Privacy Policy
Last updated: February 17, 2025
CactusPop is committed to protecting the privacy of its users. This privacy policy describes the data we collect, how we use it, and what your rights are in accordance with the General Data Protection Regulation (GDPR - EU Regulation 2016/679), California Consumer Privacy Act (CCPA), and other applicable data protection laws.
1. Data Controller
The data controller for personal data is:
- Name / Company: [To be completed]
- Address: [To be completed]
- Contact: Contact form
2. Data Collected
When using the CactusPop game, we collect the following data:
| Data | Description |
|---|---|
| Username | Name chosen by the player (1 to 15 characters) |
| Tag | Identifier in #XXXX format (4 digits) |
| Score | Score achieved in solo or multiplayer mode |
| BR Ranking | Points, wins, top 3 finishes and games played in Battle Royale |
| Date / Time | Timestamp of score submission |
| IP Address | Automatically collected by the server (technical logs) |
2.1. Advertising and AdMob
CactusPop may display advertisements through Google AdMob, a mobile advertising platform operated by Google LLC. When you use the mobile app, AdMob may collect and process certain data to provide personalized or non-personalized advertising.
Data Collected by AdMob:
- Device identifiers: Advertising ID (IDFA on iOS, AAID on Android)
- Device information: Device model, OS version, screen size, language settings
- Usage data: App interactions, ad impressions, clicks
- Location data: Approximate location based on IP address (no precise GPS tracking)
- Technical data: IP address, user agent, browser type
Purpose of Advertising Data:
- Display relevant advertisements
- Measure ad performance and analytics
- Prevent fraud and ensure ad security
- Support free access to the game
GDPR Compliance - Your Consent:
For users in the European Economic Area (EEA) and the United Kingdom:
- You will be asked for explicit consent before personalized ads are shown
- If you refuse consent, you will see non-personalized ads only
- You can change your consent preferences at any time in the app settings
- AdMob uses a Google-certified Consent Management Platform (CMP) to collect your consent
Apple's App Tracking Transparency (ATT) - IDFA:
For iOS users (iOS 14.5+):
- The app will request your permission to track your activity through the App Tracking Transparency (ATT) framework
- This permission allows access to your device's Identifier for Advertisers (IDFA)
- If you deny tracking, AdMob will show non-personalized ads without using your IDFA
- You can change this permission anytime in iOS Settings > Privacy > Tracking
AdMob Partners and Third Parties:
AdMob works with third-party ad networks and partners who may also collect data. A complete list of Google's advertising partners is available here: Google AdMob Partners
Data Retention by AdMob:
Google retains advertising data in accordance with its own privacy policy. For more information, see:
3. Purposes of Processing
The data collected is used for the following purposes:
- Display the global and Battle Royale leaderboards
- Enable multiplayer functionality (private rooms and Battle Royale)
- Display personal statistics in-game
- Ensure service security and prevent cheating (rate limiting, anti-bot)
- Diagnose technical issues (server logs)
- Display advertisements (via Google AdMob) to support the free service
We do not sell your personal game data (username, scores, etc.). However, advertising partners like Google AdMob may collect device and usage data for advertising purposes, as described in section 2.1 above.
4. Legal Basis
Data processing is based on the following legal grounds:
- Legitimate interest (Article 6.1.f GDPR): leaderboard functionality, service security and cheat prevention
- Performance of a contract (Article 6.1.b GDPR): provision of the game service as described in the Terms of Use
- Consent (Article 6.1.a GDPR): personalized advertising via Google AdMob (for EEA/UK users). Non-personalized ads are shown based on legitimate interest if consent is refused.
5. Data Retention
| Data | Retention Period |
|---|---|
| Username, tag, scores | Lifetime of the service or until deletion request |
| Battle Royale statistics | Lifetime of the service or until deletion request |
| IP address (logs) | 12 months maximum |
| Multiplayer session data | Automatically deleted after the game ends |
| Advertising data (AdMob) | Managed by Google according to their retention policies (typically 2-26 months depending on data type) |
6. Data Recipients
Your data may be shared with the following recipients:
- CactusPop technical team: For service administration and support
- Server hosting provider: For technical maintenance and infrastructure
- Google AdMob and advertising partners: For displaying advertisements (device data, advertising identifiers, usage data). See section 2.1 for details.
