Privacy policy

Who processes your data

The data controller is Josep Maria Guirao Garnica, with an address for notices at Carrer Balançó i Boter, 22, 08302 Mataró (Barcelona), Spain.

Arcade Buster is an independently developed game. The data described here is processed solely so that the game works.

What data we collect

When you open the game for the first time: your date of birth. It is mandatory and is only asked for once. It is not shown on your profile or in the rankings, it is not sent to third parties and nobody but you can see it.

If you play as a guest: a device identifier, your progress, your scores and your coins.

If you create an account with an email and password: in addition, your email address, whether you have verified it, and an encrypted password.

If you sign in with Google: an identifier that Google assigns to your account for this app and the email address of that account. That identifier never leaves our servers and is not shown on any screen. We do not receive your Google password or any other data from your Google account.

In both cases we also store a contact email, which is the address we write to in order to manage your account. It may or may not be the same as the email you sign in with: people who sign in with Google have no sign-in email, but they do have a contact email.

If you fill in your profile: player name, avatar and country, which are public in the rankings.

If you answer a survey: your answers and technical data about your device's screen, so we can tell whether the game looks right on different devices.

To protect accounts against abuse: the IP address from which you log in, request links by email or submit the forms on this website. It is only used to limit repeated attempts and is deleted after one day.

If the game crashes: technical diagnostic data. This includes the error message and stack trace, the app version, the platform, the device model, the version of the browser or web engine, the game screen you were on and a pseudonymous installation identifier. Your email address, player name, password, session keys and the content of what you type are not sent.

If you accept usage analytics: data about how you play. This includes the levels you start and finish, how each game ends, the screens you visit, the language, the type of controls, the app version, basic device data and a pseudonymous identifier. Your email address, player name, password and session keys are not sent, and this data is not used to show you ads.

If you accept ads: Google collects the data needed to show them to you and measure them, including a device advertising identifier. We do not send it your email address, your player name or your date of birth.

If you turn on notifications: a notification identifier that Firebase assigns to this installation of the game, the device's language and time zone, the app version, whether you have them turned on in the game and whether the phone's system allows them. We also store which notifications we have sent you and whether you open them, so we do not repeat them and can tell whether they are useful. The alert telling you that your tickets have been refilled does not go through our servers: the phone itself schedules it.

To prevent spam in the contact and beta forms on this website: the time at which you open the form and, through Google reCAPTCHA, technical data about your browser and how you use the page.

What we use it for

To save your progress across devices, show the rankings, manage the coin economy and improve the game.

Your email address lets you sign in to your account and lets us send you the messages needed to manage it: verifying the email itself, recovering your password and notices about account deletion. To an email address you have not verified we send nothing other than the message to verify it.

Your date of birth is used for two things. The first is to apply the treatment that corresponds to your age: if you are a minor, the game does not show you advertising or ask you for permissions you cannot give. The second is to give you a gift on your birthday.

Usage analytics lets us find out which levels are too hard, at what point people stop playing and which parts of the game go unused. That is how we decide what to fix first.

Ads help fund the development of the game. They are voluntary: you watch them in exchange for coins, and only if you ask for them.

Notifications let us tell you about things in the game that matter to you: that your tickets have been refilled, that you have a reward, that there is an event, a new world or some news and, if you have not played for a while, a reminder. You only get them if you turn them on.

Our legal basis for processing it

Your account, your progress, the rankings and the coin economy: performance of the contract. Without that data we cannot offer you the game you asked for. The same applies to your email address and the messages needed to manage the account.

The IP address used to limit repeated attempts: our legitimate interest in protecting your account and the service against abuse, such as attempts to guess passwords.

Your date of birth, to apply the treatment that corresponds to your age: compliance with the obligations imposed on us by the rules on the protection of minors and on advertising. We cannot offer you the game without knowing your age, because without it we would not know what we must protect you from.

Your date of birth, for the birthday gift: our legitimate interest in offering benefits to players. You can object by writing to us.

Ads: your consent. It is requested the first time you ask to watch one, through Google's form, and the game works the same if you do not accept.

Technical diagnostic data: legitimate interest in detecting and fixing bugs in the app. You can object at any time by turning off «Error reports» in Options › Privacy.

Usage analytics: your consent. It is requested the first time you open the game, it is turned off by default and the game works the same if you do not accept. You can withdraw it whenever you like in Options › Privacy; when you do, collection stops and deletion of the data already collected is requested.

Survey answers: your consent, which is voluntary and which you can withdraw whenever you like.

Notifications: this is a feature you turn on, so we process the data to provide the service you ask us for (performance of the contract). In addition, the phone asks you for its own permission. They are never turned on by themselves, and you can turn them off whenever you like.

The spam checks on this website's forms: our legitimate interest in protecting the service against automated submissions.

Who we share it with

We do not sell data or hand it over to advertisers. Your player name, avatar, country and score are publicly visible in the game's rankings.

To detect and fix bugs we use Sentry (Functional Software, Inc.), which acts as a data processor on our behalf and receives only the technical diagnostic data described above. That data is stored on its servers in the European Union.

Account emails (email verification, password recovery and account notices) and the notifications of the messages you send us through the contact form are sent through Resend, which acts as a data processor on our behalf and receives only the recipient address and the content of each message. It sends them from its servers in the European Union (Ireland). Resend is a United States company, so there may be access from outside the European Economic Area, with the safeguards required by European law.

