DRAFT — pending legal review. Bracketed fields must be completed and the text reviewed by counsel before publication.
Privacy Policy
Version:
This policy explains how Balon Game processes your personal data. Players in Türkiye should also read the KVKK notice (Turkish).
1. Controller
[COMPANY NAME], [REGISTERED ADDRESS]. Contact: [privacy@ALAN-ADI]. EU representative (GDPR Art. 27): [EU REPRESENTATIVE]. UK representative: [UK REPRESENTATIVE].
2. What we process
| Data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Username, password hash (scrypt) | Account and sign-in | Contract (Art. 6(1)(b)) | Until account deletion |
| Birth year, country | Age-appropriate protections (younger-player account) | Legal obligation (Art. 6(1)(c), Art. 8) / contract | Until account deletion |
| Accepted legal version and time | Proof of acceptance | Legal obligation | Until account deletion |
| Game records (score, level, duration, mode) | Leaderboards, rewards, cheat detection | Contract; legitimate interest (fair play) | Until account deletion |
| MOON transactions, inventory, season progress | Virtual items and rewards | Contract | Until account deletion |
| IP address | Security, brute-force, multi-account and bot detection | Legitimate interest (security) | Raw for 30 days, then replaced by an irreversible pseudonym; deleted after 180 days |
| Browser user-agent | Session security | Legitimate interest | 30 days |
| Session cookie / token | Keeping you signed in | Strictly necessary | Up to 30 days |
| Reports you file | Community safety | Legitimate interest | Until account deletion |
| Security and transaction logs | Fraud/cheat investigation, debugging | Legitimate interest | Server log files 30 days; anonymised on account deletion |
We currently do not collect email, phone number, real name, location, contacts, advertising IDs or payment data. We use no advertising or third-party analytics/tracking. Automated decisions are limited to checking whether a score is physically possible; you can contact us to contest a rejected score.
3. Children
For players under the age of digital consent in their country we process only the minimum needed to run the account; their names are never shown publicly, email/wallet/real-money features are off and there is no behavioural advertising. Parents can request deletion at [privacy@ALAN-ADI]. See Information for parents. In the US we do not knowingly collect personal information from children under 13 beyond what COPPA permits for internal operations.
4. Who we share data with
- Hosting provider: [Hetzner Online GmbH, Germany — servers in Germany/Finland] (processor under a data processing agreement).
- Backup storage: [backup provider and location] (encrypted backups).
- Competent authorities where required by law.
We do not sell or share your personal information for cross-context behavioural advertising.
5. Your rights
You have the right to access, rectify, erase, restrict, object and to data portability. In the Game:
- Download my data (Profile → Privacy & data): a machine-readable JSON copy of your data.
- Delete account: your account and related data are removed from live systems immediately and roll off encrypted backups within 14 days. Traces in security logs are anonymised.
For anything else, email [privacy@ALAN-ADI]. We reply within one month. You may lodge a complaint with your data protection authority.
6. Security
Connections use HTTPS; passwords are hashed with scrypt; session cookies are HttpOnly; server access is restricted; backups are encrypted. If a personal data breach occurs we notify the competent authority within 72 hours and you where required.
7. Cookies and device storage
See Cookies & storage.
8. Changes
We will notify you in the Game when we update this policy and ask for consent again for material changes.