Privacy Policy

Effective date: April 18, 2026 · Last updated: June 26, 2026

1. Who This Covers

This privacy policy applies to all mobile games published by Wibboli ("we", "us", "our") — an independent mobile game studio — on the Apple App Store and Google Play Store, including but not limited to:

Orbitap, TypeSurge, Void Flip, Flingwall, SnapLane, DotBlitz, Riftdash, WarpTap, GripFall, DriftDodge, ShardRun, BladeHop, TwinDrop, and any future games we release.

2. What We Collect — and What We Don't

We do NOT collect:

• Your name or phone number
• Your physical location (GPS/precise location)
• Photos, contacts, calendar, microphone, camera, or any other personal files
• Financial information or health data
• Free-form messages or chat — our optional leaderboard "challenges" and community emotes use only a fixed set of preset messages we provide; you can never type your own text to another player
• Your web browsing activity

We DO collect (anonymously):

The items above are anonymous — associated with a random UUID generated on your device, not with your identity. If you choose to create a Wibboli account (Section 4), some data is then linked to that optional account; everything else stays anonymous, and we never attempt to reverse-identify users.

3. Leaderboards (Games That Have Them)

Some of our games include an optional country and global leaderboard. If you play a game with leaderboards enabled, the following applies:

What's collected and shown publicly:

• Your best score — submitted to our server after a run
• A display name — auto-generated by default (e.g., "SwiftFalcon42"). You may optionally choose your own name; please don't use your real name or other personal information. Custom names are filtered, and other players can report inappropriate names.
• Your country — country-level only (shown as a flag), derived server-side from your IP address; the IP itself is not stored

These three things are visible to other players on the in-game leaderboard. Nothing else about you is shown. Your entry stays linked to the same anonymous device UUID described above — never to your identity.

Your controls:

• Delete your entry any time in-game: Leaderboard → tap your name → "Remove my scores from the leaderboard". This permanently deletes your scores and name from our server.
• Rename or re-roll your display name any time from the same screen.
• Report or block another player's name via a long-press on their row. Reported names are reviewed and reset. Blocking a player also stops any challenges from them.
• Turn off challenges — if you'd rather not receive challenges, switch them off from the challenge screen.

Challenges (games that have them):

Some leaderboard games let you send another player a "challenge." This is not free-form messaging: you pick from a fixed set of preset messages we wrote (e.g. "Can you beat me?") — you can never type your own text. When you send one, the only things transmitted are the preset message's identifier, your leaderboard display name, and your best score, shown to the recipient the next time they open the game. It stays linked to the anonymous device UUID, never to your identity. You can turn challenges off, and block or report any sender, at any time.

Leaderboard entries are retained until you delete them (unlike analytics events, which auto-delete after 7 days) — a leaderboard wouldn't work otherwise. You can also request deletion by email (see Contact below) — include your in-game display name and game.

4. Accounts & the Wibboli Community

You can play every Wibboli game without an account. If you want, you can create a free Wibboli account — a single profile that carries your coins, cosmetics, and progress across our games and across your own devices, and lets you connect with other players. It's entirely optional and you can delete it at any time (see Your Rights below).

How sign-in works:

• Email (optional): If you choose to sign in with email, we send a one-tap "magic link" to verify it — there's no password. We use your email only to send you that sign-in link and, if you opt in, account-related notifications. We never send you marketing email and never sell or rent your address. To deliver the link we pass your email to Brevo, our transactional email provider (see Third Parties below).
• No-email backup code: You can skip email entirely. We generate a one-time backup code you save yourself; it restores your account without us ever holding an email address for you.

What an account stores:

This is all first-party. Your account, email, coins, friends, and saves live on our own servers (EU-hosted). We do not share any of it with advertisers, analytics networks, or data brokers, and we never use it to track you across other apps or companies. The only third parties involved are our email provider (Brevo, for the sign-in link only) and our infrastructure host (see Third Parties below).

5. Advertising (Google AdMob)

We display ads in our games to support their development. Ads are served by Google AdMob, a third-party advertising network operated by Google LLC.

What AdMob collects:

• Your device's advertising identifier (Advertising ID on Android, IDFA on iOS) — a resettable ID your device provides for ad measurement
• Ad interaction data (which ads you saw, which you clicked)
• Device type, OS, language, general region

How this is used:

• To show you more relevant ads (personalized advertising)
• To measure ad performance and prevent ad fraud
• To enforce frequency caps (so you don't see the same ad too often)

This activity qualifies as "tracking" under Apple's App Tracking Transparency (ATT) framework. On iOS, you'll see a system prompt asking permission to track. You can decline and we will not share your IDFA with AdMob; you'll see non-personalized ads instead. In the EEA, UK, and Switzerland, you'll also see a consent prompt (Google's certified consent message) before personalized ads are shown.

AdMob's data practices are governed by Google's Privacy Policy and AdMob's disclosure about how it uses data.

