PekeGames apps privacy policy

1. Who is the data controller

The data controller is PekeGames [PENDING: legal name, tax ID and registered address].

For any privacy matter or to exercise your rights: privacidad@pekegames.app. General contact: info@pekegames.app.

[PENDING: state whether there is a data protection officer (DPO) and their contact details.]

2. What data we process

Depending on the game and the features you use, we process:

• Device identifier: so you can play without an account (as a guest) without losing your progress, the app reads a device identifier (on Android, the system identifier tied to the app, ANDROID_ID; on iOS, the identifier for vendor, IDFV; if unavailable, a random one) and stores it on the device. It is sent to our server to create and restore your guest session and to link your notification token to your device. On Android it may persist even if you reinstall the app.
• Guest session: internal identifier, temporary nickname, language and creation and last-activity dates.
• Account (optional): email, nickname, password (stored as a hash), language, avatar (from our catalog or, if you sign in with Google, your profile photo), friend code and, if you choose to provide it, your date of birth (used to know whether you are a minor). We keep previous nicknames to prevent impersonation.
• Sign in with Google or Apple (optional): this happens in the browser, on pekegames.app. We receive from the provider your account identifier with that service, your email and, if provided, your name and profile photo. If you don't choose a nickname, the initial one is created from your name, and your photo may be used as your avatar; both are visible in rankings and you can change them in the account center. With Apple you can hide your real email. We never receive your Google or Apple password.
• Gameplay and progress: scores, levels, achievements, streaks, match statistics (including multiplayer), virtual currencies, cosmetic items, missions and, in games that offer it, cloud saves.
• Social and multiplayer features: friendships and requests, gifts between friends, challenges, blocks and reports (a reason from a closed list, the match concerned and, if you add one, a comment), and what online matches need (rooms and moves). There is no free-text chat: only reactions from a closed list.
• Purchases: product, store (Google Play or App Store), proof of purchase (purchase token or signed transaction), transaction identifier, amount and currency when the store provides them, status and dates, and active subscriptions or entitlements (for example, "no ads"). We do not receive your card or payment details: the store handles them.
• Ads: in games with ads, the Google AdMob SDK collects device data (such as the advertising ID, IP address, device information and ad interactions) to show ads, measure them and prevent fraud. We store which rewarded ads you have watched, to give you the reward and apply daily limits. See sections 6 and 7.
• Push notifications (optional): if you enable them, the device's notification token (Firebase Cloud Messaging on Android; Apple Push Notification service on iOS), platform, language and device identifier.
• Our own usage statistics: game events sent to our own system (match start and end, screens and purchases) with the platform, app version, language, score and duration. For minors and guests we only record match start and end, with no other data. We do not use Google Analytics, Firebase Analytics or other third-party analytics tools.
• Technical and security data: IP address and user agent (system, browser or device model, depending on what the app sends) for security, abuse prevention and the account access log, and the IP and date when you accept the legal documents.
• Camera: only in games that let you scan the QR code of a match or a friend, and only when you ask to. The image is processed on the device: only the text of the code is used and we do not store images.

We do not collect your precise location, contacts, photos or microphone, and we do not sell personal data.

3. What we use the data for and the legal basis

[PENDING: legal bases to be validated by legal counsel.]

• Providing the service: guest session or account, saving your progress, rankings, multiplayer, social features and the account center. Basis: performance of the contract (terms of use).
• Purchases: validating purchases with the store, delivering what you bought and restoring it. Basis: performance of the contract and compliance with legal (accounting and tax) obligations.
• Advertising: funding free games. Personalized ads: only with your consent (Google's consent form in the European Economic Area and the UK and, on iOS, Apple's tracking permission). Non-personalized ads: legitimate interest.
• Notifications: telling you about matches, challenges, friends and game news. Basis: your consent (system permission), which you can withdraw at any time.
• Security: preventing cheating, fraud, abuse and impersonation, and handling reports. Basis: legitimate interest.
• Our own statistics: understanding how the games are used and improving them. Basis: legitimate interest, with data minimization and no behavioral statistics for minors.
• Legal obligations: responding to requests from authorities and keeping what the law requires. Basis: legal obligation.

