Privacy Policy

Last updated 11 October 2026

This policy explains how Squishyology handles personal data in its games and its self-hosted analytics service, including GameAnalytics, Google Analytics for Firebase, and Firebase Crashlytics.

1. Who is responsible

Squishyology is the public name used by an individual developer based in France. I am the controller for the processing described in this policy in my own games.

Public name

Squishyology

Controller

Country

France

Privacy contact

privacy@squishyology.com

The analytics dashboard is for administration, not a player account service. If I host analytics for another developer, that developer’s policy explains their role and purposes.

2. Why data is processed

I use gameplay analytics to understand activity, progression, difficulty and retention, and diagnostic reports to identify and fix errors. The self-hosted service also processes technical information to protect its servers against abuse.

I do not sell player data or use this analytics pipeline for advertising or marketing lists.

Random installation identifiers and the events linked to them can be personal data even when I do not know your name. They are not necessarily anonymous.

3. Self-hosted analytics

The following describes the existing self-hosted implementation.

• Installation and session identifiers: a random ID stored in the game’s local save, reused for that installation, and a new random session ID for each play session. The installation ID is not an advertising identifier or hardware serial number.
• Gameplay events: event names, timestamps and gameplay properties such as level, score, difficulty, deaths, duration, tutorial progress and loadout; product ID and price for tracked purchases; and error messages when something fails.
• Technical information: app version and platform.
• Country: a country code derived from the request IP when the installation is first seen. This pipeline does not use GPS or precise coordinates.

The server processes IP addresses to derive that country code and rate-limit abuse. It does not store IP addresses in player, session or event records or in application logs. A rate-limit bucket can contain an IP address for about one hour. Hosting and proxy providers may separately record IP addresses in access or security logs.

These limits describe the self-hosted service only. Third-party SDKs have their own identifiers and processing, described below.

4. GameAnalytics

GameAnalytics helps measure sessions, progression and gameplay events. It receives event information and associated identifiers and technical details, such as platform, app/build and SDK versions. It processes the connection IP to derive country information.

Identifiers depend on the SDK and platform. For example, the current Unity SDK documents random IDs on Android and desktop, and an identifier for vendor (IDFV) on iOS by default. Advertising identifiers can also be collected when permissions and configuration allow.

For game analytics, GameAnalytics’ developer policy describes it as a processor acting on the developer’s instructions. Its group includes GameAnalytics ApS in Denmark and GameAnalytics Limited in the UK.

See GameAnalytics’ developer policy and privacy notice.

5. Google Analytics for Firebase

Google Analytics for Firebase measures app usage and events. Its SDK assigns an app-instance identifier and can collect Android advertising identifiers, approximate location derived from IP information, and purchase or subscription events containing product details and price. Collection depends on platform and settings.

Google Analytics is a separate Google service with separate terms; it is not covered solely by the Firebase processing terms. See Google’s Analytics data disclosure guide and collection controls.

6. Firebase Crashlytics

Firebase Crashlytics helps diagnose crashes and errors. Reports can include stack traces, timestamps, app version, operating system and device information, application state, and Crashlytics installation identifiers. Its dependencies also involve Firebase installation and session identifiers.

Custom logs, keys, non-fatal error reports or user IDs are included if added by the developer. When integrated with Analytics, reports can include breadcrumbs describing actions before a crash.

See Firebase’s privacy information and Firebase’s Android data disclosure guide.

7. Other information

If you contact me, I receive the information you send, including your email address and message, to respond and handle your request. Please avoid sending sensitive information that is not needed.

The self-hosted telemetry is not designed to collect names, email addresses, contacts, photographs, government IDs or payment card details. This does not exclude personal data in identifiers or diagnostics.

8. Legal bases and consent

In the EEA and UK, processing needs an applicable legal basis. Non-essential access to or storage of information on your device can also require prior consent under local rules, even where a GDPR legitimate interest exists.

• Optional analytics: consent where required, including non-exempt tracking. Self-hosting does not itself create an exemption.
• Crash diagnostics:
• Security and responding to enquiries: legitimate interests in protecting the service and answering requests, balanced against your rights; legal obligations where processing is required by law.

Where consent is required, collection must wait for your affirmative choice. You may withdraw consent at any time without affecting the lawfulness of earlier processing. Reading this policy or continuing to play does not by itself give consent.

9. Recipients and international processing

• Squishyology: I access the data to operate and improve the games and handle privacy requests.
• Hosting: Namecheap hosts the self-hosted service and database according to the existing policy.
• GameAnalytics: receives the data described in section 4, with its authorised service providers.
• Google: receives Analytics and Crashlytics data described above, with relevant affiliates and service providers.
• Legal disclosures: data may be disclosed when required by law or necessary to establish, exercise or defend legal claims.

Processing may take place outside France and the EEA, including in the United States. Firebase documents global processing for Crashlytics. A European operator or a self-hosted endpoint does not guarantee European-only processing.

10. Retention and deletion

• Self-hosted raw events: 90 days under the existing policy. Rate-limit buckets last about one hour.
• Self-hosted installation summaries and activity history: previously retained while the service operates.
• GameAnalytics: retention and availability vary by event type and product.
• Google Analytics: Standard properties offer 2 or 14 months for relevant event/user data; this setting does not govern standard aggregated reports.
• Crashlytics: Google documents 90 days for crash traces and associated identifiers before removal from live and backup systems begins; this is not a promise of immediate deletion on day 90.
• Support messages:

Deleting local game data or uninstalling does not automatically delete information already sent to servers. A reinstall may create new identifiers, but this depends on platform, backup restoration and SDK behaviour. Contact me to request deletion of identifiable records.

11. Your choices and rights

Contact privacy@squishyology.com for access or deletion requests and questions about collection. Include the game, platform and relevant identifiers if available. Do not send passwords or unnecessary identity documents.

Under the GDPR, subject to the relevant conditions, you may request access, correction, erasure, restriction and portability, object to processing based on legitimate interests, and withdraw consent. I may need proportionate information to verify a request or locate records. If records cannot be identified, I will explain the limitation rather than promise deletion by name alone.

I normally respond within one month. Where permitted, that period may be extended by two further months for complex or numerous requests, with notice and reasons within the first month. You can complain to the CNIL in France or your competent supervisory authority.

12. Security

The self-hosted analytics endpoint uses HTTPS and an access-controlled administration dashboard. No transmission or storage system can be guaranteed completely secure.

13. Children

Random identifiers and gameplay telemetry can still be children’s personal data. An age statement alone does not remove obligations under GDPR, children’s privacy laws or Google Play Families policies.

Where consent is the basis for an online service offered directly to children, the relevant national age threshold and parental-authorisation requirements apply. These thresholds are not a universal minimum age for every game. Parents or guardians can contact me with privacy concerns.

14. Website cookies and local storage

The self-hosted admin dashboard uses a login session cookie for its administrator. Native games and SDKs can store installation identifiers and event queues locally without using browser cookies. Web builds may use browser storage.

15. Changes and contact

I will update this policy when data practices change and provide additional notice or request fresh consent where required. The effective date will appear at the top.

Privacy enquiries: privacy@squishyology.com.