LAST UPDATED 4 NOVEMBER 2026
Privacy Policy
This policy explains what personal data the Bubble Bandit game collects, why, who we share it with, how long we keep it, and the rights you have. We only collect what we need to run the game.
Who we are
Bubble Bandit is made by Nerd World, based in Portugal, which is the data controller for the data described here. Contact: nerdworld3d@gmail.com.
What we collect and why
| Category | Data | Why |
|---|---|---|
| Google sign-in | The email address, name and Google account identifier that Google shares when you choose Continue with Google. | To sign you in and keep your progress on your account. |
| Guest play | A random player ID and a generated name such as “Bandit123456”. No email is needed. | To let you play and appear on leaderboards without registering. |
| Username | The leaderboard name you choose. | To show you on public leaderboards. |
| Sessions | A sign-in token and its expiry time. | To keep you signed in. |
| Gameplay and leaderboards | Your best score, level reached and number of ranked runs (all-time and weekly). For each ranked run: run ID, start and finish times, scores, level, outcome and the result of our automated score checks. | To run leaderboards and to detect and hold back impossible or suspicious scores. |
| Security records | Rate-limit counters, which use a user identifier and a time window. | To protect the service from abuse and cheating. |
| Advertising (Google AdMob) | If you watch a rewarded ad, Google AdMob may collect your device advertising ID, IP address, device and app information, and ad interactions. | To show the optional rewarded ad, give you the reward, measure ads and prevent fraud, and, with your consent where required, personalise ads. |
Public information: your username, best score and level reached appear on public leaderboards. Do not use your real name if you do not want it shown. You can rename yourself in the game.
We do not sell your personal data, and we do not collect precise location, contacts, photos, microphone audio or payment details.
Stored on your device
The game stores your sign-in session in your device's secure storage, plus local preferences and progress such as your local high score, settings and cosmetic unlocks. Uninstalling the app or clearing its data removes them.
Legal bases (GDPR)
- Contract: to provide the game, your account, sign-in and leaderboards.
- Legitimate interests: to keep the service secure and fair.
- Consent: for personalised advertising where the law requires it. You can withdraw it at any time.
- Legal obligation: where we must keep or disclose information by law.
Who we share data with
- Supabase: database, authentication and server functions hosting.
- Google: Sign in with Google, Google AdMob advertising and Google Play distribution.
- GitHub: hosting of this website.
We may also disclose data if required by law or to protect players or the service.
Advertising
Bubble Bandit offers optional rewarded ads served by Google AdMob. In the EEA, UK and Switzerland we ask for your consent before ads are personalised. On Android you can reset your advertising ID or opt out of personalisation under Settings › Privacy › Ads (or Settings › Google › Ads).
International transfers
Some providers process data outside the European Economic Area, including in the United States. Where that happens, we rely on safeguards such as the EU–US Data Privacy Framework or Standard Contractual Clauses.
How long we keep data
| Account, profile and leaderboard records | Until you delete your account. |
|---|---|
| Signed-in sessions | Until they expire or you sign out. |
| Ranked run records | Until you delete your account. |
| Rate-limit counters | Short-lived, removed shortly after their time window ends. |
Your rights
Under the GDPR you can ask to access, correct, delete or receive a copy of your personal data, and to restrict or object to how we process it. Email nerdworld3d@gmail.com. We reply within one month. You can also complain to the Portuguese data protection authority, the CNPD, or the authority where you live.
Deleting your account
- In the game: open the account panel from the menu and choose Delete account. Guests can delete their guest profile there too.
- Without the app: see how to request deletion.
Deletion removes your account, sign-in methods, sessions, leaderboard entries and ranked run records straight away.
Children
Bubble Bandit is not directed at children under 13. If you believe a child under 13 has given us personal data, contact us and we will delete it.
Security
We encrypt data in transit (HTTPS), use row-level security on our database, keep secret keys only on our servers and limit repeated requests. No system is perfectly secure.
Changes to this policy
We may update this policy as the game changes. We will update the date above.
Contact
Nerd World, Portugal · nerdworld3d@gmail.com