Escaque privacy policy

1. Who is responsible

The person responsible for your data in Escaque (the controller) is Yassine Ikken Ikkene. If you have any questions about this policy or your data, write to yt.code.and.chill@gmail.com.

2. Data that stays on your device

The app saves this data on your device (in the web version, in your browser) so the game works, even offline. It doesn't send it to us:

• your settings: language, theme, sound, vibration, “Reduce motion”, pieces and board;
• your Campaign progress and your statistics;
• the names you type in Pass and play;
• the month and year you were born and, if you are a minor with an account, the name you typed (section 4);
• if you have an account: your public name and your account ID, to show them offline, and ranked games in progress or waiting to be sent;
• on Android: whether you have used the Store and whether you have the “Remove ads” purchase (so no ads are shown offline), and how many games you've played since the last ad.

In addition, the services in section 7 store what they need on your device: your account session (Supabase) and, on Android, your choice about ads (Google) and, if you have used the Store, your purchases ID and status (RevenueCat).

All of this is deleted if you clear the app's data or uninstall it. If your device's backup is turned on, the system may include it in your backup, as it does with other apps.

3. Your account and the leaderboards

The account is optional. Without an account you can play all the free play modes, and our database keeps nothing about you. You need one for the ranked modes (Daily challenge, Time attack and Duel) and to buy “Remove ads”. It's a guest account: we don't ask for an email address, phone number or password. To create it, you need a connection and a public name (if you are a minor, an alias: section 4); without it, the account isn't created.

What we keep on our server

• an account ID created at random, the date it was created and the date you last signed in;
• your session data: the IP address and technical details of the app or browser you connect with;
• your public name or alias, when you last changed it and the date of your last activity;
• your records: best daily challenge, streaks, best time attack and Duel wins;
• your ranked games: the mode, the day, the start and submission times, the score, the game log (your bets, your moves and their timing) and, if it couldn't be validated, the reason;
• your points on the daily, weekly and monthly leaderboards.

What we use it for

• To create and maintain your account, give you the ranked modes and work out your points, your records and the leaderboards. Legal basis: it's necessary to provide the service you ask for when you create the account.
• To check each ranked game (the server recalculates it from its log) and handle your complaints. Legal basis: our legitimate interest in keeping the leaderboards fair.
• To protect the service from abuse, for example by limiting how many accounts can be created from the same IP address. Legal basis: our legitimate interest in keeping the service secure.

The server checks every ranked game automatically: if it can't validate a game, the game doesn't count on the leaderboards. Removing an account from the leaderboards for cheating is always decided by a person.

Who sees it

Your public name (or alias) and your points, with their tiebreak (for example, your time in the Daily challenge), appear on the leaderboards, which other players with an account can see. Other players can't see your records or your game logs.

4. Minors

Escaque is for all ages, including children.

• Age. The first time you open the app, it asks for the month and year you were born. The answer is saved only on your device and the app never sends it. With it, the app works out your age each time it opens. Your date of birth never changes, so we only ask once and it can't be changed later; your age updates by itself every year. You'll only be asked again if you clear the app's data.
• Name and alias. If you are under 18 and create an account, the name you type stays on your device: it's the one you see in the menu and in your own rows on the leaderboards. Other players see you under an alias that the app puts together at random on your device, using child-friendly words; if it's already taken, the server adds a number. Only the alias reaches our server, never your name or your date of birth. While you are a minor, the alias doesn't change: “Change name” only changes the name on your device.
• Ads (Android only). If you are under 16, Google doesn't show you personalized ads (ads chosen based on your interests or what you've done before), doesn't receive your device's advertising ID and doesn't ask for your consent to ads. If you are 16 or 17, ads aren't personalized either. There's more about ads in section 5.
• Purchases (Android only). If your Google account needs your parents' approval (for example, with Family Link), the purchase waits until they approve it. If you are a minor, ask for permission before buying.

If you are a parent or guardian, you can see the name and records of your child's account in the app (in Settings, Account, and in Records) and delete it (section 12). If you have any questions, write to yt.code.and.chill@gmail.com.

