Privacy Policy

Last updated: 2026-09-12 · Effective: 2026-09-12

1. Who We Are

Ballin Tycoon ("we", "us") is the data controller for the personal information collected through the Service. Contact: supportplinkotycoon@gmail.com.

2. What We Collect

Account data

• Username (chosen by you);
• Hashed password (we never store passwords in plaintext — they are one-way bcrypt hashes);
• Email address — used to create and verify your account, sign in, and contact support (Google or Apple sign-in may provide it instead);
• Account creation date and last-login timestamp.

Gameplay data

• Progress, levels, currencies, items owned, pets, stickers, trophies, and other state needed to operate the game;
• Settings and preferences;
• Friend relationships, friend requests, blocks, and chat messages you send/receive;
• Trade and purchase history within the game economy;
• Events you trigger (e.g., pet pulls, tournament scores, bonus claims) used to calculate rewards and detect suspicious activity.

Device & technical data

• IP address and approximate location derived from it (country/region level);
• Browser/app type and version, operating system, screen size;
• Session cookies (see Cookie Policy);
• Server-side logs (request paths, status codes, timestamps) used for security, debugging, and analytics;
• A random per-install identifier generated by the app, used to prevent referral abuse;
• In the iOS and Android apps only: your device's mobile advertising identifier (Apple IDFA — only if you allow tracking — or Google Advertising ID), Apple's IDFV, and install-referrer information, used to measure which ad campaigns led to your install (see Section 12A).

Purchase data

If you make in-app purchases, our payment processor (e.g., Apple, Google, or a web payment provider) handles your payment instrument. We receive a transaction confirmation and the SKUs you bought. We do not store full credit-card numbers on our servers.

Information we do NOT collect

• Government IDs, social-security numbers, or similar national identifiers;
• Biometric data;
• Precise GPS location;
• Microphone or camera input.

3. How We Use Data

• Operate the Service — authenticate you, save progress, pair you with friends, deliver chat messages, run tournaments, etc.
• Support — respond to your messages, troubleshoot, restore lost progress.
• Safety & integrity — detect cheating, fraud, account-sharing, abuse, and policy violations; ban bad actors.
• Improve the game — measure feature usage, balance the economy, identify and fix bugs.
• Measure our advertising — understand which ad campaigns (for example on Snapchat or Meta) led people to install the app, so we can manage our ad spend. We do not show third-party ads inside the game.
• Comply with law — respond to legal process, enforce our Terms, and protect rights.

4. Legal Bases for Processing (GDPR / UK GDPR)

If you are in the European Economic Area, United Kingdom, or Switzerland, we rely on the following legal bases:

• Contract — to provide the Service you signed up for.
• Legitimate interests — to keep the Service safe, prevent fraud, improve the game, and measure the effectiveness of our advertising; we balance these against your rights and freedoms.
• Consent — for optional marketing emails, non-essential cookies, and access to advertising identifiers on your device where required by law (for example, Apple's App Tracking Transparency prompt); you may withdraw consent at any time.
• Legal obligation — to comply with applicable law and lawful requests.

5. Who We Share Data With

We do not sell personal information. We share data only with:

• Service providers who process data on our behalf under contract — hosting (Fly.io), payment processors (Apple, Google, web payment providers), email delivery, error logging, and similar infrastructure;
• Mobile measurement partner — AppsFlyer, which receives device identifiers, install and app-open events, and basic device information from the iOS and Android apps in order to attribute installs to ad campaigns (AppsFlyer privacy policy);
• Advertising platforms we buy ads on — currently Snap Inc. (Snapchat) and, where we run campaigns, Meta Platforms (Facebook/Instagram). Through AppsFlyer and Apple's SKAdNetwork, they receive install and attribution data linked to device identifiers so they can report and optimize our campaigns (Snap privacy policy, Meta privacy policy);
• Other players, in features you choose to use — your username, avatar, level, trophies, and chat messages are visible to friends and on leaderboards;
• Legal recipients when required by law or to protect rights, property, or safety (ours, yours, or others');
• A successor, in the event of merger, acquisition, financing, or sale of assets, with notice to you.

6. Retention

We keep account data for as long as your account is active. When you delete your account (see Account Deletion), we delete or anonymize your personal data within 30 days, except where we are required to keep records for legal, tax, fraud-prevention, or dispute-resolution purposes. Anonymized analytics data may be retained indefinitely.

7. Your Rights (GDPR / UK GDPR / similar laws)

Subject to applicable law, you may:

• Access the personal data we hold about you;
• Request correction of inaccurate data;
• Request deletion of your personal data;
• Object to or restrict certain processing;
• Request a portable copy of data you provided to us;
• Withdraw consent where processing is based on consent;
• Lodge a complaint with your local data-protection authority.

To exercise any of these rights, email supportplinkotycoon@gmail.com. We may need to verify your identity to protect your account.

