Privacy policy

The short version

You can play without an account and without giving us anything. If you sign in, we store a game account: an identifier, your progress, your currency and your purchase history, plus the email address of the account you signed in with, so that we can act on a deletion request later. We never ask for your name, and there is no analytics or tracking software in the game.

Who is responsible

Balloon Crasher is published by WWL Dienstleistung, which is the data controller for the personal data described in this policy. The app is distributed under the application id com.andbabak.balloonscrasher. For anything in this document, including requests to access or delete your data, write to hello@andbabak.com.

What we store

The game can be played offline. A server account is created when you sign in, and holds only what the game needs to give you back what you earned:

• An account identifier. A random value generated by us. It is not derived from you or from your device.
• How you signed in. For a guest account, a stored hash of a secret your device keeps, so a reinstall can recover the same account. A guest account holds no name, no email address and nothing else that identifies you.
• Your email address, only if you sign in with Google or Google Play Games. We store the account identifier that provider gives us, and the email address of that account. The address is kept for one reason: so that if you uninstall the game and later ask us to delete your account, we can tell which account is yours. It is not used for marketing, we do not send newsletters, and it is never shared. We never receive or store your password.
• Your progress. Levels cleared, the stage within the current level, and your Endless high score.
• Your currency and items. Stars, Hammers, Bombs and Freezes, plus a record of each change so a balance can be explained and a duplicate delivery cannot be counted twice.
• Purchases. For each purchase, the order identifier and purchase token issued by Google Play, which product it was, and how many Stars it granted. This is what lets us verify a purchase with Google and refuse the same receipt used twice.
• Prize wheel spins and rewarded ad grants. What was awarded and when, so daily limits work and a reward cannot be claimed twice.
• Technical data while you are connected. A session token, held in memory on the server and expiring after 30 days, and your IP address as part of ordinary server operation and abuse prevention. IP addresses are not stored in your account record.

What we do not do

• There is no analytics, telemetry or crash-reporting software in the game.
• We do not sell your data, and we do not share it for anyone else to advertise to you.
• We do not build a profile of you across other apps or websites.
• We do not ask for contacts, photos, location or microphone access.

Advertising

The game shows ads through Google AdMob. There are two places they appear: a rewarded ad you choose to watch in exchange for an item or a heart, and an interstitial between levels. Ads are never shown when the app opens.

AdMob may use your device advertising identifier to select and measure ads. That is Google acting as a separate controller of that data, under Google's privacy policy. You can reset or delete the advertising identifier in your Android settings at any time.

In the European Economic Area and the United Kingdom you are asked for consent before the first ad request, through Google's User Messaging Platform. You can change that choice later from the game settings. The game is rated for players aged 13 and over and is not directed to children.

Purchases

Stars can be bought through Google Play Billing. The payment itself is handled entirely by Google. We never see your card details, your billing address or your Google account details. We receive a receipt, check it against Google's servers, and record it so the Stars are granted once and only once.

Who else sees your data

• Google, as the operator of Google Play, Google Play Games, Google sign-in and AdMob, for the functions described above.
• Our hosting provider, which operates the physical server. They do not process the data for their own purposes.

That is the complete list. There are no other recipients.

Where your data is

The game server, its database and its cache run on a single server located in Germany. Data is encrypted in transit. Google may process advertising and purchase data outside the European Economic Area under its own safeguards.

Legal basis, for people in the EEA and the UK

• Performance of a contract. Holding your account, progress, currency and purchase history so the game works across devices and a reinstall does not lose what you earned.
• Legitimate interests. Preventing fraud and abuse, including refusing a replayed purchase receipt and limiting how often a reward can be claimed.
• Consent. Personalised advertising, where consent is required. You can withdraw it at any time in the game settings.
• Legal obligation. Keeping purchase records where tax or accounting law requires it.

How long it is kept

Your account and everything attached to it is kept while the account exists. When you request deletion there is a grace period of 14 days, during which signing back in cancels the request. After that the account and its progress, currency, ledger, wheel spins and reward records are permanently deleted.

Purchase records may be retained for longer where tax or accounting law requires it, in a form no longer linked to a playable account.

Your rights

If you are in the EEA or the UK you have the right to ask what we hold about you, to have it corrected, to have it deleted, to receive a copy, to object to processing based on legitimate interests, and to withdraw consent you have given. You also have the right to complain to your data protection authority.

Write to hello@andbabak.com, or see the account deletion page for the fastest route to erasure.

Children

The game is intended for players aged 13 and over and is not directed to children. We do not knowingly collect data from children under 13. If you believe a child has created an account, write to hello@andbabak.com and it will be removed.

Security

All traffic between the game and the server uses TLS. The database and cache are not reachable from the internet. Currency and purchases are decided by the server, never by the app, so a modified client cannot grant itself anything.

Changes to this policy

If this policy changes materially, the updated version is published here with a new date, and the game notifies you the next time it connects. Continuing to play after a change means the updated policy applies.