1. Data controller
Ronny Vinicio Cuenca Diaz (hereinafter "we"), acting as a private individual (not yet registered as self-employed or incorporated — the activity generates no income today), is responsible for processing personal data collected through the DoN mobile application. If this activity is formalized under a legal entity in the future (self-employed registration or incorporation), this document will be updated accordingly.
Privacy contact: privacy@don-games.com.
2. What data we collect
2.1 Account data
- Email and username, used for sign-up and login.
- You can create your account with email and password or with Google (see 2.6).
- We do not request or store your real name, phone number, or any payment data — there are no purchases of any kind in the App today, so there is no card or payment-method data to collect.
2.2 Gameplay data
- ELO, monthly and annual ranking points, virtual coins, owned and equipped icons, match history, and your referral code plus how many friends have used it.
- This data is calculated and stored on our server (not only on your device), so it is not lost if you switch devices.
- Technical data for each match (attendance and connection during the match), used to resolve abandonments and disconnections and to detect cheating.
2.3 Notifications
- Notifications are optional: they are only enabled if you agree to receive them.
- If you agree, we store your device's notification identifier (push token), the App language (Spanish or English) so we can send the notice in your language, and the date of the last daily notice sent (so it is sent at most once a day).
- Today we send at most one daily reminder when your daily matches are available again (only to players who played the previous day and have not yet played that day). We send no advertising and the content includes no personal data or other players' data.
- You can turn them off at any time from Profile (Notifications) in the App or from your system settings.
- The push token is removed from your account when you log out and when another account signs in on the same device, and it is deleted along with your account if you delete it.
- Delivery goes through Expo and Google's Firebase Cloud Messaging (see section 4).
2.4 Data stored on your device
- Your session is stored encrypted, with a key protected by the system's secure storage (Android Keystore). Android automatic backup is disabled for the App, so this data is not copied to other devices.
- Preferences (sound, vibration, language) and temporary data for matches pending upload to the server.
2.5 What we do NOT collect today
- No payment data: there are no in-app purchases in this version.
- No advertising or tracking data: no third-party ad or analytics SDK is integrated, no advertising identifiers, and no App Tracking Transparency (not needed, since there is no tracking).
- No sensitive system permissions: the App does not request access to location, camera, microphone, or contacts. The only permission it may ask for is notifications, and it is optional.
- No prize-related data: there are no real-money prizes today, so we do not collect or verify identity for that purpose.
2.6 Sign in with Google
- You can create your account or log in with email and password or with "Continuar con Google" (Continue with Google). Google login is handled through Supabase Auth (see section 4).
- With Google we receive only basic profile data: your email address, your name and
your profile picture URL (scopes
openid,emailandprofile). We do not access your contacts, Drive, Gmail or any other Google data. - We use it only to create and identify your account and let you log in. Your in-game player name is chosen or generated separately, and your Google name and photo are not shown to other players (the App uses its own icons). It is stored with your account in Supabase (EU) and deleted when you delete your account from the App.
- We do not sell it, use it for advertising, or share it with third parties beyond the processors already listed in section 4.
- You can revoke DoN's access from your Google account at myaccount.google.com/permissions.
- DoN's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
2.7 Error reports
- If the App crashes or a technical error occurs, a report is sent to Sentry with: the error message and its technical stack trace, the device model, the operating system version, the App version and a pseudonymous identifier derived (hashed) from your account id.
- It does not include your email or name, does not create any IP-based personal profile (default personal data collection is disabled) and does no performance tracking.
- We use it to detect and fix errors (legitimate interest in keeping the App working). Sentry keeps these reports for up to 90 days, depending on its plan.
3. Why we use your data and on what legal basis
| Purpose | Data involved | Legal basis (GDPR) |
|---|---|---|
| Provide the service (play, save progress, sync across devices) | Account, gameplay data | Performance of a contract (art. 6.1.b) |
| Calculate ELO and ranking points | Gameplay data | Performance of a contract |
| Prevent cheating, collusion and multi-accounting | Gameplay data, account identifier | Legitimate interest (art. 6.1.f) |
| Account-related communications | Performance of a contract | |
| Referral system | Account, referral code | Performance of a contract |
| Detect and fix App errors | Error reports (see 2.7) | Legitimate interest (art. 6.1.f) |
| Send push notifications (daily reminder) | Push token, App language, date of the last notice (see 2.3) | Consent (art. 6.1.a), which you can withdraw at any time from Profile or your system settings |
We do not use your data for personalized advertising or any marketing purpose without your express consent, and today we do neither.
