Privacy Policy - Pixel Pet: Retro Dog Watch

Effective date: 2026-10-16

This Privacy Policy applies to 'Pixel Pet: Retro Dog Watch' (package name: 'com.pixelpond.pixelpet.retrodogwatch'), developed by Pixelpond. That Google Play package has two parts: the watch face, and a small phone app, “Setup”, which has its own section below. The watch face runs only on your watch. It does not collect, store, transmit, or share any personal user data, usage analytics, location data, sensor data, or device identifiers with the developer or any third parties.

The watch face reads the following information only to render itself:

• Current system time, date, time zone and daylight-saving state, to run the clock, the calendar days and the scenes of the day.
• Device battery level and charging state, for the battery-shaped chapters and the low-battery look.
• Progress towards your daily step goal, shown on the face.
• Heart rate from your watch's heart-rate sensor, which sets how fast the dog wags. The number itself shows only if you choose a heart-rate complication. It is read on the watch only.
• The current weather condition, temperature and hourly forecast from your watch's own weather service, when it is available, to shape the weather chapters.
• The number of unread notifications, shown on the face as a count only.
• The current moon phase, calculated by Wear OS, for the night sky.
• Complication data provided by Wear OS for the face's three complication slots: by default your next calendar event, your step count and sunrise or sunset, or the providers you choose in the watch's editor. This data is read only to show it on the watch screen.
• Your configuration selections (such as your dog, its best friend, you, the sky, clock, info line, hemisphere and always-on styles) to render your chosen scene.
• Active and ambient state transitions of your Wear OS device to switch between normal and Always-On Display (AOD) modes.

Because the watch face is built using the declarative Watch Face Format, it contains no executable code (android:hasCode="false") and requests no permissions of its own: Wear OS supplies the values above, and all rendering is handled locally on your watch by the Wear OS operating system. The watch face sends nothing to Pixelpond, and it contains no advertisements, in-app purchases, analytics or crash reporting. Pixel Pet is made for people aged 13 and over and is not directed at children.

Phone Setup app. Everything above describes the watch face. The same Google Play package also installs a small phone app, “Setup”, that helps you install and apply the face, and Setup does use the internet. It has no ads, no analytics or crash reporting of its own, and no Pixelpond account. Here is what it does:

• Update check. It downloads our public list of current versions from the Pixelpond website. The request carries no account, settings or watch details. Like any web request, it shows our host (Vercel) your IP address and standard request details, which include your Android version and phone model. Our host retains request records according to its configured hosting and observability settings. Request records can include your IP address, the country inferred from it, your user agent, the requested path and the response result. We use hosting records to monitor service health, diagnose problems and protect the service.
• Purchase check. From Setup version 14, Setup asks Google Play for a signed answer about whether your Google account holds this face, and sends it to our purchase checker (Google Cloud, Sydney). The checker asks Google to read it and replies “confirmed” or not. The check includes the face’s package and version, signing certificates, and Google’s app, device and licence verdicts. Google Cloud’s request logs record your IP address and standard request details; the checker’s log records the verdict and whether the check matched, for service health, diagnosis and protection against misuse. Google Cloud keeps these logs for 30 days. Our checker’s database (Neon, Sydney) keeps a one-time check code, the face’s package and version, and a hashed form of your IP address, used to limit repeated checks. The hash is not anonymisation: a known address can be matched to it. Codes expire after two minutes; later checks remove records that expired more than five minutes earlier. We also keep a daily count of checks per face, and later checks remove counts more than two UTC calendar days old. We never receive your name, email or payment details. Your phone keeps a confirmed result in memory for up to five minutes. Setup 13 and earlier do not contact this purchase checker.
• Google Play. It asks Google Play whether a newer Setup is available, and opens the face’s Play listing, on your phone or on your watch, when you tap Install or Update.
• Your watch. It uses Google Play services to find your connected watch and show its name and, if the Pixelpond app is installed, asks it which version of the face your watch has. That stays between your phone and watch and is not sent to us.
• The Pixelpond app. Setup checks whether the Pixelpond app is installed on your phone, and reads the same public list of versions to see whether the app is on Google Play. It keeps the latest answer on your phone and relies on it for up to seven days. Links it opens to pixelpond.au or to the Pixelpond app’s Play listing carry fixed tags that name this face and the button you tapped, and nothing about you or your device.
• On your phone. Setup remembers your setup step and your Less motion choice, and does not back them up. The Help email button opens a draft in your own email app; nothing is attached or sent until you send it. Where Setup shows a Privacy policy button, it opens this page in your browser.

If you have questions, contact: support@pixelpond.au

This policy may be updated. The latest version will live at the URL provided in the Google Play listing.