5. Ads and consent

Only the Android version has ads. On the web, on computers and, for now, on iPhone and iPad there are no ads.

Ads are served by Google AdMob. Google decides on its own how it uses this data (it is an independent controller) and handles it under its privacy policy. To show ads, measure them and prevent fraud, Google's SDK collects:

• your IP address, which it uses to estimate roughly where you are;
• how you use the app and the ads: app launches, taps and videos watched;
• diagnostic data, such as the app's launch time;
• device identifiers: the advertising ID (except for users under 16, section 4), the app set ID and, if there are any, those of the accounts signed in on the device.

All ads are limited to content suitable for all audiences. Rewarded ads (for a hint or to skip a level) only appear if you choose to watch them.

Your consent

If you are 16 or older and in the European Economic Area, the United Kingdom or Switzerland, when you open the app Google shows you a message so you can choose whether you agree to information being stored on or read from your device and to your data being used for personalized ads. If you don't agree, ads won't be personalized. Google saves your choice on your device.

If the app shows “Privacy” in Settings, you can change your choice or withdraw your consent there at any time.

Elsewhere, if you are 18 or older, Google may show you personalized ads as the law of your country allows. On Android you can reset or delete your advertising ID in the device settings.

Legal basis: your consent, when Google's message asks for it; otherwise, our legitimate interest in funding the game with ads.

How Google uses your data: privacy in Google's advertising products and Google's privacy policy.

If you buy “Remove ads”, the app stops showing you ads (section 6).

6. Purchases

Only on Android can you buy “Remove ads”, a one-time payment. You need an account to buy, but not to restore a purchase.

Payment is handled by Google Play: we never receive your payment details. Google Play handles them under its privacy policy.

To check your purchases, restore them and revoke them if they are refunded, we use RevenueCat. The app only connects to RevenueCat if you use the Store on Android (opening it, buying or restoring) and, from then on, every time it opens, to find out whether you have “Remove ads”. If you never use the Store, RevenueCat receives nothing about you. When it connects, it receives:

• a random RevenueCat ID or, if you have an account, your account ID;
• your device type, the system and app versions, and when you last opened the app;
• your approximate country, which it works out from your IP address (according to RevenueCat, it doesn't keep the IP address);
• if you buy or restore: the Google Play purchase token, the product, its price and the date.

We don't send it the advertising ID or other device identifiers: we have turned that collection off.

In addition, Google Play notifies RevenueCat of each purchase, cancellation or refund through Google Cloud, with the purchase token and the product, without your name or email address.

Legal basis: it's necessary to give you what you buy and let you restore it.

The purchase stays with your Google Play account: even if you delete your Escaque account, you can get it back with “Restore purchases”.

7. Who we share data with

Only with these services, and only what they need:

• Supabase (Supabase Pte. Ltd.): hosts our server, with the accounts, the leaderboards and their technical logs. It processes the data on our behalf and following our instructions. Its database is in Ireland, in the European Union.
• RevenueCat (RevenueCat, Inc.): manages purchases on our behalf (section 6).
• Google: Google AdMob serves the ads as an independent controller (section 5); Google Play distributes the app and takes payments under its own policy, and Google Cloud carries Google Play's purchase notifications to RevenueCat on our behalf (section 6).
• Cloudflare (Cloudflare, Inc.): hosts this page and, once it's published, the web version of the game. On our behalf, it processes your IP address and the technical details of your visit to serve and protect the page.

In addition, other players see your public name and points on the leaderboards (section 3). We'll only give data to anyone else if the law requires us to.

8. Transfers outside Europe

Some of these services may process data outside the European Economic Area. To do so, they rely on these safeguards:

• Supabase: the database is in Ireland, but Supabase may process data in other countries, such as the United States or Singapore, under standard contractual clauses approved by the European Commission.
• RevenueCat: stores data in the United States, under standard contractual clauses approved by the European Commission.
• Google and Cloudflare: may process data in the United States. Both state that they are certified under the EU-U.S. Data Privacy Framework and also use standard contractual clauses.

If you'd like more information about these safeguards or a copy of them, write to us.

