Privacy Policy

1. Controller and scope

The data controller and current operator of Gamerlandia is Francisco Gregorio, an individual in Spain. Address: Avenida de las Mimosas 14E, 03509 Finestrat, Alicante, España. Tax ID: Z0494997L. Privacy contact: gamerlandia.contact@gmail.com.

This policy applies to the Gamerlandia app and gamerlandia.com. Where a provider processes information for its own purposes and under its own terms, its documentation also applies.

2. Service exclusively for adults aged 18 or over

Gamerlandia is intended exclusively for people aged 18 or over. It is not designed for minors. We may request or retain the minimum age-eligibility evidence needed to enforce this rule and may act on accounts that do not meet it.

3. Account and authentication

Gamerlandia uses Firebase Authentication. Registration or sign-in may use email and password or Google Sign-In. Depending on the method, we process the Firebase UID, email address, provider identifiers, display name or nickname where applicable, and technical creation or sign-in data.

Guest/anonymous accounts and Apple Sign-In are not available in the current version. Gamerlandia does not request your Google password and does not receive full payment card numbers. Credentials are handled by the relevant authentication provider.

4. Profile and settings

To configure and display the account, we may process nickname, avatar identifier, language or locale, Social ID, Studio or preset names, and other profile preferences. Limited nickname, avatar, Social ID and competitive information may be visible to other people through social features.

5. Gameplay and progression

To run trivia games, calculate results and synchronize progress, we process sessions, question identifiers, selected answers, correct and incorrect results, timings, scores, XP, level, and Studio, game and genre progression.

We also process streaks, Daily Challenge data, aggregated usage statistics and operational data needed to validate rewards and prevent the same operation from being applied more than once.

6. Virtual economy and inventory

Gamerlandia maintains balances of soft and premium currency, lives, jokers, boosters, avatars, themes and inventory. These records are linked to the account to deliver and validate resources, preserve state across devices, and detect errors, abuse or fraud.

7. Friends, leaderboards and challenges

Social features use internal Social IDs for search, friend requests, friendships, leaderboards, Elo, challenges, limited opponent information, exclusively virtual stakes, and match or challenge results. Public leaderboard rows do not expose the internal Firebase UID.

Gamerlandia does not request access to your phone address book or device contacts. Gamerlandia's internal social graph is stored to provide friend and challenge features. There is no chat.

8. Firebase Analytics

Firebase Analytics is active in Production and may receive app interactions, screens and features used, aggregated gameplay and economy events, pseudonymous identifiers, and technical device and app-version information.

We use it to understand product use, improve features and support product and performance decisions. The target retention for event- and user-level data governed by the Google Analytics setting is up to 14 months; the exact value depends on the remote setting and must be verified before launch.

9. Crashlytics and technical identifiers

Firebase Crashlytics is active in Production for stability and diagnostics. It may process crashes, stack traces, technical logs, app version, device model and technical state, and pseudonymous identifiers including UID where applicable. The app limits events to technical types, codes, feature, operation, build, platform and state, while dropping or redacting sensitive values and free text.

Firebase Installations creates technical installation identifiers used by Firebase services to operate, protect and diagnose the app. They are not the user's public Social ID.

10. Security, App Check and Play Integrity

Firebase App Check and Google Play Integrity may process integrity tokens and technical signals to authenticate legitimate app instances, prevent abuse, fraud and automation, and protect APIs and the game economy.

11. Advertising and consent

Production contains banner and rewarded advertising through Google User Messaging Platform (UMP), Google Mobile Ads, LevelPlay/ironSource, and Unity Ads as a mediated network or adapter. Depending on region, consent, identifier availability and SDK privacy modes, these providers may process Advertising ID, other device identifiers, app information, ad interactions, diagnostics, IP or network data, privacy choices and anti-fraud signals.

The live ad provider initializes only after an authenticated account, legal acceptance, 18+ eligibility, product gates and the UMP request-ads gate. UMP presents and manages privacy choices where applicable and lets users reopen them from Settings when required. Advertising may be personalized, limited or non-personalized depending on region, consent, SDK settings and choices. Rewarded ads are optional.

12. Location

Gamerlandia does not request access to GPS or precise device location. Advertising, hosting or infrastructure providers may process IP address and network data and use them to infer a general or approximate location.

13. In-app purchases

On Android, Google Play Billing processes payment. Gamerlandia receives evidence needed to validate and deliver a purchase, such as Product ID, purchase token and transaction or order identifiers, purchase status, validation, entitlement and, where applicable, refund, revocation or chargeback information.

Gamerlandia does not receive full payment card numbers. Google processes payment information under its own terms and policies.

14. Purchase records after account deletion

When an account is deleted, active ledgers are converted into separate minimized IAP transaction records. They are limited to ProductId, Platform, OrderId where applicable, PurchaseTime, an irreversible PurchaseTokenHash, transaction and validation states, acknowledgement or consumption states where applicable, refund, revocation or chargeback states, a test indicator, RetentionReason, RetentionCreatedAt, RelevantTransactionDate and RetainUntil.

These records are retained for 6 calendar years from the last relevant transactional event. This may be a purchase, acknowledgement or consumption where applicable, refund, revocation, chargeback or another legitimate transaction state change. RelevantTransactionDate uses the latest valid date, so a later event may move the start of the period forward and an older out-of-order event cannot shorten it.

