Privacy Policy – Cube Galaxy

Effective: 24 October 2026 · version 1.0

In short

The game does not ask for your name, e-mail or a login.
We send a random player ID, your nickname and your sector results to our server so the leaderboard works.
Statistics about how the game runs are sent only with your consent, and never from players under 16.
Ads are shown by Google AdMob. Personalised ads only for players aged 18+ who agree.
You can delete your account and all data on our server at any time in the game: Settings → Delete account and data.

1. Who is responsible

Miroslav Pecka, sole trader, Company ID (IČO) 71595295, registered address Na sypčině 648/12, 147 00 Praha 4 – Podolí, Czech Republic. We publish the game under the Pecka Interactive brand ("we").

Contact: support@peckainteractive.com (English or Czech). We have no data protection officer; one is not required.

2. Scope

The Cube Galaxy game for iOS and Android, its web version and the website peckainteractive.com.

3. What stays on your device only

your game progress (sectors, stars, credits, power-ups) and settings,
your year of birth – asked once at first launch to set up the game for your age; it is not sent to our server,
your consent choices,
the secret key the game uses to sign in to the leaderboard.

Deleting the app removes this data.

4. What we send to our server

4.1 Game and leaderboard – whenever the game is online

player ID – a random number the game gets when it first connects; it does not reveal who you are,
a fingerprint (hash) of the secret key (the server never knows the key itself),
your nickname, game version, platform (iOS, Android, web) and a flag showing whether the player is under 16,
results of sector attempts: sector, difficulty, result, stars, game time, power-ups used, game data version,
promotions (Pilot Class, rank) and, once at the first connection, your existing progress,
the time of your last connection (to delete inactive accounts, section 8),
whether and when you agreed to statistics (section 4.3).

Why: to run the leaderboard, calculate points and unlock sectors.

Legal basis:

players aged 16+: performance of a contract – the leaderboard is part of the game under our Terms of Use (Art. 6(1)(b) GDPR),
players under 16: our legitimate interest in running the game with a leaderboard for younger players too (Art. 6(1)(f) GDPR). We keep their data to a minimum: they build nicknames from offered words and we send no statistics from them.

You do not have to provide this data: the game can be played offline, just without the leaderboard.

Your nickname is publicly visible on the leaderboard. Do not use your real name or other personal data in it.

4.2 Protection against cheating

From the same data the server checks that results are plausible (for example that the sector was unlocked, that the stars match the conditions met, and that a win was not impossibly fast). Nicknames go through a filter of inappropriate words.

Why and legal basis: our legitimate interest in a fair leaderboard and in the security of the server (Art. 6(1)(f) GDPR).

Some steps are taken automatically by the server – see section 10.

device: type, screen size, language,
how the game runs: frames per second, errors and crashes,
gameplay: play time, reasons for defeats, tips, credits and purchases with credits, daily gift, ads watched.

Why: to fix bugs, tune difficulty and improve the game.

Legal basis: consent (Art. 6(1)(a) GDPR). You can withdraw it at any time in Settings. This does not affect playing or the leaderboard.

4.4 Purchases

Payments are processed by Apple (App Store) or Google (Google Play). We never see your payment details. The game verifies and delivers the purchase directly with Apple or Google. Our server receives only a purchase record (what, when and the store's transaction number).

Why and legal basis: to help you with a problem with a purchase (performance of a contract, Art. 6(1)(b) GDPR) and to keep an overview of sales (legitimate interest, Art. 6(1)(f) GDPR).

4.5 What we do not store

We do not store your IP address. The server keeps it briefly in memory to protect against overload. For the registration limit it stores only a fingerprint (hash) made with a key that changes every day.
We do not store your name, e-mail, phone number or location.

5. Ads (app only)

Ads are shown by Google AdMob. Google (Google Ireland Limited) acts as an independent controller of personal data under its own Privacy Policy. How Google uses data from apps is explained at policies.google.com/technologies/partner-sites.

18+: Google's consent window is shown and you choose what to allow.
With full consent you see personalised ads. On iPhone you also have to allow the system window "Allow tracking".
With consent to storage on the device only you see non-personalised ads (based on the app's content and approximate location). The device identifier is used only to limit how often an ad repeats and for aggregated reports.
Without consent you see limited ads: no personalisation and no device identifier. Google uses the IP address to deliver the ad and may store data only to detect fraud.
Ages 16–17: never personalised ads, and the "Allow tracking" window is not shown. In Google's window you can allow storage on the device (non-personalised ads); otherwise you see limited ads.
Under 16: neither Google's window nor "Allow tracking" is shown. We mark ad requests as coming from a child: Google turns off personalisation and remarketing, the device advertising identifier is not sent and ad content is suitable for children. Google still receives the IP address and technical data about the device and app to deliver the ad and to protect against fraud.
You can change your choices at any time in the game's Settings. You can remove ads completely by buying "No ads".

