Privacy policy
1. Who we are
Fuselings is a puzzle game made by Extalia, a sole proprietorship in Greece ("we", "us"). We decide how your personal data is used (we are the "controller").
- Privacy contact: [email protected]
- Full legal details: Imprint
We have not appointed a Data Protection Officer, because the law does not require one for a project of this size.
2. The short version
- You play without an email address or login. The game creates a random player ID on your device.
- We ask your year of birth once. We keep only an age range (under 13, 13 to 15, 16 to 17, 18 or over), and only on your device. It never leaves your device.
- Usage stats are off unless you say yes. You can change your answer any time in Settings > Privacy.
- Ads: we ask your choice (personalised or not) before any ad loads. If you are under the age of digital consent in your country, you only get non-personalised ads and we do not ask.
- Your progress is backed up on our server under your random player ID. A recovery code in Settings lets you move it to a new device. We store only a scrambled (hashed) form of the code.
- You can delete everything in Settings > Privacy > Delete my data, or ask us by email.
3. What we collect, why, and on what legal basis
| Data | Why | Legal basis | How long |
|---|---|---|---|
| Random player ID, device key and sign-in tokens. The device key and tokens are stored only as hashes. | To run your online account: leaderboards, leagues, wallet and cloud save. | Contract, Art. 6(1)(b) GDPR | Until you delete your data. |
| Device platform (iOS or Android) | Support and compatibility | Legitimate interest, Art. 6(1)(f) | Until you delete your data. |
| Display name. It is random by default. You can choose your own if you are at or over the age of digital consent in your country. | Shown to other players on leaderboards and in leagues | Contract | Until you delete your data. Then it becomes "Deleted player". |
| Country (two letters), only if our network provider adds it when you first connect | No feature uses it today. We will update this policy before we use it for anything. | Legitimate interest | Until you delete your data. |
| IP address | Abuse protection (rate limits) | Legitimate interest | Held in memory only, never written by our game server. The web proxy in front of our game server keeps access logs for at most 14 days. Our website host keeps standard access logs for a limited time. |
| Game runs: random seed, your moves, the time between moves, score, game version and anti-cheat flags | To check that ranked scores are real | Legitimate interest (fair play) and contract | Moves of practice and rejected runs: 90 days. Verified ranked runs: until you delete your data. |
| Scores, league placement and rewards | Leaderboards and leagues | Contract | Until you delete your data. Afterwards scores stay as "Deleted player", without your moves. |
| Wallet and purchases: coin and gem balance changes, store transaction IDs, what you own | To give you what you bought, restore it and handle refunds | Contract; legal obligation for tax records | Until you delete your data. Transaction records as long as Greek tax law requires. |
| Cloud save: stars per level, cosmetics and Workshop items you own, what you have equipped, best scores, streak, tutorial done. No coins, gems or settings. | To keep your progress safe and restore it on a new device | Contract | Until you delete your data. Each sync replaces the previous copy. |
| Recovery code: only a keyed hash of the code, plus when it was made and last used | To move your player to another device without a login | Contract | Until you make a new code (the old one is deleted at once) or delete your data. |
| Usage stats, only if you say yes: session ID, language, game version, settings changes, level and run results, shop, Workshop, ad and purchase events. Linked to your random player ID. | To balance levels and improve the game | Consent, Art. 6(1)(a) GDPR and Art. 4(5) of Greek Law 3471/2006 | 13 months |
| Your age range and privacy choices | To set up ads and stats for your age and remember your choices | Legal obligation, Art. 6(1)(c) with Art. 8 GDPR | Only on your device. Never sent to us. |
| Game progress and settings on your device | So you can keep playing | Contract (strictly necessary storage) | On your device until you delete the app or your data. |
| Support emails | To answer you and handle your rights requests | Contract or legal obligation | 24 months after the case is closed. |
We do not make automated decisions about you with legal or similarly important effects. The anti-cheat check is automatic: if it rejects a ranked score, the score counts as practice. You can ask us to look at it by email.
Crash reports
The game itself does not send crash reports to us today. If you allowed it in your phone's settings, Apple or Google may share anonymous crash reports with us.
4. Ads
Beta builds show placeholder ads only and do not contact any ad network. The released game will show ads through an ad network ("ad partners"). We will name it here before the first ad is shown.
Before any ad is requested, the game shows a consent form (Google's User Messaging Platform, IAB TCF v2.2) where you choose whether ad partners may use data from your device to personalise ads. You can change this any time in Settings > Privacy > Ad privacy options.
- Non-personalised ads still use some device data (for example IP address and device type) to deliver ads, limit how often you see them and prevent fraud.
- If you are under the age of digital consent in your country (13 to 16, depending on the country), we do not ask. You only get non-personalised ads, and our ad requests say you are under that age. Under 13, requests are also marked as child-directed.
- On iPhone, we show Apple's "Allow tracking" question only if you chose personalised ads.
Ad partners decide themselves how they use the data they collect. We will link their privacy policies here once the ad network is chosen.
5. Who receives data
- Other players: your display name, scores and league placement.
- Hosting: our game servers run on servers we manage ourselves. This website is hosted by Hostinger.
- Email: our email provider handles support mail.
- Apple and Google handle app downloads and payments under their own policies.
- Ad partners: see section 4.
- Authorities, only when the law requires it.
We do not sell your personal data.
6. Transfers outside the EU
Ad partners and some service providers are in the United States. Those transfers rely on the EU-US Data Privacy Framework where the company is certified, and otherwise on the European Commission's Standard Contractual Clauses.
7. Children and teens
The game is listed for players aged 13 and over. We ask the year of birth without hinting at a "right" answer and keep only an age range on the device. Players under the age of digital consent in their country get no consent questions, non-personalised ads only, no usage stats, and only randomly made display names. Starter offers are shown to them without a countdown.
8. Your rights
You can ask us for a copy of your data (access and portability), and for correction, deletion or restriction. You can object to use based on legitimate interest. Where we rely on your consent, you can withdraw it at any time. That does not affect what was done before.
- In the game: Settings > Privacy > Delete my data deletes your online account (including the cloud save and the recovery code) and everything on this device. Coins and gems you paid for are lost and cannot be restored, and your old recovery code stops working.
- Recovery code: anyone who has it can take over your progress, so keep it private. Settings > Account > Recovery code lets you make a new one, and the old code stops working at once.
- By email to [email protected]: include the Player ID shown in Settings > Privacy so we can find your data. Without a login we cannot otherwise tell that the data is yours.
- Without the app: fuselings.com/delete-account
We answer within one month.
You can complain to the Hellenic Data Protection Authority (www.dpa.gr, Kifisias 1-3, 115 23 Athens) or to the authority in the EU country where you live.
9. Security
All connections to our server use HTTPS. The device key and the recovery code are stored only as hashes (the recovery code with a secret key), and restore attempts are rate limited. Our game server does not log your IP address. Database backups are kept for 14 days (daily) and 60 days (weekly), so deleted data is gone from backups within 60 days.
10. Beta testers
During the closed beta the same rules apply. Server data from the beta (player IDs, scores, leagues, recovery codes) is wiped at launch, and the final beta backup is deleted 90 days after launch. See the beta terms.
11. Changes
We update this page when the game changes and show the date at the top. For important changes we will also tell you in the game.