Privacy Policy
1. Who is responsible
The controller for your data is [[COMPANY_NAME]], [[ADDRESS]], email [[EMAIL]]. We are based outside the EU. Our representative in the EU (Art. 27 GDPR) is [[EU_REPRESENTATIVE]]; you can contact them instead of us for any privacy question.
2. What we collect, and why
We collect as little as possible. You do not give us your name or email to play.
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Guest ID — a random account number created when you start | Link your progress and purchases to you | Contract, Art. 6(1)(b) |
| Save game — level, buildings, coins, Pearls, boosts, settings, timestamps | Keep and restore your progress | Contract, Art. 6(1)(b) |
| Purchases — product, price, currency, time, Stripe payment reference | Deliver what you bought, receipts, refunds, tax and accounting duties | Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c) |
| Technical data — IP address, browser type, time of request (server logs of our providers) | Run the game securely, prevent abuse and fraud | Legitimate interest, Art. 6(1)(f) |
Payment details such as your card number go directly to Stripe. We never receive them.
3. Data stored on your device
The game stores your save game and settings in your browser's local storage so you can continue where you left off. This is strictly necessary for the game you asked for, so no consent banner is needed for it. We do not use advertising cookies, tracking pixels or analytics.
4. Service providers
We use these providers. They process data only on our instructions under a data processing agreement (Art. 28 GDPR):
- Supabase — database, guest login and server functions. Stores your Guest ID, save game and purchase records. Server region: [[SUPABASE_REGION]].
- Stripe — payment processing. Stripe handles your payment details on its checkout page. For its own legal duties (for example fraud prevention and anti-money-laundering) Stripe acts as an independent controller; see stripe.com/privacy.
- Website hosting — [[HOSTING_PROVIDER]] delivers the game files and keeps short server logs.
- Google Fonts — the game currently loads fonts from Google servers, which receive your IP address. [[REMOVE_THIS_LINE_AFTER_FONTS_ARE_SELF_HOSTED]]
5. Transfers outside the EU
We and some providers are located outside the EU/EEA. Where a country has no EU adequacy decision, transfers rely on EU Standard Contractual Clauses (Art. 46 GDPR) or, for certified US recipients, the EU-U.S. Data Privacy Framework. You can ask us for a copy of the safeguards.
6. How long we keep data
- Guest ID and save game: as long as your account exists. We delete accounts with no activity for [[INACTIVE_DELETION_PERIOD]].
- Purchase records: [[PURCHASE_RETENTION_PERIOD]], because tax and accounting law requires it. After deletion of your account we keep only what this requires.
- Server logs at our providers: a short period, usually a few days to weeks.
- Local storage on your device: until you clear your browser data.
7. Your rights
You have the right to access your data, correct it, delete it, restrict or object to its processing, and receive it in a portable format (Art. 15–21 GDPR). To use these rights, email [[EMAIL]] and include your Guest ID so we can find your data. We answer within one month.
You can also complain to a data protection supervisory authority, in particular in the EU country where you live.
8. Children
The game does not ask for names, emails or other contact details, so we do not knowingly collect such data from children. Purchases by minors need a parent's or guardian's permission (see the Terms). Parents can ask us to delete a child's data at any time.
9. No automated decisions, no selling of data
We do not make decisions about you based solely on automated processing, we do not build advertising profiles, and we do not sell your data.
10. Changes
If we add a new service (for example analytics or ads), we will update this policy first and ask for your consent where the law requires it.