Retention is limited to accounting and tax duties, transaction documentation, refunds, chargebacks, fraud prevention, security, compliance with legal obligations, and the establishment, exercise or defense of legal claims. It does not mean that the account is kept for six years: the record contains no Firebase UID, email, nickname, Social ID, ProviderUid, profile, progression, social graph, ordinary gameplay data, raw purchase token or full entitlement snapshot. The record must be deleted after the period ends.

15. Feedback, reports and moderation

Product feedback is deliberately designed not to be linked to the Firebase UID and is not a support or deletion channel. The app instructs users not to include names, emails, identifiers, payment information or other personal data; client and server reject obvious personal or secret patterns without storing or logging the rejected text. Raw feedback is retained for 180 days; non-identifying aggregates may be retained afterwards.

Question reports and other records needed for safety, quality or moderation may contain UID, content identifier, reason, context and timestamps so the report can be investigated and abuse prevented.

16. Future notifications

The current version does not implement push notifications or collect push tokens. If they are enabled in a supported version, this policy and in-app information will be updated to explain notification tokens, preferences, purposes, provider, retention and how to disable them.

17. Data processed by the website

The current website does not include login, analytics, advertising, tracking cookies or forms that store requests. Contact links open the visitor's email client.

Firebase App Hosting and its infrastructure may process technical request data such as IP address, User-Agent, date, requested URL and technical logs as needed to serve, protect and diagnose the website.

18. Purposes and legal bases

For users in the EU or Spain, data needed to create and maintain the account, run gameplay, progression, economy, social relationships, challenges and purchases is processed to perform the contract and provide the requested service.

Consent is used where legally required, particularly for certain advertising modes or similar technologies. Security, fraud prevention, diagnostics, service protection and proportionate improvement may rely on legitimate interests after the appropriate balancing. Fiscal, accounting and compliance records are retained under legal obligations where applicable.

19. Recipients and providers

Depending on the feature used, data may be received or processed by Google Firebase (Authentication, Firestore, Functions, Analytics, Crashlytics, Installations and App Check), Google Play (Sign-In, Billing and Integrity), Google UMP and Google Mobile Ads, LevelPlay/ironSource, Unity Ads, hosting and infrastructure providers, and advisers or authorities where there is a lawful requirement.

We do not list a company merely because of a transitive dependency: each disclosure depends on the feature and SDK actually active.

20. International transfers

Some providers may process information outside the country of residence. Where applicable, adequacy decisions, standard contractual clauses or other mechanisms and safeguards recognized by law are used. Specific locations depend on each provider's current infrastructure and configuration.

21. Retention

While the account is active and afterwards until deletion or anonymization is completed, subject to the limited exceptions described in this policy.

Production target: up to 14 months for Firebase Analytics event- and user-level data governed by the Google Analytics retention setting; the remote value must be verified before launch.

Raw feedback is retained for 180 days; aggregates that do not identify an individual may be retained afterwards.

After account deletion, the minimum IAP transaction record is retained for 6 calendar years from the last relevant transactional event. A purchase or a later valid state change may move the start of the period forward; an older out-of-order event cannot shorten it. This retention is limited to accounting or tax duties, transaction documentation, refunds, chargebacks, fraud prevention, security, compliance or legal claims.

For the period configured with each provider and only while needed for diagnostics, security, integrity, abuse prevention or compliance.

Aggregated or anonymized data may be retained when it can no longer reasonably identify an individual.

Minimum technical account-deletion job records currently carry a 30-day ExpiresAt. This is a job/tombstone period subject to remote TTL, not a promise that every request will finish within a fixed time.

Where no fixed period has been demonstrated, we apply a necessity test based on purpose, security, dispute resolution and legal duties; we do not publish an invented period.

22. Security

Gamerlandia uses HTTPS/TLS, Firebase Authentication, authorization controls, Firestore Security Rules, App Check, Play Integrity, server-side validation and minimization of retained records. Technical access is restricted according to the data's function.

No system is absolutely secure. We review controls and address reasonable risks, but do not promise infallible protection.

23. Account deletion

Deletion can be started in the app from Profile/Settings with confirmation and recent authentication, or externally from the public deletion page by email. Proportionate identity verification may be requested without asking for passwords or full card information.

The server-authoritative process is resumable and idempotent. It removes Auth after the mandatory Firestore sweep, profile, Social ID and social graph, leaderboard, progression, sessions, reports, ads mapping, economy and inventory, challenges and request records no longer needed. Only the minimum transaction, security or compliance exceptions explained in this policy remain.

Local cleanup removes authentication/session references, account caches, receipts and deletion state. Device-only preferences such as language or volume may remain because they are not account records. We will follow up if more information is needed or an error occurs.

24. Your rights

Where the law provides, you may request access, rectification, erasure, restriction, objection and portability, and withdraw consent without affecting earlier lawful processing. You may also complain to the competent supervisory authority; in Spain, the Spanish Data Protection Agency.

To exercise your rights, email gamerlandia.contact@gmail.com. We may request the minimum information needed to verify identity and locate the account.

25. Changes and contact

We may update this policy if the product, providers or law changes. We will communicate relevant changes through suitable means where necessary. Version 2.0, revision 2; effective date: 2026-09-08.

Privacy: gamerlandia.contact@gmail.com. Support: gamerlandia.contact@gmail.com.