Privacy Policy

1. Who we are

The Service is operated by Project Team For You, which is the data controller responsible for your information. You can reach us, including our privacy officer, at [email protected].

2. Information we collect

There is no sign-up or login. When you open the game for the first time, the app creates a random device identifier (a UUID) and stores it on your device. Our server then issues an anonymous player ID, an access token and an automatically generated nickname. You may change your nickname at any time and may optionally choose a country flag and a profile title; these are shown on leaderboards.

Pixel Pop Arcade: the mini games store your best scores and settings only in your browser’s local storage (localStorage). Arcade scores and settings are not sent to our servers.

Reminders: on Android, the app can show an optional daily reminder (by default at 19:00 device time). It is scheduled locally on your device; we do not collect a push notification token. You can turn it off in the game’s Settings or in your device’s notification settings.

We do not ask for, and do not want, sensitive information, precise location, contacts, photos or payment card details.

3. How we use information and our legal bases

• Providing the game — keeping your progress, syncing your cloud save and restoring it on reinstall (performance of a contract).
• Daily challenge, weekly tournament, duels and leaderboards — recording scores and displaying your nickname, country flag and title (performance of a contract).
• Fair play and score verification — re-simulating the replay log submitted with a leaderboard score on our server to confirm that the score is genuine, and detecting cheating, abuse and fraud (legitimate interests in fair competition and security).
• Fixing bugs — using error reports only to find and fix crashes and errors (legitimate interests in providing a working and secure game).
• Improving the game — analysing level run statistics, mainly in aggregated form, to balance level difficulty (legitimate interests).
• Security — rate limiting requests and protecting our servers (legitimate interests).
• Advertising — showing ads that fund the free game; personalised ads only where you have consented, where consent is required (consent, or legitimate interests for non-personalised ads where permitted).
• Legal obligations — responding to lawful requests and keeping records required by law.

Where we rely on legitimate interests, we have balanced them against your rights, and you may object at any time (see section 10). We do not use your information for automated decision-making that produces legal or similarly significant effects on you. Automatic score verification only decides whether a score is accepted on a leaderboard; if you think a score was rejected by mistake, contact us.

4. Advertising

The Android app uses Google AdMob to show rewarded ads (which you choose to watch, for example to receive a booster) and interstitial ads (full-screen ads shown between levels). The web version may use Google AdSense / H5 Games Ads placements where we have enabled them. Google may use your device’s advertising ID (Android) or cookies and similar technologies (web), together with your IP address and device information, to deliver ads, measure performance, limit repetition and prevent fraud.

• Consent (EEA, UK and Switzerland): in the Android app we use Google’s User Messaging Platform (UMP) to show a consent form and ask for your consent before personalised ads are shown and before information is stored on or read from your device for advertising. On the web, where ads are enabled, consent for these regions is requested through a Google-certified consent management platform.
• Changing your choice: if the game’s Settings show a Privacy options entry, you can reopen the consent form there at any time. If your version does not show it, contact us at [email protected] and we will help you, or turn off ads personalisation in your device or Google settings (see below). Withdrawing consent does not affect processing carried out before the withdrawal.
• Non-personalised ads: if you do not consent, only non-personalised or limited ads are requested. These do not use your past activity for targeting, but Google may still use cookies or identifiers for frequency capping, aggregated reporting and fraud prevention, as permitted by law.
• Opting out: on Android you can reset or delete your advertising ID, or opt out of ads personalisation, under Settings → Google → Ads (or Settings → Privacy → Ads). On the web you can manage cookies in your browser and visit adssettings.google.com.

Learn how Google uses information from sites and apps that use its services at policies.google.com/technologies/partner-sites.

5. In-app purchases

The Service is currently free to play and does not offer in-app purchases. If we introduce an optional purchase in the future (for example, “Remove Ads”), it will be processed entirely by Google Play: we would receive only a purchase token and the status of the transaction, never your payment card details, and we will update this Policy beforehand. Google’s handling of payment data is governed by the Google Payments Privacy Notice.

6. Sharing and service providers

We do not sell your personal information and we do not share it with third parties for their own marketing. We use the following service providers (processors), which process data only on our instructions:

We may also disclose information if required by law, to protect the rights and safety of our players or others, or in connection with a merger, acquisition or sale of assets, in which case this Policy will continue to apply.

7. International data transfers

We are based in the Republic of Korea, and our servers and service providers are located mainly in the United States. Your information may therefore be transferred to and processed in countries whose data protection laws differ from those of your country. Where required, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses and our providers’ data processing terms. Details of transfers under Korean law are listed in section 12.