Legal basis: personalised and non-personalised ads – your consent (Art. 6(1)(a) GDPR); limited and child ads – our legitimate interest in funding a free game (Art. 6(1)(f) GDPR).

6. Who receives data

Hetzner Online GmbH (Germany) – runs our server and database in its data centre in Helsinki (Finland, EU). It processes data only on our instructions under a data processing agreement (Art. 28 GDPR).
Netlify, Inc. (USA) – hosts the web version of the game. When the page loads it processes your IP address and browser data. It is our processor under a data processing agreement; the transfer to the USA relies on the EU-U.S. Data Privacy Framework or, as a fallback, the EU Standard Contractual Clauses.
WEDOS Internet, a.s. (Czech Republic) – runs our mailbox; the data is stored in the Czech Republic.
Google – AdMob ads as an independent controller (section 5). Google is responsible for transfers outside the EU under its own policies.
Apple and Google – app stores and payments, as independent controllers under their own policies.
Authorities – only when the law requires it.

We do not sell your data.

7. Transfers outside the EU

Only data from the web version at Netlify and data processed by Google (sections 5 and 6) leave the EU (to the USA). Our server and database are in the EU.

8. How long we keep data

Account, nickname and result summary (points, best results per sector): until you delete the account, but no longer than 24 months after the game last connected to our server. Then we delete the account with all its data, so that abandoned accounts do not stay on the server. Your game progress stays on your device; when you come back, the game creates a new account and your leaderboard points start from zero.
Detailed records (events, sessions, sector attempts): 13 months, so we can compare the game a year back.
Backups: database 14 days, whole server 7 days. Deleted data therefore disappears from backups within 14 days at the latest.
Technical server logs (without IP addresses): 30 days.
E-mails: no longer than 2 years after your request is closed, so we can follow up on repeated questions and show how a request was handled.
Web version at Netlify: page-load records for the period set by Netlify.

9. Your rights

You have the right to access your data, to rectification and erasure, to restriction of processing and to data portability. You can withdraw consent at any time; this does not make processing before the withdrawal unlawful.

Deletion: in the game, Settings → Delete account and data (needs an internet connection). It deletes the player and all their data on our server.
Correcting your nickname: in the game, in the Pilot profile.
Other requests: write to support@peckainteractive.com. The game has no login, so we need to check that the account is yours: send us your full player ID from Settings (the "Contact support" button adds it to the e-mail for you). Do not share your player ID with anyone else. If you no longer have the game, you cannot send us the ID and we cannot link the account to you (Art. 11(2) GDPR); it is then deleted automatically after 24 months without connection.
Deadline: we reply within one month. In exceptional cases we may extend this by two further months; we will tell you in time and explain why.
Complaints: to the Czech Office for Personal Data Protection (uoou.gov.cz) or to the data protection authority in your country.

Right to object. You can object at any time to processing based on our legitimate interest (leaderboard for players under 16, protection against cheating, sales overview, limited and child ads) by writing to support@peckainteractive.com. We will then stop, unless we show compelling legitimate grounds that override your interests. The quickest way is to delete your account in the game.

10. Automated steps

Nickname filter: the server rejects a nickname with an inappropriate word.
Reported nickname: when 3 different players report a nickname, the server resets it to the default (e.g. Pilot-1234).
Implausible results: the server does not count them towards points. After 5 unresolved implausible results it hides the player from the leaderboard (they can keep playing and still see themselves on the leaderboard).

The game briefly tells you when your nickname was reset or you were hidden. Both steps can be reversed and have no legal or similarly significant effect on you (Art. 22 GDPR). If you disagree, write to us – a person will review it.

11. Children

The game is for everyone. At first launch we ask for the year of birth.

Under 16: no statistics, only child ads (section 5), nickname from offered words, no "Allow tracking" window.
Under 18: never personalised ads; real-money purchases are switched off and a parent can switch them on in Settings.
Parents can delete their child's data in the game or by writing to us.

Children under 13 in the USA (COPPA): from a child we collect only the player ID, a nickname built from offered words and game results. We use them only to run the game and the leaderboard, to calculate points, to protect against cheating and for security; ads are contextual only, without the advertising identifier. We do not use children's data for personalised advertising or profiling, and we do not sell or share it with anyone except the processors in section 6. We delete it according to the periods in section 8. A parent can review or delete the child's data via support@peckainteractive.com or in the game.

12. Security

Communication with the server is encrypted (HTTPS). The server is in the EU and only the operator has access. We store the player's secret key only as a fingerprint that cannot be reversed.

13. Website peckainteractive.com

The website uses no cookies and no analytics and keeps no access logs. The server processes your IP address only to deliver the page and does not store it.

14. Changes

We will announce significant changes in the game or on this website. The effective date and version are shown at the top.