Privacy policy

Last updated: 25 September 2026

This policy tells you which personal data the game Splatties uses, why, for how long, and what your rights are. This policy is available in English, Spanish, French, German and Italian. If the texts differ, the Spanish text applies.

Who is responsible

Aleix Cos, Spain
Email: hello@playsplatties.com

The data we use

Data	Where it comes from	Why
Account: an internal ID, your player name and its number (for example, Splatty#1234), whether you are a guest, the date you joined and the date you last played.	Made when you first open the game.	To give you an account and keep your progress.
Sign in with Apple or Google: only the user ID that Apple or Google gives us. We do not get or keep your email. With Google, we use your name one time only, to suggest a player name. We do not keep it separately.	Apple or Google, when you link your account.	To get your account back on a different phone.
Session: session tokens. On the server we keep only a hash of the refresh token.	The server, when you sign in.	To keep you signed in safely.
Matches and progress: match results (score, wins, painted tiles and other stats), the name each player had in the match, level, missions, seasons, items and cosmetics, and your coin and tint balance with its history.	Made when you play.	To operate the game: scores, match history, rewards and the shop.
Real-money purchases: the product you bought, the store's transaction and order IDs, the quantity of tint, the date, and whether the store refunded it. We do not get your card or payment details. Apple or Google handle the payment.	The App Store or Google Play, when you buy.	To give you what you bought, to stop duplicates and fraud, and to obey tax law.
Game use: events such as when you open the app, open a screen, look at or buy an item, equip it, or tap PLAY. With each event: the platform (iOS or Android), the app version and the time.	The app, while you play.	To learn what works and to make the game better.
Server logs: technical records with your internal ID, your player name, the room code and errors.	The server, while you play.	To find and repair errors, and to stop abuse.
Support messages: what you write, your email address, and the details that the app adds to the message: your player name and its number, your internal ID, the app version, the operating system and the phone model.	You, when you write to us.	To reply and to repair the problem.

What we do not do

We do not show ads, and we do not use advertising IDs.
We do not use analytics or tracking tools from other companies. Game-use data stays in our own database.
We do not keep your IP address. The server uses it for a short time, in memory, to limit abuse (for example, too many connections). Then the server forgets it.
We do not sell your data, and we do not give it to other persons.
There is no chat between players.

What other players see

In a match, the other players see your player name, the cosmetics you wear, your score and the emotes you send. They do not see the number of your name or your level. The match history of each player shows the names and scores of the other players in that match.

Legal basis

Contract (the terms of service): the account, matches, progress, session and purchases. The game cannot operate without this data.
Legitimate interest: security, abuse prevention and server logs, and game-use data to make the game better. You can object: write to us.
Legal obligation: purchase records, for the time that tax law tells us.

Who else is involved

Fly.io, Inc. hosts our servers and database in its Madrid region, as our processor.
Axiom, Inc. keeps our server logs for 30 days, as our processor.
Cloudflare, Inc. hosts this website and sends the emails for our address to our inbox, as our processor. To show you this website, Cloudflare uses your IP address. We do not use analytics on this website.
Google LLC (Gmail) holds our support inbox, as our processor.
Apple and Google also handle sign-in with their accounts, payments in their stores, and the backups of your phone. For this, they are independent controllers, under their own privacy policies.

Fly.io, Axiom, Cloudflare and Google are companies in the United States. When data goes out of the European Economic Area, the transfer has the protections of the GDPR: the EU-U.S. Data Privacy Framework or the standard contractual clauses of the European Commission.

How long we keep data

Account and game data: while the account exists.
A guest account that did not play for 180 days is deleted automatically, if it did not change its name, did not link Apple or Google, and did not buy with real money.
Session tokens expire: the access token after 15 minutes, the refresh token after 90 days.
Server logs: 30 days.
Support messages: for the time that we need to answer you.

When you delete your account

We delete your link to Apple or Google, your items, progress, level, missions, stats and game-use data. We set your balance to zero. Your name changes to "Deleted player", also in past matches.
We keep, without your name: an empty account record (the internal ID, the number and the dates), and the stats of your past matches, so that the match history of other players stays correct. Nobody can connect these records to you.
We keep the purchase and balance records, without your name, for the time that tax and commercial law tell us.

Your rights

You can ask for access to your data, correction, deletion, restriction and portability. You can also object to use that is based on legitimate interest. Write to hello@playsplatties.com. The easiest way is "Contact support" in the app. If you write from a different place, include your player name and its number (you see it in your Profile). We reply in one month or less.

You can delete your account yourself from Settings → Account → Delete account. If you do not have the game any more, follow the steps on the support page.

If you think that we did not use your data correctly, you can complain to the Spanish Data Protection Agency (www.aepd.es) or to the authority in your country.

Children

If you are younger than 14, you must have permission from a parent or guardian to use Splatties and to make purchases. If you are a parent or guardian and you think that a child younger than 14 gave us data without your permission, write to us. We will delete it.

Data on your phone

The app keeps your settings (for example volume, colorblind patterns and emotes), your player name, your internal ID and your session tokens on your phone. The session tokens are in the secure storage of the system: the Keychain on iOS, encrypted storage on Android.
The normal backup of your phone (iCloud or Google) can include your settings and your player name. On iOS, an encrypted backup can also include your session tokens.
On Android, the app also keeps an encrypted copy of your sign-in token in Google Block Store. With this copy, a guest can get the account back on a new phone.

The app and this website do not use cookies.

Changes to this policy

If we make an important change to this policy, we will tell you in the game. The date at the top shows the latest version.