Privacy policy

Last updated: 21 October 2026

This policy tells you which personal data the Splatties game uses, why, for how long, and what your rights are. This policy is available in English, Spanish, French, German, Italian, Portuguese (Brazil), Dutch, Swedish, Danish, Norwegian, Indonesian, Polish and Turkish. If the texts differ, the Spanish text applies.

The data we use

Data	Where it comes from	Why
Account: an internal ID, your player name and its number (for example, Splatty#1234), whether you are a guest, the date you joined and the date you last played.	Created when you first open the game.	To give you an account and keep your progress.
Sign in with Apple or Google: only the user ID that Apple or Google gives us. We do not get or keep your email. With Google, we use your name only once, to suggest a player name. We do not keep it separately.	Apple or Google, when you link your account.	To get your account back on a different phone.
Session: session tokens. On the server we keep only a hash of the refresh token.	The server, when you sign in.	To keep you signed in safely.
Matches and progress: match results (score, wins, painted tiles and other stats), the name each player had in the match, level, missions, seasons, items and cosmetics, and your coin and tint balance with its history.	Created when you play.	To operate the game: scores, match history, rewards and the shop.
Real-money purchases: the product you bought, the store's transaction and order IDs, the quantity of tint, the date, and whether the store refunded it. We do not get your card or payment details. Apple or Google handle the payment.	The App Store or Google Play, when you buy.	To give you what you bought, to prevent duplicates and fraud, and to comply with tax law.
Rewarded ads: if you choose to watch a video for a prize, we keep the kind of prize, the match it applies to (if any), the transaction ID that Google gives us, the date, whether we gave you the prize, and how much Google says the ad paid.	Google AdMob and the app, when you finish the video.	To give you the prize, to stop the same ad from paying twice, and to measure ad revenue.
Game use: events such as when you open the app, open a screen, look at or buy an item, equip it, or tap PLAY. With each event: the platform (iOS or Android), the app version and the time. Also how long you wait for a public match.	The app, while you play.	To learn what works and to make the game better.
Server logs: technical records with your internal ID, your player name, the room code and errors.	The server, while you play.	To find and fix errors, and to stop abuse.
Support messages: what you write, your email address, and the details that the app adds to the message: your player name and its number, your internal ID, the app version, the operating system and the phone model.	You, when you write to us.	To reply and to fix the problem.

What we do not do

There are no forced ads and no banners. There are only video ads that you choose to watch for a prize (see “Ads” below).
Apart from ads, we do not use analytics or tracking tools from other companies. Game-use data stays in our own database.
We do not keep your IP address. The server uses it for a short time, in memory, to limit abuse (for example, too many connections). Then the server forgets it.
We do not sell your data. We give it only to the companies in “Who else is involved”, for the reasons that we give there.
There is no chat between players.

What other players see

In a match, the other players see your player name, the cosmetics you wear, your score and the emotes you send. They do not see the number after your name or your level. The match history of each player shows the names and scores of the other players in that match.

You can watch a video ad to get a prize, for example free tint or double the coins of a match. Ads are optional: you never need them to play, and there are no forced ads or banners.

The ads come from Google AdMob (Google Ireland Limited in the European Economic Area; Google LLC in the rest of the world). To show and measure the ads, Google's software in the app collects data from your phone: the advertising ID (on iOS, only if you allow it), the IP address, the phone and system model, and what you do with the ad. Google uses this data as an independent controller, under its privacy policy. See also how Google uses data from apps.

When you choose to watch an ad, the app also gives Google your internal ID and the prize that you chose. Google sends them back to our server when the video ends, so that we know who gets the prize. Google does not get your player name.

Before the first ad, the app asks for your permission:

In the European Economic Area, the United Kingdom and Switzerland, with Google's consent form. If you do not consent, Google can show you only non-personalized or limited ads.
On iOS, with Apple's tracking question. If you say no, the app does not use your advertising ID.

