This policy explains what the mobile game Wobblegg ("the game", "we") processes about you, why, for how long, and how you can delete it. It also covers this website.
Who is responsible
The controller of your data is:
Marcin Lucko, an individual developer based in Poland.
Contact: support [at] wobblegg [dot] com
What we process and why
- Guest account. On first launch the game creates an account identified by a random player ID. No name, email or phone number is needed. The game keeps a random session token in your device's secure storage (the iOS Keychain); our server stores only a one-way hash of each token.
- Gameplay. For each run we store when it started, the hero, the random seed and the result our server verified (score, catches, combo, lives, duration). The taps you make during a run are sent to the server to check the result; we keep the verified result and a hash of the request, not the taps themselves. We also store your coins and coin history, the heroes you own, missions, daily rewards and gifts.
- Purchases. Purchases are made and paid through Apple's App Store (and Google Play when the Android version is released); we never see your payment details. The game sends the store's signed receipt to our server, which checks the store's signature and records the product, the store's transaction IDs and the price and currency the store reported, so the purchase can be granted and restored.
- Leaderboard and friends. The nickname you pick, a short tag derived from your player ID, your friend code, your friends, invitations and blocks, and your best score per day, week and season. Other players see your nickname, tag, hero and score on the leaderboard; your friends also see your weekly best.
- Game Center (optional). If you sign in with Game Center, we store your Game Center team player ID (teamPlayerID) and the date you connected, so your progress can come back on a new device. If you have no nickname yet, your Game Center name becomes your leaderboard name. We keep a hash of each Apple sign-in proof for 24 hours to stop it being reused.
- Advertising (Google AdMob). The game shows ads from Google AdMob. Before ads are requested, the game asks for your consent through Google's consent message (where required, e.g. in the EEA and UK) and through Apple's App Tracking Transparency prompt. If you allow it, Google may use your device's advertising identifier and other device data to personalise ads; otherwise Google shows non-personalised ads, which still use some device data, for example to limit how often an ad is shown and to prevent fraud. For rewarded ads we give Google a separate random ID (not your player ID) so that Google can confirm to our server that an ad was watched; we store Google's transaction ID and the ad unit. Google is an independent controller of the data it collects: see how Google uses information from apps that use its services.
- Server and network logs. Our game server logs each request's route, status and timing, without your IP address, player ID or token. Our web server's access log records the IP address, time and requested path, and our network provider Cloudflare processes IP addresses to deliver and protect the service. To limit abuse, the server counts requests per IP address in memory for at most one hour.
- On your device only. Volume, vibration, language and tutorial progress, and all progress of the offline mode, stay on your device and are never sent to us.
We process account, gameplay, purchase, leaderboard, friends and Game Center data to provide the game you asked for (Art. 6(1)(b) GDPR), logs to keep the service secure (legitimate interest, Art. 6(1)(f)), and personalised advertising only with your consent (Art. 6(1)(a)). We do not sell your data and we do not use it for automated decisions with legal effects.
This website
wobblegg.com uses no cookies, no analytics and no advertising, and has no forms or accounts. When you open a page, Cloudflare, our network provider, processes your IP address to deliver and protect the site, and our web server's access log records the IP address, time and requested path. We keep these logs for up to 14 days to keep the site secure (legitimate interest, Art. 6(1)(f) GDPR). If you email us, we use your message and email address only to answer you.
Who else receives data
- Our server hosting provider and Cloudflare, who run the infrastructure for us.
- Apple, for App Store purchases and Game Center sign-in.
- Google, for AdMob advertising as described above (and Google Play purchases once available).
Apple, Google and Cloudflare may process data outside the European Economic Area under the safeguards they provide, such as the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.
How long we keep it
- Your account and game data: until you delete them (see below).
- Session details: until 30 days after the session expires; a session lasts 30 days.
- Web server access logs: up to 14 days.
- Game Center sign-in proof hashes: 24 hours.
- After a deletion we keep only one-way hashes of old session tokens and the random setup IDs your device used, with no link to any account or data, so that an old token can never open a new account; and a daily count of deleted accounts. Deleted data can remain in our encrypted database backups for up to 14 days, until the backup that contains it is removed.
Deleting your data
In the game, open Settings → DELETE MY DATA and type DELETE to confirm. This immediately and permanently deletes your account on our server: coins, heroes, runs, missions, leaderboard entries, friends (also from your friends' lists), your Game Center link and all sessions. Purchases stay with your Apple ID and can be restored on the new save with RESTORE PURCHASES in the store. The game then starts again with a new, empty guest account. In the offline mode the same button resets the progress stored on your device. You can also ask us to delete your data by email.
Your rights
Under the GDPR you have the right to access your data, correct it, delete it, restrict or object to its processing and receive it in a portable format. Where we rely on consent you can withdraw it at any time: change ad consent with Settings → AD PRIVACY in the game (when shown) and tracking in iOS Settings → Privacy & Security → Tracking. To exercise a right, email support [at] wobblegg [dot] com; include your friend code (shown on the Friends screen) so we can find your account. You can also complain to your local data protection authority; in Poland this is the President of the Personal Data Protection Office (UODO).
Children
The game is not directed to children under 13 and we do not knowingly collect their data. If you believe a child under 13 has used the game, contact us and we will delete the account.
Changes
We will update this page when what the game processes changes; the date at the top shows the latest version. See also our Terms of Service and Support page.