Privacy Policy

1. Who we are

The data controller is Adrian Duardo, the independent developer of the App. You can write to aduardoyanes@gmail.com about anything to do with your data.

2. Data at a glance

Everything below, in one table.

3. What we collect

3.1 Anonymous device session

The first time you open the App, your own phone generates a random identifier (crypto.randomUUID()) and stores it. That identifier is sent to the server to create your account. What it is not matters: it is not the Android advertising ID, it is not the IMEI or any hardware serial number, and it cannot be used to recognise you outside the App. If you reinstall, a new one is generated and the previous account is left orphaned.

Along with it, the server creates an automatic nickname such asSonda-4F2A, which you can change whenever you like.

3.2 Google account (optional)

Linking Google is voluntary and serves exactly one purpose: not losing your progress when you change phone. The App works in full without it.

If you do link it, these permissions are requested and no others:

• openid — to identify you
• userinfo.email — your email address
• userinfo.profile — your public name and photo

Of everything Google returns, the server stores exactly three things:

• your Google identifier (sub), a number that only means anything between Google and this App;
• your email address;
• the URL of your Google profile picture (the image itself is served by Google, it is not copied).

Your Google name is received during the process but isnot stored anywhere. Your in-game nickname is chosen by you and has nothing to do with it. Google accounts whose email is not verified are rejected.

There are no redirects to a sign-in page and no passwords involved: the App receives a signed token from Google and the server checks the signature. This App never sees your Google password.

3.3 How you play

When you finish a run, the following is sent and stored:

• the mode, the day and the score, the metres and the duration;
• the replay: the sequence of what your thumb did, about 3 bytes per tick. It is not video and not audio, it is the list of inputs. It is used to re-simulate the run and check the score is real, and so other players can race your “echo”;
• your duel rating (elo), wins and losses, and the outcome of each duel you play;
• your progress: salt, workshop purchases, what you have equipped and a logbook of your totals. To the server this is an opaque block of text: it stores it and hands it back, but never interprets it.

3.4 On your own phone

The App stores in the device's local storage your session identifier, your access token, your nickname, your progress, your chosen language, whether you have seen the tutorial, and any runs waiting to upload while you are offline. These are not cookies and they never travel to a third party. They are removed when you uninstall the App.

3.5 Technical data

As with any Internet connection, the server receives your IP address: without it there is no way to send you a response. It may appear transiently in the server's technical logs, but it is not written to the database and is not linked to your profile or your runs.

4. What we do not collect

This list matters as much as the previous one. The App does not:

• include any analytics SDK (no Firebase, no Google Analytics, no Crashlytics, no Sentry, none at all);
• send crash reports or usage statistics;
• use cookies or tracking technologies: the session is a credential sent in a header, not a cookie;
• collect the Android advertising ID, because there are no ads (seeAdvertising);
• access your location, camera, microphone, contacts, calendar, photos or files;
• send push notifications;
• offer in-app purchases or ask for payment details: there is nothing to pay for;
• have chat or player-to-player messaging;
• sell or rent personal data. Ever.

The only permission the App declares on Android is android.permission.INTERNET.

5. How and why we use it

Each piece of data is processed for a specific purpose on a specific legal basis (General Data Protection Regulation, Article 6):

• Providing the service — account, progress, leaderboard, seasons, echoes and duels. Basis: performance of a contract, Art. 6(1)(b).
• Checking that runs are genuine — re-simulating replays to detect cheating. Basis: legitimate interest in a leaderboard that means something, Art. 6(1)(f).
• Maintaining and fixing the App — diagnosing errors from what you tell us by email. Basis: legitimate interest, Art. 6(1)(f).
• Linking your Google account, if you ask for it. Basis: your consent, Art. 6(1)(a). You can withdraw it by deleting your account.
• Complying with the law, should it ever be required. Basis: legal obligation, Art. 6(1)(c).

No automated decisions with legal effects are made about you, and no commercial profile is built.

6. What other players see

A player's public profile shows their nickname, their player id, since when they have played, how many days they have played, their best run in each mode and their best rank. The same appears on daily leaderboards, on season leaderboards and to your opponent in a duel.

