Privacy policy
Smash-a-gon is a free online game at smashagon.io, run by an independent developer in the United Kingdom ("we", "us"). We are the controller of the personal data described here. This page explains, in plain words, what we keep about you, why, and what you can do about it.
Questions or requests: privacy@smashagon.io.
The short version
- You don't need to give us your name or email to play.
- We keep a game account with the player name you see in the game, your scores and wins, and, if you sign up with an emailed link, an age range.
- If you sign in with Google or Apple, we keep only the ID they give us to recognise you, not your email or name.
- If you sign in with an emailed link, we use your address to send the link and keep only a scrambled copy of it, not the address itself.
- The game shows ads from Google, at breaks between games and as videos you can choose to watch for a reward. Google and its partners may use cookies to show them, and players in the UK and EU are asked for consent first. There are no analytics.
- You can download or delete your account at any time from Settings → Account.
What we keep, and why
| What | Why | How long |
|---|---|---|
| Your account: a random account ID, your player name, when you last changed it, and when the account was made and last used | To give you an account that owns your name, scores and anything you unlock | Until you delete the account |
| An age range (13–15, 16–17 or 18+) from the year of birth you enter when you sign up with an emailed link. Guests and Google or Apple sign-ups aren't asked, and have no age range. | To check players are 13 or over, and to apply age-appropriate settings (with no age range, we use the settings for the youngest players). We don't keep your year of birth. | Until you delete the account |
| Sign-in records: a session for each device you play on, and a scrambled (hashed) copy of your recovery code if you made one | To keep you signed in and let you move your account to another device | Sessions end 90 days after their last use; codes until replaced or the account is deleted |
| If you sign in with Google or Apple: the user ID they give us for you | To recognise you when you sign in again. We don't ask them for your email address or name. | Until you delete the account |
| If you sign in with an emailed link: a scrambled copy (a keyed hash) of your email address | To recognise the address when you sign in again. We use the address itself only to send the link, and don't store it. | Until you delete the account. Unused links expire after 15 minutes. |
| Scores and wins on the public boards (player name, score and time) | The leaderboards are part of the game, and anyone can see them | Until they drop off the board or you delete the account |
| Your XP, coins and what you've unlocked, including rewards from videos you chose to watch | To run levels, the coin shop and the daily limit on video rewards | Until you delete the account |
| A history of account events (made, renamed, signed in, saved with Google) | Security, and to show you in your data download | Until you delete the account |
| IP addresses | To stop abuse, such as one person making thousands of accounts, and in our web server's logs to fix problems | Request counts are kept in memory for up to an hour; server logs are overwritten as they fill up, usually within weeks |
Our legal basis under UK and EU data protection law is that this data is needed to provide the game you asked to play (contract), plus our legitimate interest in keeping the game secure and fair (abuse prevention and logs).
On your device
The game stores your session token and your settings (sound, controls and so on) in your browser's local storage, or in the app's storage. It also remembers when you last saw an ad, so they're spaced out. These are needed for the game to work, so we don't ask for consent for them. We don't set cookies ourselves. Google sets cookies for ads (see Advertising below), and if you use the Google or Apple sign-in buttons, Google or Apple may set their own cookies under their own privacy policies.
Advertising
Smash-a-gon is free, and ads pay for the servers. Ads appear only at breaks: when you're out of a game or it's over and you tap to play again, watch or leave (at most one every few minutes), and as videos you choose to watch for a reward, such as double XP or coins. There are never ads during play.
The ads come from Google (Google AdSense and Ad Placement on the web, and Google AdMob in the apps). Google and its partners use cookies, or similar identifiers on your device, to show ads, to limit how often you see the same one, to measure them and to prevent fraud. If you allow it, they may also use them to show ads based on your visits to this and other websites. You can read how Google uses information from sites that use its services, turn personalised ads off at Google's Ad Settings, or opt out of some other companies' personalised ads at aboutads.info and youronlinechoices.eu.
If you're in the UK, the EU or Switzerland, Google shows you a consent message before any ads, and you can change your choice later from the same message. We only ask for personalised ads for players whose account says they're 18 or over; everyone else gets non-personalised ads. We don't pass your name, email or account details to advertisers.
If you're in a US state with its own privacy law, such as California, you can opt out of the "sale" or "sharing" of your personal information for targeted advertising using the "Do not sell or share my personal information" link that Google shows on the site, or by turning on Global Privacy Control in your browser. We don't sell your data for money.
Who else handles your data
- DigitalOcean hosts the game servers and the private backups of the account database, in London.
- Google serves the ads, as described under Advertising.
- Google and Apple, for sign-in, only if you choose to sign in with them.
- Resend sends sign-in emails, from its EU region, only if you ask for one. It handles your address to deliver the email and keeps delivery logs under its own policy.
We don't sell your data and don't share it with anyone else, unless the law requires us to.
Backups
The account database is copied continuously to a private backup so accounts survive a server failure. Backups are kept for 30 days, so a deleted account is gone from them within 30 days.
Your rights
- See and download your data: Settings → Account → Download my data.
- Correct it: change your name in Settings → Account.
- Delete it: Settings → Account → Delete account. This happens straight away.
- Object to or restrict how we use it, or ask for anything else: email us. We'll answer within one month.
- Complain: you can complain to the UK Information Commissioner's Office at ico.org.uk, or to the data protection authority where you live.
Children
Smash-a-gon is for ages 13 and over. Guests confirm they're 13 or over when they first play, Google and Apple apply their own age rules to their accounts, and we ask for a year of birth when you sign up with an emailed link. We don't make an account for anyone who tells us they're younger. If you think a child under 13 has an account, email us and we'll delete it.
Changes
If we change what we collect, we'll update this page and its date. For anything significant, such as adding ads or email sign-in, we'll tell you in the game first.