Your journey, kept private.

Updated September 5, 2026. False Floor, LLC operates the Morpheus apps and online services at soapbubble.xyz.

We use your information to save and resume your game, connect your devices when you sign in, show discovery progress, protect the service, and investigate reports you send. We do not sell your data or use advertising identifiers, cross-site advertising, or device fingerprinting.

What Morpheus keeps

Your device keeps save slots, preferences, discovered locations, and pending saves. After you choose to play with online services, Morpheus also stores your game state, a random player and device identifier, and basic session details such as platform, app version, current scene, and service activity times. You can play without an account.

Signing in associates your progress with your account so other signed-in devices can resume it. Clerk handles authentication, including information provided by your sign-in method. We use your verified account identifier to own saves; we do not require your real name or public profile. When available, we securely keep the Apple sign-in credentials needed to revoke authorization when you delete your account. We also keep a minimal record of an incomplete Apple authorization so deletion status reflects any authorization we could not confirm.

A report is sent only when you select Send. It includes your text, the optional technical details described in the report form, and any screenshot you include. Reports stay private to the developer. Avoid including unrelated personal information; a reply email is optional.

Discovery and service diagnostics

Discovery is calculated from locations recorded in your saves. At the ending, Morpheus may compare your discovery with an aggregate of other players’ currently saved completed games. It does not reveal anyone else’s identity or save. The comparison shows how many other players are represented. Recorded progress is not a certification that a game was played without modifications.

We use operational session records to make saves and support work. We do not keep a separate click-by-click browsing history or use these records for advertising.

Your choices

The game menu’s Privacy control lets you stop online services while continuing to play locally. Saves and reconnects do not ask you to make repeated privacy choices. Signing out changes the account used on the device; it does not delete an account or erase previously stored online information.

Privacy also lets you delete online saves, sessions, and reports while keeping this device’s journeys. That stops online services on this device. Another connected device may upload its local progress again. Deleting your sign-in account through account settings also removes its Morpheus online records. Private attachments become inaccessible immediately and are removed by daily cleanup once they are at least 24 hours old.

You can request access, correction, export, or deletion using our contact form. Include a reply address if you want a response. Depending on where you live, you may also object to processing, restrict it, withdraw consent without affecting earlier lawful processing, or complain to your data-protection authority. We may need enough information to confirm which records are yours.

Storage and retention

Neon stores game and session records; private Vercel Blob storage holds report attachments. These Morpheus stores are located in the United States. Vercel delivers the website and API, and Clerk provides account services. Their infrastructure may process information in other countries, subject to their contractual safeguards.

Signed-in saves remain until deletion is requested. Inactive anonymous player data is eligible for deletion after 90 days, session diagnostics after 30 days, and reports after 90 days. A daily cleanup removes expired records and abandoned report uploads. Provider backups and security logs may remain for their separate limited retention periods.

The app does not store raw IP addresses in its player database. For abuse prevention, it uses expiring request counters and daily keyed hashes of network addresses. Hosting and authentication providers also process connection information to operate and secure their services.

An accepted account deletion may remain pending while our sign-in provider completes it. We retain an encrypted account reference only until deletion is confirmed. A hash prevents a retrying session from recreating deleted data while deletion is pending and for 30 days after completion. It contains no profile or game progress.

We keep a minimal deletion receipt indefinitely so a device that was offline can finish cleanup later. The completed receipt contains a random reference, a protected recovery-token hash, status and dates, with no account identifier, game, or report data.

Apple revocation credentials may remain encrypted for up to 30 days while we retry revocation. During that time, the revocation job is linked only to the random deletion receipt so its status can be updated. We remove the credentials when revocation succeeds or that period ends. A failed revocation does not prevent account deletion. You can also revoke Apple access in your Apple Account settings.

Why we process it

We process the information needed to provide the game services you request, and limited security and reliability information for our legitimate interest in operating them safely. Where processing relies on your permission, you can withdraw it through Privacy or contact us. We do not treat optional advertising or unrelated analytics as necessary gameplay processing.

Material changes will be described where you use the affected feature. For privacy or support requests, contact False Floor, LLC.