Privacy Policy

1. Who we are

Gatecrash is a puzzle game made and run by Ngomma Value Added Services Limited, trading as NG Gaming Labs ("we", "us"). It comes as an Android app (package com.nggaminglabs.gatecrash) and as a web game at nggaminglabs.com. Both are called "the game" below.

For anything about your information, write to privacy@nggaminglabs.com.

2. What the game uses, and why

2.1 Your saved game, on your device

Your stars, coins, lives, your sound and vibration settings, a random id the game makes up the first time it runs, and a short list of your most recent play statistics are kept in the game's local storage on your device: the app's storage on Android, your browser's local storage on the web. They do not leave your device unless you choose to save your progress to an account (2.3). The game sets no cookies of its own.

Why: so the game remembers where you are.

2.2 Play statistics, sent to our server

When the game starts, and each time you finish or leave a level, it sends our server a small message over HTTPS. It contains: the random id; the time; the level number; the mode (Puzzle or Rush) and whether it was the daily challenge; how the level ended (cleared, out of moves, out of time, no moves left, or left); the stars you earned; the moves you used, the move limit and the best known score; the seconds you used and the time limit; the ladder rung you reached (from 1 in 10 to 1 in a million); whether you used bonus moves or time; and how many times you continued. It has no name, email address, phone number or location.

If you also save your progress to an account (2.3), your saved game contains the same random id, so on our server the id is stored next to your email address. We use the statistics in totals and do not use that link to look at one person's play.

Why: to find levels that are too hard or too easy, to fix bugs and to see how many people play.

2.3 Saving your progress to an account (optional)

If you choose Settings, then "Save my progress", and type your email address, we send you a one-time sign-in link and a 6-digit code by email: you tap the link, or type the code in the game. Both work once and expire after 15 minutes. We store your email address, the sign-in link and code until they expire, a sign-in session, and a copy of your saved game. Your device keeps a sign-in token and your email address so you stay signed in until you log out. We use the email address to sign you in and to answer you if you write to us, not for marketing.

The sign-in email is sent through an email delivery service, Resend, which handles your email address and the message so it can be delivered.

Why: to give you the sign-in and the saved copy you asked for.

2.4 Ads in the Android app

The Android app shows ads through Google AdMob: rewarded videos that you choose to watch (to double a level's coins, or to get extra moves, extra time or another life), and full-screen ads between some levels. To show and measure ads, Google collects and uses information from your device, such as your Android advertising ID, your IP address, details of your device and the app, and how you interact with ads, as described in how Google uses information from apps that use its services and Google's Privacy Policy. We do not receive that information. Google gives us only totals, such as how many ads were shown.

You can reset your advertising ID, or turn off ad personalisation, in your Android settings.

Why: the ads pay for the game.

2.5 The web version

The web version does not show ads from any ad network. Where the app plays a video ad, the web game shows a short countdown instead. The web page loads the Fredoka typeface from Google Fonts, so Google receives your IP address and browser details when the page loads (see Google's Privacy Policy); the Android app has the typeface built in and does not contact Google Fonts. The web version is delivered through Cloudflare (see Cloudflare's Privacy Policy).

2.6 Server logs

Like any server, ours and Cloudflare's record technical details of each request, such as your IP address, the time, the address requested and the type of browser or device, in logs.

Why: for security and to find and fix faults.

2.7 Purchases

In the Android app you can buy coins. The payment is made through Google Play, which handles your payment details under its own policies. We do not receive your card or account details. We receive a confirmation of the purchase, with a purchase token, so that we can give you the coins; the game keeps the last few tokens in your saved game so that coins are never given twice, and they go with your saved game if you save your progress to an account. Our server also checks each purchase token with Google Play and records the token, the coin pack, the time and your random id, so that a purchase is paid only once and a faked purchase is refused. That record holds no email address; we keep it, also after you delete an account, for our accounts and to stop the same token being used twice.