6. Data Shared With Third Parties

We share data with the following third parties only as strictly necessary for our games to function:

If you sign in by email, we use Brevo (Sendinblue) solely to send your sign-in link and any account notices you opt into. We do not run marketing campaigns through it, and Brevo does not use your address for its own purposes. If you use the no-email backup code instead, no email address is shared with anyone.

We do not sell your data. We never share data for purposes unrelated to operating or improving our games. We don't have any data-broker relationships.

7. How to Opt Out

Opt out of our analytics:

Every Wibboli game has a "Send usage data" toggle in its settings or collection screen. Turn it off, and no analytics events will be sent from your device. Your existing local game data remains.

Opt out of personalized ads:

• iOS: Settings → Privacy & Security → Tracking → "Allow Apps to Request to Track" off — or decline the App Tracking prompt on first launch. You'll still see ads, but they will be non-personalized.
• Android: Settings → Privacy → Ads → "Delete advertising ID" or "Opt out of Ads Personalization." Same effect — ads will be non-personalized.

8. Data Retention

Anonymous analytics events we receive are automatically deleted from our servers after 7 days (via database TTL index — a hard technical limit, not a policy promise we might forget). We do not maintain long-term logs of individual device activity.

Exception — leaderboard entries (best score + display name + country code) are retained until you delete them in-game or by email request, since a leaderboard requires persistent scores to function.

Account data (account ID, optional email, coins, nickname, friends, cloud saves, push token) is retained for as long as your Wibboli account exists. When you delete your account — in-app or at wibboli.netlify.app/community/delete — this data is permanently removed from our servers. If you sign in by email, the email address is stored only while your account exists and is deleted with it.

Aggregate statistics (e.g., "X unique devices this week") may be retained longer, but cannot be traced back to any individual user.

Data stored on your device (game progress, settings, high scores) remains on your device until you uninstall the game.

9. Security

All data transmission between our games and our servers uses HTTPS encryption (TLS 1.2+). Our backend is hosted on industry-standard cloud infrastructure with access restricted to the developer via authenticated credentials. We follow industry best practices for secure development, including no plaintext secrets in client code.

10. International Data Transfers

Our servers are hosted in the European Union (Frankfurt region). If you're in a country outside the EU (including the United States, United Kingdom, Canada, and Australia), data may be transferred there for processing. We rely on AdMob's own international data transfer mechanisms for ad-related data, which Google maintains under applicable data protection laws.

11. Your Rights

If you only play our games without an account, we hold no information that identifies you, so most data-protection rights have little to act on. If you create a Wibboli account, you have the full set of rights below, which we honor for everyone:

• Delete your account — at any time, two ways: (1) in-app — Profile/Settings → "Delete account", which permanently erases your account, email, coins, nickname, friends, saves, and push token from our servers; or (2) on the web at wibboli.netlify.app/community/delete, with no need to reinstall the game.
• Delete a leaderboard entry — in-game: Leaderboard → tap your name → "Remove my scores from the leaderboard" (this is separate from full account deletion and also works if you have no account).
• Opt out of analytics — use the in-game "Send usage data" toggle, or device-level ad settings (see the Advertising and Opt Out sections).
• Withdraw consent — you can withdraw consent for any optional data (email notifications, push, analytics) at any time without losing access to the games. Withdrawing consent doesn't affect processing already carried out.
• Right to object (GDPR/UK) — email us (Contact section) to stop processing data associated with your device or account, and we'll honor it.
• Right to know / access & portability — email us and we'll tell you what data is tied to your device or account, and provide a copy, within 30 days.
• Request deletion by email — if you'd rather not use the in-app or web option, email us (Contact section) with your account email or in-game nickname and we'll delete your data.

Legal basis for processing (GDPR / UK):

Our legal basis for anonymous analytics is legitimate interest (maintaining and improving our games). For optional account data — including email used for sign-in — our legal basis is your consent and the performance of providing the account service you requested; you can withdraw consent and delete the account at any time.

California / CCPA:

We do not sell personal information. We do not share personal information for cross-context behavioral advertising in a way that would constitute a "sale" under CCPA. The Advertising ID is a third-party identifier managed by Apple/Google, not by us directly; you can reset it in your device settings at any time.

12. Children's Privacy (COPPA)

Our games are rated for general audiences (ages 13+) and are not directed at children under 13, and we do not knowingly collect personal information from children under 13. Creating a Wibboli account requires confirming you are 13 or older; if you indicate you are under 13, account creation is blocked and no email is collected. If you are a parent or guardian and believe your child has created an account or otherwise provided us personal information, please contact us and we will delete it.

Where required by law (including the EU, UK, and certain US states), minimum age requirements for consent to data processing are observed via Apple and Google's account-level parental controls.

13. Changes to This Policy

We may update this policy when we add features, use new services, or when laws change. Material changes will be reflected in the "Last updated" date above. We encourage you to check this page occasionally. Continued use of our games after an update constitutes acceptance of the revised policy.

14. Contact

Questions, requests, complaints, or anything else? Reach us at wavetinker400@gmail.com.

We read every email. Response within 5 business days, usually much faster.