If you accept usage analytics, that data is processed with Google Analytics for Firebase. Google Ireland Limited acts as a data processor on our behalf and may process it outside the European Economic Area with the safeguards required by European law. If you do not accept, the game sends nothing to Google.

If you accept ads, they are shown through Google AdMob. Google Ireland Limited and its advertising partners process that data and may do so outside the European Economic Area with the safeguards required by European law. Consent and the list of partners are managed from Google's own form, which you can return to whenever you like.

If you choose to sign in with Google, the sign-in is handled by Google, which therefore knows that you have signed in to Arcade Buster. We do not send it any of your data: we receive from Google a signed proof that the account is yours, and we check it against its servers. Google Ireland Limited is the controller of whatever it processes on its own behalf in that process, under its own privacy policy.

If you turn on notifications, they are delivered through Firebase Cloud Messaging. Google Ireland Limited acts as a data processor on our behalf and receives only your installation's notification identifier and the content of each notification. It may process them outside the European Economic Area with the safeguards required by European law. The image that comes with some notifications is downloaded by your phone from our website.

Your date of birth is not shared with anyone. It is not sent to Google, to Sentry or to any other third party, and it does not appear on any public screen in the game.

The contact and beta forms on this website use Google reCAPTCHA to tell people apart from automated programs. When you open and send them, Google Ireland Limited receives technical data about your browser and your interaction with the page, and processes it under its own privacy policy. It may do so outside the European Economic Area with the safeguards required by European law. We do not send it the content of your message.

How long we keep it

For as long as your account is active.

If you ask to delete an account that can be signed in to again, it is locked for 30 days: during that time it cannot be used and does not appear in the rankings, and you can recover it by logging in or with the link we send you. After 30 days it is permanently deleted, except for anything a law requires us to keep. The same applies to an account that signs in with Google: it gets the same 30 days and is recovered by signing in with Google again.

An account is only deleted immediately when there is no longer any way to sign in to it again: that of someone playing as a guest, and one whose email expired without being verified. Waiting 30 days would not help anyone.

If you change your sign-in method, the previous one is kept for 7 days and stays inactive: it cannot be used to sign in and nobody else can use it. It exists so that you can undo the change if you did not request it. After those 7 days it is deleted, and that email or that Google account becomes free again.

If you ask to change your sign-in method to email and password, the new email and the new encrypted password are stored separately for 24 hours, waiting for you to confirm with the link we send you. If you do not confirm, they are deleted automatically and your account stays exactly as it was.

If you do not verify your email address within 7 days of entering it, we remove it from your account. The account and your progress are kept, and you can enter another one.

Guest accounts that stop being used are deleted: after 30 days if no game was ever played, and after one year if there were games.

The IP address we use to limit repeated attempts is deleted after one day.

Technical diagnostic data is kept for 30 days and deleted automatically when that period ends.

Usage analytics data is kept for 14 months and deleted automatically when that period ends.

Your date of birth is kept for as long as you have the account, and is deleted when the account is permanently deleted.

The notification identifier is kept while the app is installed. When you sign out or sign in with another account, it stops being associated with the previous one. It is deleted when Firebase tells us that it is no longer valid (for example, because you have uninstalled the game), if nine months go by without the app being opened, or when the account is permanently deleted. The record of notifications sent is also deleted when the account is deleted.

Your rights

You can access your data, rectify it, erase it, restrict or object to its processing, withdraw any consent you have given and request its portability. Withdrawing consent does not affect the lawfulness of processing carried out before.

You can delete your account from the game, in Options › Account › Delete account, or with the form on this website; to use the form, the account email must be verified. You can correct your email address while it is not verified, change your password and change your sign-in method (from email and password to Google, or the other way round) in Options › Account › Manage access details. We notify you by email of every change of method, you can undo it for 7 days, and after that you have to wait 30 days before changing it again. To stop sending error reports or withdraw usage analytics, go to Options › Privacy in the game. To review or withdraw your consent to ads, go to Options › Privacy › Ads, which opens the Google form where you gave it. To stop receiving notifications, turn them off in Options › Game › Notifications or in your phone's notification settings.

Your date of birth cannot be changed from the game: it is declared only once, on purpose, so that the age check actually means something. If you made a mistake when entering it, write to us and we will correct it.

Minors

When you open the game for the first time we ask for your date of birth, and what we do afterwards depends on it. You can play in every case: your age does not block the game, only what data we process.

If you are under 13: you are not shown advertising of any kind, no usage analytics is collected, you are not invited to surveys and you are not sent commercial communications.

If you are between 13 and 15: you can see ads, but never personalised ones, and no usage analytics is collected and you are not invited to surveys, because for that processing the law requires a consent that you cannot give on your own at your age.

If you are 16 or over: you can decide for yourself about usage analytics and ads, and both are turned off by default.

Notifications are only sent if you turn them on. We never send minors reminders to come back and play: at most, alerts about their tickets, their rewards and news about the game.

Some features need the permission of your mother, father or guardian. We have not yet set up a way to ask for it, so for now those features remain turned off.

If you believe that a minor in your care has given us data and you want us to delete it, write to us and we will do so.

Contact

To exercise your rights or for any question about this policy, you can write to hello@arcadebuster.com, or by post to the controller's address given at the beginning.

If you believe we have not handled your request properly, you can file a complaint with the Agencia Española de Protección de Datos (Spanish Data Protection Agency, www.aepd.es).