Privacy policy
Version 0.1 (draft, not yet in force)
We collect as little data as we can. You can play without an account, and a guest's progress stays on their own device. This policy explains what we do collect, why, and the rights you have under the General Data Protection Regulation (GDPR) and Spanish data protection law.
1. Who is responsible
The controller of your data is TREPTES STUDIOS, S.L. (NIF B19427079). For anything about your data, write to contact@treptes.com.
2. What we collect and why
Playing as a guest
Your progress, settings, statistics and the game in progress are saved in your browser's storage or in the app on your device. They are not sent to us. If you clear your browser data or uninstall the app, they are deleted.
Visiting the site
Like every website, our hosting server receives technical data with each request: IP address, browser and device type, the page requested and the time. We use it only to deliver the site, keep it secure and fix errors. Legal basis: our legitimate interest in running a secure site (art. 6(1)(f) GDPR). These logs are deleted after a short period, usually within 30 days.
Your account (optional)
If you sign in with Google, we receive your name, email address and profile picture; if you sign in with a link sent by email, only your email address. We create a unique user ID and store with it your game progress, settings and purchases, so you can keep them across devices. Legal basis: the contract with you (art. 6(1)(b) GDPR). We keep this data while your account exists and delete it when you delete your account, except what we must keep by law (for example, records of purchases).
Purchases
On the site, payments are handled by our reseller Paddle, which acts as an independent controller for the payment data it collects (name, email, country, payment method, billing details); see Paddle's privacy notice. In the apps, payments are handled by Apple or Google. We never see your card details. We receive the information needed to unlock Premium and to answer billing questions: which plan you bought, when, the country, and an anonymous purchase ID linked to your user ID. Legal basis: the contract with you, and our legal obligations for tax and accounting records, which we keep for the periods the law requires.
Messages to us
When you email us, we use your address and message to reply and to solve your request, and we keep the conversation for as long as needed for that. Legal basis: your request and our legitimate interest in answering it.
Statistics (only with your consent)
If you accept analytics in the cookie banner, we use Google Analytics for Firebase (Google) to measure how the site and the games are used: pages visited, games played, where players get stuck. It works with a random identifier, not your name, and is not used for ads. Legal basis: your consent (art. 6(1)(a) GDPR), which you can withdraw at any time with Cookie settings at the bottom of every page. In the apps, statistics stay off until we ask for your consent there. Details are in our cookie policy.
Ads (when available)
Free and unregistered accounts may see ads between games. Ads are served by our advertising partners (for example Google AdMob or Google AdSense), who may use device identifiers or cookies. In the European Economic Area, the United Kingdom and Switzerland, personalised ads are only shown if you agree; otherwise you see non-personalised ads. You can change your choice at any time in the game settings or the cookie banner. Premium players see no ads.
3. Who we share data with
We don't sell your personal data. We share it only with providers that help us run the games:
- Hostinger (website hosting, European Union);
- Google Firebase (sign-in, cloud saves and, when available, game statistics);
- Paddle (sales and payments on the site), Apple and Google Play (sales in the apps);
- RevenueCat (keeps track of which Premium plans your account has, across devices);
- advertising partners such as Google, only for free and unregistered accounts, as described above;
- public authorities, when the law requires it.
Some of these providers process data outside the European Economic Area, for example in the United States. In those cases the transfer is protected by an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework) or by the Commission's standard contractual clauses.
4. Your rights
You can ask us at any time to:
- access the data we hold about you, or receive a copy of it (portability);
- correct or delete it;
- restrict or object to its use;
- withdraw a consent you gave, without affecting what was done before.
Write to contact@treptes.com; we reply within one month. If you think we have not handled your data correctly, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, aepd.es) or to the authority of the country where you live.
5. Children
Anyone can play as a guest, and guests don't give us personal data. To create an account you must be at least 14 years old, or have the consent of a parent or legal guardian. If you believe a child under 14 created an account without consent, write to us and we will delete it.
6. Security
The site is served only over an encrypted connection (HTTPS). Account data is stored with providers that protect it with industry-standard measures, and only the people who need it to run the games can access it.
7. Changes to this policy
This policy is versioned: each update gets a new version number and date, shown at the top of this page. If we make important changes, we tell you in the games or by email before they apply.