Netlify, receives information needed to deliver the site, such as your IP address, requested URL, browser information and request time. Hosting and security services may keep operational logs to diagnose faults and prevent abuse. Avoid putting personal information in URLs or public player names.

For mixed reality, the browser and headset handle tracking and permissions. The game uses tracking locally to position and view the arena. We do not upload room scans, camera images or headset movement to analytics. The game does not collect microphone or camera recordings.

Playing with friends

When you choose an online room, PeerJS Cloud helps browsers find each other and Google STUN helps establish a direct WebRTC connection. These services receive connection information such as IP addresses and technical session identifiers. Other participants may learn your public network address as part of establishing the connection.

The host, players and spectators exchange the display name, selected boxer, controller inputs and fight state needed for the shared match. You choose whether to share room codes or invitation links. We do not centrally record private-room gameplay. Local arena placement stays on your device. Do not share a private identity backup as an invitation.

Optional public leaderboard

If you join, we store a public display name, a randomly generated identity, selected fighter, provisional rating, results and related match records in our Neon database. Your browser holds an access secret; the database holds its hash. No email is required to play or join the leaderboard.

Your display name, fighter and ranking statistics are public. CPU wins, difficulty and bout records are submitted by your browser to a separate CPU points leaderboard. Multiplayer ratings use matching reports from participating browsers. Both boards are provisional. Choose a nickname rather than your real name. Rankings are game features, not decisions about employment, credit or another significant real-world service.

Saves & account controls lets you export your leaderboard data, download or restore a private backup and delete your leaderboard identity. Deletion removes the identity and associated match records from the active database; cached rankings may take several minutes to refresh. It preserves local game progress. Keep backups private: possession of the access secret grants access to that leaderboard identity.

Analytics are off

This all-ages version does not load Google Analytics or send optional gameplay analytics. Earlier saved opt-ins do not turn collection back on. When you visit pages that run our privacy migration, we record a declined Analytics preference and clear the site's existing Google Analytics cookies without deleting game saves.

Previously collected reports are not erased by this change. Contact us about your information using the details above.

Advertising and Google

Jab & Move is intended to be funded by advertising. The lobby can show a clearly labelled first-party promotion linking to Jab & Move player guides. It is delivered as ordinary site content without advertising cookies, third-party advertising scripts, or impression/click tracking. Privacy choices do not remove this promotion.

Google network ads are not active. AdSense is still reviewing the site. Publisher verification metadata and ads.txt do not load an advertising SDK. This release does not load Google's consent messaging either.

Before network ads are activated, we will verify the restricted delivery mode, apply child protections and update these notices with the actual processing and any required choices. Declining optional processing will not be presented as an ad-free option. The ability to show an advert does not itself permit tracking.

Read how Google uses information from partner sites. We do not sell player names, identity secrets or gameplay records to advertisers.

Why we use information

• Consent: earlier optional Analytics collection and any future consent-dependent processing. Optional collection is currently off. You may withdraw consent at any time without affecting processing that was lawful before withdrawal.
• Legitimate interests: delivering the game and the multiplayer/leaderboard features you choose, maintaining reliable rankings, securing the service, investigating faults and responding to enquiries. We limit the information used and consider the effect on your privacy. You may object to this processing.
• Legal obligations: responding to valid legal requests or keeping records where required by law.

If you email us, we receive the contact details and message you provide and use them to answer your request. Optional information is your choice; a feature may need the information described above to work.

Providers and international processing

We use Netlify for hosting and functions, Neon for the optional leaderboard database, Google for STUN connectivity, and PeerJS Cloud for multiplayer signalling. Only services needed for your chosen features receive the corresponding information. We may also disclose information where required by law or necessary to protect the service and people's rights.

These services operate internationally, including in the United States, so information may be processed outside the UK or EEA. Their published processing terms describe safeguards such as applicable adequacy arrangements and standard contractual clauses, including UK provisions where relevant. Contact us for information about safeguards applying to your data.

Provider information: Netlify privacy and processing terms; Neon / Databricks privacy; Google privacy and transfer frameworks; PeerJS connections.

How long information is kept

• Local saves and preferences: until you clear site data, remove a save or your browser removes it. Browsers and domains have separate storage.
• Leaderboard identity and totals: while the identity remains registered, until you delete it or we remove it for service administration. Inactive identities are not automatically deleted.
• Match/invitation records: eligible for deletion seven days after expiry. Bounded cleanup runs when the ranking cache refreshes, so removal may take longer during inactivity or a backlog.
• Abuse counters: the API uses salted IP hashes. Minute counters become eligible for cleanup after one hour; registration counters after two days. These are separate from provider security logs.
• Earlier Google Analytics records: collection is now off. Our property retains event-level data for two months and user-level data for fourteen months. New activity resets Google's user-data retention period. Most aggregated standard reports are not governed by those periods. Device cookies are configured for up to 90 days without automatic renewal.
• Enquiries, operational logs and recovery copies: kept as needed to resolve an enquiry, investigate an incident, operate recovery or meet legal obligations. The period depends on the purpose and provider retention arrangements. Deletion from active records does not promise immediate erasure from every provider log or recovery copy.

Your choices and rights

Depending on your location and the applicable law, you can request access, correction, deletion, restriction or portability, object to legitimate-interest processing and withdraw consent. Contact us using the details above. We may need enough information to verify the request relates to you; never email your access secret or full private backup. We normally respond within one month and will explain any lawful extension or restriction.

You may complain to the UK's Information Commissioner's Office or your local data protection authority. You do not have to contact us first.

Clear cookies or site data through your browser to remove device storage. This can permanently remove progress or leaderboard access without a private backup. Declining analytics does not clear game saves.

Children and families

Jab & Move is intended for players of all ages, including children. It is a stylised boxing game. Parents and guardians should help children decide whether the game is suitable for them and guide their use of online features.

This audience description is not an official age rating and does not override a device manufacturer's minimum age, account rules or safety guidance. Children should ask a parent or guardian before using a headset, joining an online room or sharing information publicly.

For younger players: use a made-up name. Keep your real name, school, address and contact details private. Only share room invitations with people you know. Ask a trusted adult if something worries you.

Optional analytics and personalised advertising are off for everyone. We do not ask for your date of birth or use an adult checkbox to authorise tracking. A parent or guardian can contact us about a child's information. We will assess the request and remove information where appropriate.

Changes to this notice

We will update this page when services or data practices change and show the date above. Material changes to optional collection will be explained before they start, with a new choice where required.