Privacy Policy

1. Who we are

Controller / operator: NTT Media. Contact for privacy questions and requests: [email protected].

2. Data we collect

We collect only what is needed to run the game:

• Account data: a random player ID (also for guests); if you register: your e-mail address and a password (stored only as a salted hash, never in clear text); if you sign in with Google or Apple: the account identifier, e-mail address and name given by the provider; if you sign in with Telegram: your Telegram ID, name and username.
• Profile: the display name you choose, an avatar number and, only if you upload one, a small profile photo (resized and stored by us).
• Gameplay data: scores, game modes, the highest planet reached, the inputs of each game (when you dropped, swapped or shook), used to verify scores and detect cheating; in-game balances (meteors, stardust, diamonds), unlocked scenes and upgrades, selected scene, language and saved progress.
• Purchase data: product, price, status and the order or receipt reference returned by Stripe, Telegram Stars, Google Play or the Apple App Store. We never see or store your card number.
• Technical and security data: IP address, app version and platform, timestamps, and security events (for example failed sign-ins), used to keep the service secure and prevent abuse.
• Advertising: if rewarded or banner ads are switched on, the ad provider (such as Google AdSense / AdMob or Adsgram) may collect device identifiers or cookies under its own privacy policy. We only record that a rewarded ad was watched.
• On your device: the game stores progress, settings and sign-in tokens in your browser or app storage (local storage). We do not use tracking cookies of our own.

3. Google user data

If you use "Sign in with Google" we request only the openid, email and profile scopes. We use your Google account identifier, e-mail address and name solely to create your account, sign you in and, if you ask for it, send you a verification or password-reset e-mail. We do not request access to Gmail, Drive, Contacts, Calendar or any other Google service, we do not sell Google user data, we do not use it for advertising and we do not transfer it except as needed to run the game or when required by law.

The use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

Separately, the game operator uses its own Gmail account to send transactional e-mails (verification codes and password resets) from the server. This does not give us access to any player's mailbox.

4. How we use data

• Provide the game: sign-in, saving progress, purchases and unlocks.
• Show leaderboards (your display name, avatar and score are visible to other players).
• Verify scores and prevent cheating, fraud and abuse.
• Send service e-mails you request (verification code, password reset). We do not send marketing e-mails.
• Fix bugs, keep the service secure and comply with the law.

5. Sharing

We do not sell your personal data. We share it only with: hosting and infrastructure providers that run the service for us; payment providers (Stripe, Telegram, Apple, Google) to process purchases; advertising providers if ads are enabled; and authorities when the law requires it. These providers act under their own terms and privacy policies.

6. Retention

• Account and gameplay data are kept while your account exists and are deleted when you delete your account.
• One-time codes expire within minutes; unfinished game sessions are removed after 24 hours.
• Security logs are kept only as long as needed for security and abuse prevention.
• Encrypted server backups are rotated and overwritten within about 7 days.
• Purchase records may be kept as long as the law requires for accounting or tax purposes.

7. Your rights and choices

Depending on where you live (for example the EEA/UK GDPR, California, or Vietnam's Personal Data Protection Decree) you may have the right to access, correct, delete, restrict or export your data, and to object to processing. You can:

• change your name, avatar and password in the game (Profile);
• delete your account and data yourself in the game (Profile → Delete account) or follow the steps on our Delete account page;
• contact us at [email protected] for any other request. We answer within 30 days.

8. Security

Traffic is encrypted with HTTPS. Passwords are hashed, access tokens are short-lived, and administration is protected by two-step verification and rate limits. No online service is perfectly secure, so please use a strong, unique password.

9. Children

The game is not directed to children under 13 (or under 16 where required by local law) and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact [email protected] and we will delete it.

10. International transfers

Our servers or our providers' servers may be located outside your country. Where required, we rely on appropriate safeguards for such transfers.

11. Changes

We may update this policy. The date at the top shows the latest version; for significant changes we will also notify you in the game.

12. Contact

NTT Media – [email protected]