8. California & US State Privacy Rights (CCPA / CPRA et al.)

If you are a resident of California or another US state with applicable consumer-privacy laws, you have rights similar to those above, including the right to know, the right to delete, and the right to opt out of "sale" or "sharing" of personal information for cross-context behavioral advertising. We do not sell personal information for money. We do share device identifiers and install data with advertising platforms to measure our ad campaigns (see Section 12A), which some state laws may treat as "sharing." You can opt out of this at any time using the device settings described in Section 12A or by emailing us with the subject "Do Not Share." To exercise your rights, contact us at supportplinkotycoon@gmail.com. We will not discriminate against you for exercising these rights.

9. Children

The Service is not directed to children under 13 (or under 16 in the EEA, unless local law allows a lower age with verifiable parental consent). We do not knowingly collect personal information from children below those ages. If we learn that we have collected personal information from a child without parental consent, we will delete it. If you believe a child has provided us with personal information, please contact supportplinkotycoon@gmail.com so we can take action.

10. Security

We use industry-standard technical and organizational measures, including bcrypt password hashing, HTTPS in transit, SQLite encryption-at-rest options where available, server-side authorization for all sensitive actions, and rate limits. No system is perfectly secure; we cannot guarantee absolute security, but we work hard to protect your data and will notify you of any breach affecting your account where required by law.

11. International Data Transfers

The Service is hosted on infrastructure that may be located outside your country of residence (currently the United States). Where personal data is transferred from the EEA/UK/Switzerland to a country not recognized by the relevant authority as offering an adequate level of protection, we rely on standard contractual clauses or another lawful transfer mechanism.

12. Third-Party Services & Links

The Service may include or link to third-party services (Apple, Google, payment processors, etc.). Those services have their own privacy policies; please review them. We are not responsible for third parties' privacy practices.

12A. Ad Measurement & Your Choices

We advertise Ballin Tycoon on other platforms, such as Snapchat. To know which ads actually lead to installs, the iOS and Android apps include the AppsFlyer SDK. When you first open the app, AppsFlyer receives your device's advertising identifier (where available), install-referrer data, IP address, device model, OS version, and app open and install events. It matches this to ad clicks or views on the platforms we advertise on, and reports the result to us and to that platform.

We use this only to measure and improve our own ad campaigns. We do not show third-party ads in the game, and we do not sell this data.

Your choices:

• iPhone / iPad: the app asks your permission before accessing your IDFA. If you tap "Ask App Not to Track", we never access it; Apple's privacy-preserving SKAdNetwork may still report aggregated, non-identifying install counts to ad platforms. You can change your choice any time in Settings → Privacy & Security → Tracking.
• Android: go to Settings → Google (or Privacy) → Ads and tap "Delete advertising ID" (or "Opt out of Ads Personalization" on older versions). Apps then receive no advertising ID.
• Anyone: email supportplinkotycoon@gmail.com with the subject "Do Not Share" and we will help you opt out, including by requesting deletion of measurement data held by AppsFlyer for your device where we can identify it.

The web, desktop, and Discord versions of the game do not include the AppsFlyer SDK.

12B. Apple App Tracking Transparency

On Apple platforms (iOS / iPadOS), Apple requires apps to request permission before tracking users across apps and websites owned by other companies (the "ATT" prompt). Ballin Tycoon shows this prompt the first time you open the iOS app. If you allow tracking, your IDFA is shared with AppsFlyer and the ad platforms described in Section 12A to attribute your install to an ad. If you decline, we do not access your IDFA. Declining never limits any game feature.

12C. Google Play Data Safety Summary

For users who install Ballin Tycoon through Google Play, this summary mirrors what we declare in the Play Console "Data Safety" form. Detail is in the sections above; this is a quick reference.

• Data collected: personal info (email address, user IDs such as username and friend code); approximate location (country, from IP address); financial info (purchase history); messages (in-app chat and support messages); app activity (in-game actions, progress, bug reports); app info & performance (diagnostics); device or other IDs (advertising ID, per-install ID, session token).
• Data shared with third parties: device or other IDs, shared with AppsFlyer and the ad platforms we advertise on (such as Snap) for analytics and ad measurement. Service providers (hosting, payment processing, error logging) receive only the data needed to perform their function, under contract, which Google Play does not count as sharing.
• Data sold: no.
• Data used for advertising or marketing: yes — device identifiers are used to measure our own ad campaigns. No third-party ads are shown in the game.
• Security: all data is transmitted over HTTPS. Passwords are stored only as bcrypt hashes.
• Data deletion: users can request deletion at any time. See Account & Data Deletion.
• Google Play Families Policy: not applicable — Ballin Tycoon is not directed at children under 13.

13. Changes

We may update this policy. When we do, we will update the "Last updated" date and, for material changes, we will notify you in-game or by email. Continuing to use the Service after the effective date constitutes acceptance of the updated policy.

14. Contact

Email: supportplinkotycoon@gmail.com. Please mark the subject "Privacy Request" so we can route your message quickly.