Public data (username, tag, score) is visible to all users via the leaderboard.
Note: We do not sell your personal game data (username, scores) to third parties. Advertising partners collect device and usage data directly through their SDKs in accordance with their own privacy policies.
7. Transfers Outside the EU
Your game data (username, scores, statistics) is hosted within the European Union.
Advertising data (AdMob): Google AdMob may transfer your advertising data (device identifiers, usage data) to servers located outside the European Union, including the United States. These transfers are protected by:
- Google's compliance with the EU-U.S. Data Privacy Framework
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Additional technical and organizational security measures
For more information on Google's international data transfers: Google Privacy Frameworks
8. Data Security
We implement the following technical and organizational measures to protect your data:
- Encrypted communications via HTTPS/TLS
- Token-based authentication for API access
- Rate limiting on requests
- Anti-bot protection and data validation
- Restricted access to servers and databases
- Regular security updates
9. Your Rights (GDPR)
In accordance with the GDPR and applicable data protection laws, you have the following rights:
- Right of access (Art. 15): obtain a copy of your personal data
- Right to rectification (Art. 16): correct inaccurate or incomplete data
- Right to erasure (Art. 17): request the deletion of your data
- Right to restriction (Art. 18): restrict the processing of your data
- Right to data portability (Art. 20): receive your data in a structured format
- Right to object (Art. 21): object to the processing of your data
To exercise these rights, contact us via our contact form. We will respond within 30 days.
You also have the right to file a complaint with your local data protection authority if you believe that the processing of your data does not comply with applicable regulations.
10. United States Privacy Rights
California Consumer Privacy Act (CCPA)
If you are a California resident, you have specific rights under the CCPA:
- Right to Know: Request information about the categories and specific pieces of personal information we have collected about you in the past 12 months
- Right to Delete: Request deletion of your personal information, subject to certain exceptions
- Right to Opt-Out: Opt-out of the "sale" of your personal information. Note: We do not sell personal information as traditionally defined, but advertising partners may collect data through their SDKs.
- Right to Non-Discrimination: You will not receive discriminatory treatment for exercising your CCPA rights
- Right to Limit: Request to limit the use and disclosure of your sensitive personal information
To exercise your CCPA rights, contact us via our contact form and mention "CCPA Request" in your message.
Do Not Sell My Personal Information
While we do not directly sell personal information, Google AdMob and advertising partners may use your data for advertising purposes, which may be considered a "sale" under CCPA. You can opt-out by:
- Adjusting ad settings in the mobile app
- Using device-level settings (iOS: Settings > Privacy > Tracking; Android: Settings > Google > Ads)
- Visiting the Digital Advertising Alliance opt-out page
Other U.S. State Privacy Laws
Similar rights may apply to residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and other U.S. states with comprehensive privacy laws. Contact us to exercise these rights.
Children's Online Privacy Protection Act (COPPA)
CactusPop does not knowingly collect personal information from children under 13 years of age without verifiable parental consent. If we discover that we have inadvertently collected information from a child under 13, we will delete it immediately. Parents can contact us via our contact form.
11. Minors
CactusPop is a game suitable for all ages. We do not knowingly collect identifiable personal data from children under 16 (or under 13 in the U.S.) without parental consent. If you are a parent or guardian and discover that your child has provided us with personal data, please contact us via our contact form so we can take the necessary steps.
12. Policy Changes
We reserve the right to modify this privacy policy at any time. Any changes will be published on this page with an updated date. In the event of a substantial change, a notification may be displayed in-game.
Continued use of the service after a change constitutes acceptance of the updated policy.
13. Contact
For any questions regarding the protection of your personal data, you may contact us via our contact form.