Choose your nickname carefully. It is the only thing of yours other players see, and it is always visible. Your email, your Google photo and your device identifier arenever shown to other players. If your nickname contains your real name, that was your decision: you can change it at any time in settings.

7. Who we share it with

Data is not sold, not rented and not shared for commercial purposes. The parties involved:

• Google (Identity Services) — only if you choose to link your account. Google identifies you and hands the App a signed token. Google processes that data under its own privacy policy.
• Google Play — the App's distributor. Its relationship with you over the download is governed by Google's terms.
• The hosting provider of the server and the database, acting as a data processor and handling data only on our instructions.

We may also have to disclose data if a competent authority requires it, or to defend legitimate rights against abuse.

8. Advertising

The App shows no advertising today and integrates no ad network. The Android advertising ID is neither collected nor shared.

If advertising were added in the future, collecting the advertising ID and sharing it with the relevant network would become necessary. In that case this policy, its Spanish version and the Google Play Data Safety form would all be updated beforehand, the last-updated date would be raised, and whatever consent applicable law requires would be requested.

9. How long we keep it

• Account, nickname and progress: for as long as the account exists.
• Runs and replays: for as long as the account exists; deleted with it.
• Season standings: frozen when the season closes, and also deleted when you delete your account.
• Access credential: expires on its own after 30 days.
• Server technical logs: transient, and rotate by themselves.

10. Deleting your account and data

You can delete your account yourself, from inside the game, and it is immediate.

1. Open the App.
2. Go to Settings.
3. Tap delete account and confirm.

The moment you confirm, the following is erased from the server, unrecoverably:

• your account: device identifier, nickname and — if you had linked them — your email, your Google identifier and your photo URL;
• all your runs and replays, across all four modes;
• your saved progress: salt, cosmetics, aids and logbook;
• your duel rating and the history of duels you played;
• your season standings, including seasons already closed;
• your place in the matchmaking queue, if you were in it.

Deletion is total and irreversible. There is no bin and no grace period: it cannot be undone and progress cannot be recovered afterwards. If you only want to stop appearing under your name, change your nickname instead of deleting your account.

If you cannot use the button — you lost the phone, the App will not start — write to aduardoyanes@gmail.com from the Google address you linked, stating your nickname. The request will be handled within a maximum of 30 days.

To also remove what is stored on the phone itself, uninstall the App. Note that system backups may keep residues for a while, outside our control.

11. Security

All traffic between the App and the server is encrypted with HTTPS. Access uses a signed credential that expires after 30 days. The database is not reachable from the Internet and the service runs with reduced privileges.

No passwords are stored, because the App has none: you either enter with your device's anonymous session or with Google. Even so, no system is invulnerable: if you find a security flaw, write to aduardoyanes@gmail.com before disclosing it publicly and you will be thanked for it.

12. Children's privacy

The App is not directed at children under 13 (or the minimum age set by the law of your country, which in the European Economic Area may be as high as 16), and no data is knowingly collected from children.

If you are a parent or guardian and believe a child in your care has created an account, write to aduardoyanes@gmail.com and it will be deleted.

13. International transfers

The App's servers are hosted in the European Union. If you link your Google account, Google may process your data outside the European Economic Area, relying on the transfer mechanisms provided for by the GDPR, such as the standard contractual clauses approved by the European Commission.

14. Your rights

If the GDPR applies to you, you have the right to access your data,rectify it, erase it, restrict orobject to its processing, to data portability and towithdraw your consent at any time.

You can exercise most of them yourself: the nickname is changed in settings, and the account is deleted with the button described underDeleting your account and data. For anything else, write toaduardoyanes@gmail.com. You will get an answer within one month.

You may also lodge a complaint with the supervisory authority in your country. In Spain that is the Agencia Española de Protección de Datos.

California residents. We do not sell or share personal information as defined by the CCPA/CPRA, and we have not done so in the past twelve months. You have the right to know what is collected, to request its deletion, and not to be treated differently for exercising those rights. The same contact routes apply.

15. Changes to this policy

If this policy changes, the new version will be published here with its last-updated date. If a change materially affects what is collected or what it is used for, notice will be given inside the App before it takes effect.

16. Contact us

• Email: aduardoyanes@gmail.com
• Controller: Adrian Duardo
• Application: ABISMO (win.starfleet.abismo)