8. How long we keep information

• Player data (player ID, hashed device identifier, nickname, country, title, cloud save, daily challenge and weekly tournament entries with their replay logs): until you delete your data or your player record is deleted.
• Duels (duel scores and replay logs): deleted automatically about 7 days after the duel expires (duels expire 30 days after they are created), or earlier if you delete your data.
• Level run statistics: up to 24 months, after which they are deleted or kept only in aggregated form that no longer identifies you.
• Error reports: deleted automatically after 30 days.
• IP addresses: used transiently for security and rate limiting and not stored long term.
• Pixel Pop Arcade scores and settings: kept only in your browser until you clear its site data; we never receive them.

We may keep information longer if the law requires it.

9. Deleting your data

• In the game: open Settings → Delete my data. Your player record, cloud save, nickname, level run statistics and your daily challenge, tournament and duel entries (including replay logs) are erased from our servers immediately, and the local identifier on your device is reset.
• By email: write to [email protected] and include your player ID (shown in Settings) if possible. We will complete the deletion within 30 days.
• Error reports do not contain a player ID, so we cannot link them to you; they are deleted automatically after 30 days.
• Pixel Pop Arcade: clear your browser’s site data for this website to remove arcade scores and settings (this also removes the web game’s local data on that browser).

Uninstalling the app alone does not delete server data. More information: https://pixelpopgame.com/legal/delete-account.html. Advertising data held by Google is managed through your Google or device settings.

10. Your rights (EEA, UK and Switzerland)

Under the GDPR and similar laws you have the right to access your data, to have it rectified or erased, to restrict its processing, to receive it in a portable format (portability), and to object to processing based on legitimate interests. Where processing is based on consent, you may withdraw consent at any time without affecting earlier processing. You also have the right to lodge a complaint with your local supervisory authority.

To exercise these rights, email [email protected]. Because we do not know your name, we may ask for your player ID to verify the request. We respond within one month.

11. California and other US states

Under the CCPA/CPRA and similar state laws, you have the right to know what personal information we collect, to access and delete it, to correct it, and not to be discriminated against for exercising these rights.

• We do not sell personal information for money. Disclosure of the advertising ID to Google for personalised ads may be treated as “sharing” for cross-context behavioural advertising. Do Not Sell or Share My Personal Information: you can opt out by turning off ads personalisation on your device (see section 4), by enabling Global Privacy Control in your browser, which we honour, or by emailing us.
• We do not use or disclose sensitive personal information.
• Requests can be sent to [email protected]; you may use an authorised agent.

12. Republic of Korea (PIPA)

For users in Korea, the full disclosures required by the Personal Information Protection Act are set out in the Korean version of this Policy. In summary: we entrust processing to Cloudflare, Inc. (USA), Railway Corporation (USA) and Google LLC (USA); data is transferred to them over encrypted networks as you use the Service, for the purposes and retention periods described above. You may refuse the transfer by not using the Service or by deleting your data. Our privacy officer can be reached at [email protected].

13. Japan (APPI)

We handle personal information in accordance with the Act on the Protection of Personal Information. Personal data is provided to the service providers in the USA listed in section 6, which take measures equivalent to those required by the APPI. You may request disclosure, correction, suspension of use or deletion of your retained personal data by contacting [email protected].

14. Brazil (LGPD)

Under the Lei Geral de Proteção de Dados, you may request confirmation of processing, access, correction, anonymisation, blocking or deletion, portability, information about sharing, and revocation of consent. You may also file a complaint with the ANPD. Our contact for data protection matters (encarregado) is [email protected].

15. Children

Pixel Pop Flow is a casual game for a general audience. It is not primarily directed to children and is not directed to children under 13 (under 16 in the EEA, or the higher minimum age in your country, such as 14 in Korea). We do not knowingly collect personal information from children below these ages, and we do not configure our ads as child-directed. If we learn that we have collected personal information from a child without the required parental consent, we will delete it. Parents or guardians can contact us at [email protected] to ask for deletion; they can also use Settings → Delete my data on the child’s device.

16. Security

We use encrypted connections (HTTPS/TLS), store device identifiers only in hashed form, restrict access to our database to authorised staff, and apply rate limiting and abuse detection. No system is completely secure, but we work to protect your information and will notify you and the authorities of a breach where the law requires.

17. Local storage and cookies

The game stores your random device identifier, access token, settings and a local copy of your progress on your device (app storage or browser localStorage). This is necessary for the game to work. Pixel Pop Arcade stores its best scores and settings only in your browser’s localStorage, and this data stays on your device. On Android, the optional daily reminder is scheduled locally by the app. On the web, where ads are enabled, Google’s ad services may set cookies as described in section 4. Clearing browser data or app storage removes the local data but not your server data.

18. Changes to this Policy

We may update this Policy from time to time. We will post the new version on this page with a new effective date and, for material changes, notify you in the game before they take effect.

19. Contact us

Project Team For You — Privacy officer
Email: [email protected]
Web: pixelpopgame.com

If this Policy is translated, the translation is provided for your convenience; in case of inconsistency, the English version prevails, except for the Korean version for users in Korea or where local law requires otherwise.