Privacy Policy
Last updated: [DATE]
This policy explains what data GGGL (the website gggl.online and the games on it) collects, why, how long it is kept, and what your rights are under the EU General Data Protection Regulation (GDPR), the UK GDPR and other applicable data protection laws.
1. Who is responsible
Data controller: [YOUR NAME OR COMPANY], [ADDRESS].
Privacy contact: [EMAIL].
2. What we collect
| Data | Why | How long |
|---|---|---|
| Player name, avatar, account creation date | Your account and the leaderboards of every game | Until you delete your account |
| Password (stored only as a bcrypt hash, never as text) | Signing in | Until you delete your account |
| Game results (for example score, lines, level, duration, round, stars, moves, rating), with date | Records, rankings, progress, profile statistics | Until you delete your account |
| Session token (stored hashed) | Keeping you signed in | Deleted when you sign out or after 90 days of inactivity |
| IP address, only on failed sign-ins and account creation | Protection against password attacks and mass account creation | 24 hours |
We do not collect your email, real name, phone number, location, contacts or photos. You can also play without an account; your settings and records then stay on your device only and are never sent to us.
3. Legal basis
- Contract (GDPR Art. 6(1)(b)): to provide the account, leaderboards and progress you ask for.
- Legitimate interest (Art. 6(1)(f)): to keep the service secure and the leaderboards fair.
- Consent (Art. 6(1)(a)): for personalized ads. You can withdraw consent at any time.
4. What other players can see
Your player name, avatar and results are shown publicly on the leaderboards and round records. Don't use your real name as your player name if you don't want to be identifiable.
5. Advertising
GGGL shows ads from Google AdSense. Google may use cookies or similar technologies to show and measure ads and, with your consent, to personalize them.
In the European Economic Area, the UK and Switzerland, Google's consent form is shown before any personalized ads. You can change your choice at any time in Settings → Ad privacy. Learn more: how Google uses information from sites or apps that use its services.
Rewarded ads ("Watch an ad to continue") are only shown when you choose them.
6. Where data is stored
Our server and database are hosted by Hostinger in [DATA CENTER LOCATION, e.g. Lithuania / EU], acting as our processor. Google may process ad-related data outside the EU using the safeguards required by the GDPR (Standard Contractual Clauses / EU-US Data Privacy Framework).
7. Security
All connections are encrypted (HTTPS). Passwords are stored only as bcrypt hashes. Session tokens are stored hashed (SHA-256). Sign-in is rate-limited after repeated failed attempts.
8. Your rights
- Access and portability: Profile → Download my data (JSON file).
- Erasure: Profile → Delete account, or on the web via the account deletion page. Deletion is immediate and complete.
- Rectification: change your avatar and password yourself in your Profile. For your player name, contact us.
- Restriction, objection and withdrawing consent: in Settings or by email.
- Complaint: you have the right to lodge a complaint with a data protection authority, for example the one in the country where you live.
For any other request, email [EMAIL]. We reply within 30 days.
9. Children
Accounts are only for people aged 16 or older. If you learn that a child under 16 has created an account, contact us and we will delete it immediately. Anyone can play without an account, in which case no data is sent to our server.
10. Changes
If we change this policy, we update the date above. For significant changes we will notify you in the game.