2.8 What we do not collect

We do not ask for or collect your name, phone number, location, contacts, photos, camera or microphone, or payment details. Coins you buy are paid for through Google Play, which keeps your payment details. The Android app asks only to use the internet and to know whether you are online, to vibrate (for the vibration setting), to sell coins through Google Play (the billing permission) and, for ads, to use the Android advertising ID, plus a few technical permissions that Google's ad library adds.

3. Who we share it with

Only the services that make the game work: Google (AdMob and Google Play in the app, Google Fonts on the web), Cloudflare (delivering the website), the email delivery service for sign-in emails, and the host of our server. We do not sell your personal information and we do not share it with advertisers. We may disclose information if the law requires it, or to protect the game and its players.

Our server and our providers may process information in countries other than yours. Google and Cloudflare operate worldwide and use the transfer safeguards described in their own policies.

Where the EU or UK GDPR applies, we use the play statistics and server logs because we have a legitimate interest in running, securing and improving the game; we use your email address and saved game because you ask us to provide the sign-in and the saved copy; and Google uses ad information under its own policies.

4. How long we keep it

• On your device: until you remove the app or clear its data (on the web, your browser's site data).
• Your account and saved game: until you delete your account in the game or ask us to delete them (section 6).
• Sign-in links and codes: they work once and expire after 15 minutes.
• Play statistics: for as long as they help us improve the game, then we delete them or reduce them to totals.
• Server logs: for a short time, for security and fault finding.

5. Your choices and rights

• You can play without an account, and clear the game's data on your device whenever you like (Android: Settings, Apps, Gatecrash, Storage, Clear data).
• To sign out of your account on a device, use Settings, "Save my progress", "Log out". To delete your account, use Settings, "Save my progress", "Delete my account" (section 6).
• You can reset your advertising ID or turn off ad personalisation in your Android settings.
• In the European Economic Area and the United Kingdom the app shows Google's consent form before the first ad, and you can change your choice at any time in Settings, "Privacy choices". If you do not consent, the app does not request ads.
• Reminders are optional. If you say yes in the app, it schedules two notes on your own phone (your hearts are full; today's Daily Challenge is ready). They are created and shown by your phone, nothing is sent to or from our servers for them, and you can switch them off in your Android notification settings.
• You can ask us for a copy of what we hold about you, to correct it, to delete it, to restrict or stop our use of it, and to receive it in a portable form. Data protection laws such as the EU and UK GDPR and Kenya's Data Protection Act, 2019 give you these rights. Write to privacy@nggaminglabs.com and we will answer within 30 days.
• You can complain to a data protection authority: the Office of the Data Protection Commissioner in Kenya, the Information Commissioner's Office in the UK, or the authority where you live.

6. Delete your data

If you saved your progress to an account: in the game, open Settings, then "Save my progress", then "Delete my account", and confirm. We then delete, straight away, your email address, your saved game, every sign-in link and session, and the play statistics that carry the random id stored in your saved game. The record of coin purchases (token, pack, time, random id; no email address) stays, as section 2.7 says. The game on your device stays as it is (section 5 says how to clear it). These steps are also at nggaminglabs.com/delete-account.

If you cannot open the game, email privacy@nggaminglabs.com from the address you signed in with, with the subject Delete my Gatecrash data. We will delete the same things, and reply to confirm, within 30 days.

If you never saved your progress to an account: we hold no email address for you, and the play statistics carry only a random id that we cannot match to you. Remove the app or clear its data and the game's data on your device is gone.

7. Children

Gatecrash is not meant for children under 13, and we do not knowingly collect personal information from them. If you think a child has given us an email address, write to us and we will delete it.

If you are under 18, please ask a parent or guardian before you save your progress to an account.

8. Security

The game talks to our server over HTTPS, and the account data is kept on our own server. No online service is completely secure, so we cannot promise absolute security.

9. Changes to this policy

We may update this page. The date at the top shows the latest version. If a change matters, for example if we start collecting something new, we will say so in the game or on nggaminglabs.com before it takes effect.

10. Contact

Ngomma Value Added Services Limited, trading as NG Gaming Labs
privacy@nggaminglabs.com