9. How long we keep data

• On your device: until you clear the app's data or uninstall it.
• Your account, with your name or alias, your records and your session data: for as long as you have it. If 365 days go by without you opening the game online, it's deleted automatically, together with everything it has on our server. An account that was left without a name is deleted after 7 days.
• Your ranked games, with their logs: deleted in the daily clean-up after their first 3 days.
• Your points on the leaderboards: daily ones, 15 days; weekly ones, 9 weeks; monthly ones, 13 months.
• The server's technical logs, with the IP address and technical details of the connection: up to 7 days.
• The server's backups: up to 7 days.
• RevenueCat: for as long as you have the account, and it's deleted when you delete the account in the app. Kept with no fixed period: the data of guest accounts that the server deletes for inactivity, if they used the Store, and that of anyone who used the Store without an account, which only carries a random ID.
• Google, for ads and Google Play: for the periods set by its own policies. The purchase notifications that go through Google Cloud are kept only while they are delivered to RevenueCat.
• Cloudflare: for as long as it needs to serve and protect this page.

10. Security

• The app connects to our server over an encrypted connection (HTTPS), and Supabase encrypts the data it stores.
• Nobody can see or change your data through the app, except what the leaderboards show: the server only answers through functions that check who you are, and it recalculates every result instead of trusting the one the app sends.
• The services' secret keys are only on the server, never inside the app.
• We keep only what's needed and delete it within the periods in section 9.

11. Your rights

You can ask us at any time to:

• tell you what data we have about you and give you a copy, including in a format you can take to another service;
• correct it (if you are an adult, you can also change your public name in the app: in Settings, go to Account and tap “Change name”);
• delete it (section 12);
• restrict how we use it, or object to us using it when we rely on our legitimate interest;
• withdraw your consent to ads (section 5); anything done before you withdraw it remains valid.

Write to yt.code.and.chill@gmail.com. It's free. We'll reply within one month at the latest; if the request is complex, we may need up to two more months, and we'll tell you within the first month. We may ask you for some details to confirm who you are: we never act on an account without confirming that it's yours. A guest account has no email address or password, so if we can't confirm it, we'll explain how to do it in the app, where you can see your name and records (in Settings, Account, and in Records), change your name or delete the account (section 12).

If you think we haven't handled your data properly, you can complain to the Spanish Data Protection Agency (AEPD, aepd.es), which is the supervisory authority that applies to us, because the controller lives in Spain. If you live in another European Union country, you can also complain to the data protection authority in your country.

12. Delete your account

In the app (you need a connection)

1. Open Settings and go to Account.
2. Tap “Delete account” and confirm.

If you no longer have the app

Your guest account is deleted automatically, together with everything it has on our server, when 365 days go by without you opening the game online.

You can also ask us to delete it: write to yt.code.and.chill@gmail.com with the subject “Delete my Escaque account” and the account's public name (for a minor's account, the alias with its number). We never delete anything without confirming that the account belongs to whoever asks, because anyone could ask us to delete someone else's account. If we can confirm it, we'll delete it and let you know. If we can't, as usually happens with guest accounts, which have no email address or password, we'll reply explaining how to delete it in the app, or reminding you that it's deleted automatically after 365 days.

What is deleted

When it's deleted, in the app or at your request: your account, your name or alias, your records, your games, your points on the leaderboards, your session data and, if you used the Store, your data in RevenueCat. On our server they are deleted immediately; RevenueCat deletes them shortly after. Anything left in the technical logs and backups disappears by itself within 7 days. When the account is deleted automatically, the same is deleted, except the RevenueCat data (section 9).

What stays

Your date of birth, settings, Campaign, statistics and Pass and play names stay on your device; they're deleted if you clear the app's data or uninstall it. The “Remove ads” purchase stays with your Google Play account: after you delete the account, ads come back until you tap “Restore purchases” in the Store. Ad data is managed by Google on its own (section 5).

13. Changes to this policy

If we change this policy, we'll publish the new version here with its update date. If we add features that use your data in a different way, we'll update it before they're available and, if the change is important, we'll announce it visibly.