Your answer does not change the game, only the ads you see. You can change it at any time:

Your consent to Google, in the app: Settings → Help → Ad privacy.
Tracking on iOS, in the iPhone settings: Privacy & Security → Tracking.
On Android, you can delete the advertising ID in your phone's privacy or ads settings.

Legal basis

Contract (the terms of service): the account, matches, progress, session, purchases, and the prizes of the ads you choose to watch. The game cannot operate without this data.
Legitimate interest: security, abuse prevention and server logs, and game-use data to make the game better. You can object: write to us.
Legal obligation: purchase records, for as long as tax law requires.
Consent: personalized ads and the use of the advertising ID. You can withdraw it at any time (see “Ads”).

Who else is involved

Fly.io, Inc. hosts our servers in its Frankfurt region (Germany), as our processor.
Neon, Inc. hosts our database on Amazon Web Services in Frankfurt (Germany), as our processor.
Axiom, Inc. keeps our server logs for 30 days, as our processor.
Cloudflare, Inc. hosts this website and forwards the emails sent to our address to our inbox, as our processor. To show you this website, Cloudflare uses your IP address. We count visits with Cloudflare Web Analytics: which pages people view, which site the visit comes from, the country and the type of device. It uses no cookies and does not follow you from site to site. We only see totals, never individual visitors.
Google LLC (Gmail) hosts our support inbox, as our processor.
Google AdMob serves the rewarded ads as an independent controller (see “Ads”).
Apple and Google also handle sign-in with their accounts, payments in their stores, and the backups of your phone. For this, they are independent controllers, under their own privacy policies.

Fly.io, Neon, Axiom, Cloudflare and Google are companies in the United States. When data goes out of the European Economic Area, the transfer has the protections of the GDPR: the EU-U.S. Data Privacy Framework or the standard contractual clauses of the European Commission.

How long we keep data

Account and game data: while the account exists.
A guest account that has not played for 180 days is deleted automatically, if it has not changed its name, has not linked Apple or Google, and has not bought anything with real money.
Session tokens expire: the access token after 15 minutes, the refresh token after 90 days.
Server logs: 30 days.
Support messages: for as long as we need to answer you.

When you delete your account

We delete your link to Apple or Google, your items, progress, level, missions, stats and game-use data. We set your balance to zero. Your name changes to "Deleted player", in past matches too.
We keep, without your name: an empty account record (the internal ID, the number and the dates), and the stats of your past matches, so that the match history of other players stays correct. Nobody can connect these records to you.
We keep the purchase and balance records, without your name, for as long as tax and commercial law require.
We keep the records of ad prizes, without your name, to stop the same ad from paying twice.

Your rights

You can ask for access to your data, and for its correction, deletion, restriction and portability. You can also object to the use of your data based on legitimate interest. Write to hello@playsplatties.com. The easiest way is "Contact support" in the app. If you write to us in a different way, include your player name and its number (you can find it in your Profile). We reply in one month or less.

You can delete your account yourself from Settings → Account → Delete account. If you do not have the game anymore, follow the steps on the support page.

If you think that we did not use your data correctly, you can complain to the Spanish Data Protection Agency (www.aepd.es) or to the authority in your country.

Children

If you are younger than 14, you must have permission from a parent or guardian to use Splatties and to make purchases. If you are a parent or guardian and you think that a child younger than 14 gave us data without your permission, write to us. We will delete it.

Data on your phone

The app keeps your settings (for example volume, colorblind patterns and emotes), your player name, your internal ID and your session tokens on your phone. The session tokens are in the secure storage of the system: the Keychain on iOS, encrypted storage on Android.
The normal backup of your phone (iCloud or Google) can include your settings and your player name. On iOS, an encrypted backup can also include your session tokens.
On Android, the app also keeps an encrypted copy of your sign-in token in Google Block Store. With this copy, a guest can get the account back on a new phone.

This website does not use cookies. The app does not either, but Google's ad software uses your phone's advertising ID (see “Ads”).

Changes to this policy

If we make an important change to this policy, we will tell you in the game. The date at the top shows the latest version.

Who is responsible and how to contact us

Aleix Cos, Spain. Email: hello@playsplatties.com.