4. Who we share data with

We do not sell personal data. We only share it with:

• Google AdMob and its consent platform: in games with ads. Google processes the data collected by its ads SDK as an independent controller [PENDING: validate]. More information: https://policies.google.com/technologies/partner-sites
• Google Firebase Cloud Messaging: notification delivery on Android (it also uses a Firebase installation ID).
• Apple Push Notification service: notification delivery on iOS.
• Google Play and Apple App Store: they process payments; we check the status of your purchases and subscriptions with them to validate them.
• Google and Apple (sign-in): only if you choose to sign in with them.
• Hosting provider: servers that run the service and store backups [PENDING: provider name and country or region of the data center].
• Email provider: sending verification, password recovery and account emails [PENDING: provider name].
• Other players: they see your nickname, avatar and scores in rankings (you can hide yourself in your privacy settings) and, if you are friends, your activity according to your settings.
• Authorities: when required by law.

5. International transfers

Some providers, such as Google or Apple, may process data outside the European Economic Area, for example in the US. In those cases appropriate safeguards apply, such as the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. [PENDING: legal review of transfers and of our hosting location.]

6. Minors

Our games are suitable for all ages and we apply privacy by default:

• If we don't know your age (whenever you play as a guest), we treat you as a minor. You are also a minor if your date of birth shows you are under 18.
• You must be at least 13 to create an account; younger players play as guests. [PENDING: review the threshold per country according to the age of digital consent (14 in Spain; between 13 and 16 in other EU countries) and parental consent where applicable.]
• For minors, ads are requested in child-directed mode: no personalized or behavioral advertising, content suitable for all ages, and no advertising consent or Apple tracking prompt. Rewarded ads are only shown if the player chooses them, in that same mode.
• Guests cannot make real-money purchases, have friends or send reports. Accounts aged 13 to 17 can buy through the device's store, where Google Play and Apple parental controls apply. [PENDING: decide whether to block real-money purchases for all minors.]
• For minors we do not send behavioral statistics: only match start and end, with no other data.
• There is no free chat: only reactions from a closed list. Nicknames are pseudonyms and only the nickname appears in public rankings.
• Parents or guardians can request access to, or deletion of, their child's data by writing to privacidad@pekegames.app.

7. Advertising ID and personalized ads

• Android: you can reset or delete your advertising ID in Settings > Google > Ads (or Settings > Privacy > Ads, depending on the device).
• iOS: we only use the advertising identifier (IDFA) if you allow it in Apple's tracking prompt. You can change this in Settings > Privacy & Security > Tracking.
• European Economic Area and UK: if you are an adult, the game shows you Google's consent form the first time. [PENDING: add an option in the games to reopen that form and change your choice.]
• No ads: if you buy the "no ads" option or a subscription that includes it, that game stops showing ads.

8. Notifications

Notifications are only enabled if you grant permission. You can turn them off at any time in the system notification settings, in the game settings or in the account center (Notifications). If you turn them off from the game, we delete your device's token from our server.

9. How long we keep data

• Account and progress: while the account is active. When you delete it, section 10 applies.
• Guest sessions: [PENDING: define the retention period for inactive guest sessions; there is currently no automatic deletion].
• Sign-in sessions: refresh tokens are deleted 7 days after they expire or are revoked.
• Unfinished scored matches: 24 hours.
• Purchases: [PENDING: period required by accounting and tax rules].
• Usage statistics and security and access logs: [PENDING: define the period; there is currently no automatic deletion].
• Backups: deleted after 14 days.

10. How to delete your account and data

• From the game: in the game settings, open your account (account center) and choose "Delete account".
• From the web: sign in at https://pekegames.app/perfil/privacidad and choose "Delete account".
• By email: write to privacidad@pekegames.app from your account's email address.

When you delete your account, we erase or replace with generic values your email, nickname, avatar and password, unlink your Google or Apple sign-ins and close all your sessions. Your scores and your match and purchase history are kept without your identifying data, to keep rankings consistent and meet legal obligations. [PENDING: legal review of the scope of deletion; date of birth, friend code, nickname history, notification tokens and access logs are not currently deleted.]

If you play as a guest, you can delete the data on your device by uninstalling the app or clearing its data. To also delete the data stored on our server, write to privacidad@pekegames.app. [PENDING: procedure to identify a guest session.]

11. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent at any time, by writing to privacidad@pekegames.app. You can also change your nickname, avatar and privacy settings in the account center. [PENDING: offer a data download in the account center (the server already has an export, incomplete).]

If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (https://www.aepd.es) or with the supervisory authority of your country.

12. Security

Communications between the app and our servers are encrypted (HTTPS/TLS). Passwords are stored as hashes, access to data is restricted and purchases are validated on the server with the store.

13. Changes to this policy

If we change it in a significant way, we will update the date above and, where appropriate, let you know in the apps or by email.