Flappals privacy policy.
Flappals is a pixel-art arcade game by eyniq. This policy explains what happens with your photos, your name and your score.
LAST UPDATED:
In short
- No ads, no analytics, no crash reporting, no accounts or log-in screens.
- The photo you choose for your pal is analysed on your device and is never uploaded.
- If you enter the online top 10, your chosen name and score are stored online and shown to all players.
Who is responsible?
Nick Vanden Eynde, trading as eyniq, Wolvertemsesteenweg 30 bus 022, 1785 Merchtem, Belgium, company number BE 0743.620.608, is the controller of your personal data in Flappals.
Photos for your pal
When you pick a photo from your gallery (system photo picker) or take one with the camera (system camera app), Flappals analyses it on your device to detect a face, hair, glasses and similar features and to draw a 24x24 pixel-art pal. On Android this uses Google ML Kit (face detection and selfie segmentation, with the models bundled in the app). On iOS it uses Apple Vision.
The photo is not uploaded and not kept. Only the generated pixel-art pal and a short description of its parts (for example hair style and colours) are saved in the app storage on your device. Flappals never has access to your other photos: the system picker only hands over the photo you select. Legal basis: performing the service you request (Art. 6(1)(b) GDPR). Please only use photos of people who are fine with it.
Online top 10
When your score qualifies for the top 10, you can enter a name (letters A-Z and digits 0-9, up to 8 characters). Flappals then sends your name and score to Cloud Firestore (Google Firebase, region europe-west1, Belgium). To make this possible, Flappals signs in to Firebase Authentication anonymously, which creates a random user ID. Stored per entry: name, score, random user ID and a server timestamp. The top 10 (names and scores) is public to all players.
Please choose a name that does not identify you. Legal basis: our legitimate interest in running a fair, shared leaderboard (Art. 6(1)(f) GDPR) and performing the service you request (Art. 6(1)(b)). If a score cannot be sent right away, it is queued on your device and sent later.
Data on your device
Best score, the last name you used, your saved pals, the anonymous sign-in token and the queue of unsent scores are stored locally in the app storage. They are removed when you uninstall the app or clear its data. We do not receive them.
Technical data processed by Google
When Flappals connects to Firebase, Google processes technical data such as your IP address and a user-agent string to deliver the service and prevent abuse. On Android, Google ML Kit may collect diagnostics and usage metrics (for example device information, app package name and version, performance metrics and error codes) and per-installation identifiers that are not intended to uniquely identify you or your device, sent over HTTPS.
We do not use Firebase Analytics, Crashlytics, advertising identifiers or any third-party advertising or tracking SDK.
Who receives data
- Google (Firebase Authentication and Cloud Firestore, and ML Kit on Android) as our processor, under Google's data processing terms. Transfers outside the EEA rely on the EU-US Data Privacy Framework and standard contractual clauses.
- Apple Vision on iOS processes images on the device only; we receive nothing from it.
- Other players see the names and scores of the public top 10.
We do not sell your data and do not use it for advertising or profiling.
Retention
- Leaderboard entries (name, score, random user ID, timestamp) are kept for as long as the leaderboard exists, or until you ask us to remove them.
- Everything stored on your device stays until you delete the pals, clear the app data or uninstall the app.
Your rights
Under the GDPR you can ask us for access to, correction, erasure or restriction of your data, object to processing and request data portability. Because there are no accounts, we identify your entry by the name, score and approximate date you give us.
To have your leaderboard entry removed, email hallo@eyniq.com with the name and score as shown in the top 10 and the approximate date. We respond within one month. To report an inappropriate name, use the same address; we remove such entries.
You can also lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit, www.gegevensbeschermingsautoriteit.be).
Children
Flappals is designed for players aged 13 and older and is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has entered a name, contact us and we will remove it.
Security
Data is sent over encrypted connections (HTTPS). Leaderboard writes are limited by security rules: a name of 1-8 letters or digits, a score between 1 and 9999, entries tied to the signed-in anonymous user, and no edits or deletes by players.
Changes
We may update this policy, for example when the game changes. The date above shows the latest version.