1. Data controller
- Controller: Carles Garcia
- NIF: 46988642X
- Contact: hello@sudokubattleapp.com
This policy explains how we process personal data when you use the Sudoku Battle app, website and related services (the “Service”), in accordance with Regulation (EU) 2016/679 (“GDPR”) and Spanish Organic Law 3/2018 (LOPDGDD).
We have not appointed a Data Protection Officer because we are not legally required to; you can raise any privacy matter at hello@sudokubattleapp.com.
2. Data we process
Account data. A device identifier that creates your guest account; your username, avatar (chosen from presets) and friend code; your language; and, if you link them, your email address and password (stored only as a secure hash) or your Game Center player ID.
Game data. Your level, points and arena; your matches (the moves you make, results, mistakes and timings, the opponent and the date); your position in the rankings; your purchases’ benefits (such as an arena pass). Practice games, best practice times and app settings are stored only on your device.
Social data. Your friends, friend requests and challenges, and the codes and links used to share them.
Public information. Your username, avatar, level and rank are visible to other players — in the rankings, to your opponents and to your friends.
Purchase data. The products you bought and their store transaction details, received from Apple to validate and grant the purchase. We never receive your card or bank details.
Advertising data. If you use the free version, Google AdMob receives data needed to show and measure ads, such as your IP address and device information, and — only if you allow tracking in the iOS prompt — your device’s advertising identifier (IDFA). Your consent choices are recorded by Google’s consent tool where the law requires consent.
Notifications. If you allow notifications, a push token for your device.
Technical data. App version, device model and OS version, and server logs (IP address, timestamps, the requests made) kept for security and troubleshooting.
We do not use analytics or marketing trackers of our own.
3. Purposes and legal bases
| Purpose | Data | Legal basis (GDPR art. 6) |
|---|---|---|
| Providing the game: accounts, matchmaking, refereeing matches, rankings, friends and challenges, history, sign-in on other devices | Account, game, social, technical | Performance of a contract (6.1.b) |
| Granting and restoring purchases, managing the subscription | Purchase data | Performance of a contract (6.1.b) |
| Sending account emails (password reset, account deletion codes) and notifications you enabled | Email, push token | Performance of a contract (6.1.b) |
| Showing personalised ads and measuring them | Advertising data | Consent (6.1.a), which you can withdraw at any time |
| Showing non-personalised ads to keep the game free, and preventing ad fraud | Advertising data without the advertising identifier | Legitimate interest (6.1.f) in funding the free game |
| Security, fair play (detecting cheating and abuse), troubleshooting | Game and technical data, logs | Legitimate interest (6.1.f) in a secure and fair game |
| Legal obligations (tax, accounting, requests from authorities) | Purchase records | Legal obligation (6.1.c) |
Matchmaking pairs you with opponents of a similar level; this does not produce legal or similarly significant effects on you.
4. Recipients and processors
We do not sell personal data. We use these providers to run the Service:
| Provider | Purpose | Location |
|---|---|---|
| OVH SAS (OVHcloud) | Hosting of the game servers and database | France (European Union) |
| Cloudflare, Inc. | Hosting and delivery of this website | Global network |
| Mailgun Technologies, Inc. | Sending account emails | European Union (Mailgun EU region) |
| Google LLC / Google Ireland Ltd. | Ads (AdMob) and consent management; push notifications (Firebase Cloud Messaging) | USA / EU / global |
| Apple Inc. | App Store purchases, Game Center, push notifications (APNs) | USA / global |
Google acts as an independent controller for the ads it serves under its own policies (see policies.google.com/technologies/partner-sites). Apple acts as an independent controller for App Store transactions and Game Center. Personal data may also be disclosed to competent authorities when required by law.
5. International transfers
Our game servers are in France, within the European Union. Where a provider processes data outside the European Economic Area, the transfer is protected by an adequacy decision of the European Commission (including the EU–US Data Privacy Framework, where the provider is certified) and/or the European Commission’s Standard Contractual Clauses.
6. Retention
- Account, game and social data: kept while your account exists, and deleted when you delete it.
- Account deletion and password reset codes: valid for 15 and 30 minutes and deleted once used or expired.
- Purchase records: kept for the periods required by Spanish tax and commercial law (generally up to 6 years).
- Server and security logs: kept up to 6 months.
- Data on your device (practice games and times, settings): until you delete the App.
7. Your rights
You have the right to access, rectify and erase your data, to restrict or object to processing (including processing based on legitimate interest), to data portability, and to withdraw consent at any time without affecting earlier processing.
- Ads: change your consent in Profile → Settings → Privacy options (shown where the law requires it), and tracking in your iPhone’s Settings → Privacy & Security → Tracking.
- Your profile: change your username and avatar in the Profile tab.
- Erasure: delete your account in the App (Profile → Account → Delete account) or, for an account with an email, on our website at sudokubattleapp.com/delete-account.
- For anything else, write to hello@sudokubattleapp.com (from the email linked to your account, or with your username and friend code). We will respond within one month.
- If you believe we process your data unlawfully, you may lodge a complaint with the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid — www.aepd.es — or with your local supervisory authority.
8. Security
We apply technical and organisational measures appropriate to the risk, including TLS encryption of all connections, token-based sessions, hashed passwords, rate limits on sensitive actions, server-side validation of every move and purchase, and access controls on our infrastructure. If a breach is likely to result in a high risk to your rights, we will notify you and the AEPD as required by GDPR articles 33–34.
9. Children
The Service is not directed at children. You must be at least 14 years old to use it (see the Terms). We do not knowingly process data of children under 14; if you believe a child under 14 is using the Service, contact us and we will delete the account. Ads in the App are limited to content suitable for a general audience.
10. Device permissions
- Tracking (App Tracking Transparency): asked once by iOS; you can change it at any time in Settings. Declining changes nothing in the game.
- Notifications: asked through the system dialog; used only for game messages such as friend requests and challenges, never for marketing. You can turn them off in Settings.
11. Our website
This website does not use cookies or analytics. Our hosting provider processes your IP address and request details to deliver the pages and protect them from abuse. The account deletion page sends the email and code you type directly to our game server, and stores nothing in your browser.
12. Changes to this policy
We may update this policy when the Service or the law changes. Material changes will be announced in the App or on this website before they take effect, with the new date at the top.