4. Who we share your data with
We do not sell your data. Today we only share it with:
- Supabase (our backend infrastructure provider, which also handles Google login) — stores the account and gameplay data described in section 2, and runs server-side logic (ELO, points, coins, anti-cheat calculations).
- Colyseus Cloud (real-time match server, hosted in Madrid) — receives your account identifier and the data of the match in progress in order to referee it; it does not store your email.
- Resend (email delivery) — receives your email address to send you the account confirmation email and other account notices.
- Expo (push notification service), which delivers notifications through Google's Firebase Cloud Messaging — they receive the push token and the notification content, only if you have agreed to receive notifications.
- Sentry (Functional Software, Inc., error reporting service, sentry.io, EU region) — receives the error reports described in section 2.7, only when the App fails.
- Public authorities, only when there is a legal obligation to provide information.
We do not share data with:
- Google (or any other third party) for payment processing — there are no purchases in the App today. The initial launch is Android-only, via Google Play.
- Any gift-card provider — there are no cash prizes today.
- Any third-party advertising or analytics provider — no such SDK is integrated.
If any of these services are integrated in the future, we will update this policy before activating them and request the corresponding consent (for example, App Tracking Transparency on iOS if tracking-based advertising were activated).
5. International transfers
The Supabase servers we use are hosted in the eu-west-1 region
(Ireland) and the Colyseus Cloud match server in Madrid, both within the European Union.
Resend and Expo/Google are US-based companies and may process your email (Resend) or your
notification token (Expo/Google) outside the European Economic Area; in those cases the
transfer relies on the EU-U.S. Data Privacy Framework or on the EU standard contractual
clauses included in those providers' data processing agreements. Sentry (Functional Software, Inc.) is
also a US-based company, although the error data is stored in its EU region (Germany).
6. How long we keep your data
- Account and gameplay data: for as long as your account is active.
- Error reports: up to 90 days at most, depending on Sentry's plan.
- If you delete your account (see section 7), your data is removed from our server immediately, unless the law requires us to retain a specific piece of data for a set period (which does not apply today, given there are no purchases or prizes involved).
7. Your rights
If you reside in the European Union (GDPR) or a jurisdiction with equivalent rights, you may exercise at any time:
- Access to the data we hold about you.
- Rectification of incorrect data (e.g., your username, editable directly from your profile in the App).
- Erasure of your account and data — available directly from the App (Profile → Delete account), with immediate effect, or by writing to privacy@don-games.com. Step-by-step instructions at Delete account.
- Objection and restriction of processing in the cases provided by law.
- Portability of your gameplay data, where technically feasible.
To exercise any of these rights, write to privacy@don-games.com. You also have the right to file a complaint with your country's data protection authority (for example, in Spain, the Agencia Española de Protección de Datos).
8. Children
This App is not directed at children under 14 (the minimum age to consent to the processing of personal data in Spain, Article 7 of the Spanish data protection law, LOPDGDD) and does not allow them to register: creating an account requires confirming you are 14 or older. We do not knowingly collect data from children under 14. If you believe a child under 14 has registered, contact us at privacy@don-games.com and we will delete their account and data.
9. Security
We apply reasonable technical and organizational measures to protect your data (encryption in transit, database-level access control, secure storage of your session on your device). No system is 100% secure, but we commit to notifying you, as required by applicable law, if a security breach affecting your data were to occur.
10. Cookies and tracking technologies
The App does not use tracking cookies or any third-party advertising or analytics SDK today. If this changes in the future, this policy will be updated to describe what is collected and, on iOS, App Tracking Transparency consent will be requested before activating it.
11. Changes to this policy
We may update this Privacy Policy. If the change is material — in particular, if we activate in-app purchases or a real-money prize system that involves collecting new types of data — we will notify you via the App or by email before it takes effect, without committing here to any specific date.
12. Contact
For any questions about this Privacy Policy or your data: privacy@don-games.com.