Privacy Policy

Bubble Tower (web, Android and iOS app) · Effective 26 October 2026

Who we are

Bubble Tower is published by Creative Coders sp. z o.o., ul. Płk. Zoltána Baló 6 lok. 5, 02-793 Warszawa, Poland (KRS 0001271368, NIP 9512657914), the controller of the personal data described here. Contact: support@quorumwork.com.

The short version

• No accounts, no sign-up, no analytics of our own.
• The mobile app can show optional reward videos and a short ad between some runs, served by Google AdMob when Google's consent platform permits ad requests. Eligible purchases or Remove Ads disable ads between runs.
• The game works offline. The global leaderboard and its reporting/moderation tools talk to our server.
• Coin packs, Double Coins and Remove Ads are sold through Google Play or the Apple App Store. We never see your payment details.

What we process and why

• Leaderboard data — a random player ID created by the app, a secret key (we store only its hash), your leaderboard name (a random “Bubbler1234” name until you change it), a two-letter country code taken from your device language settings, and your scores with basic run statistics (height, number of bubbles, duration, perfect placements). Purpose: running the public leaderboard you take part in (Art. 6(1)(b) GDPR). Your name, country flag and best scores are visible to other players.
• Safety reports — when you report a leaderboard player, we store the reported player's public random identifier and name, your selected reason, the time, a hashed reporter identifier and moderation status. There is no free-text field, and reports are not public. The app sends its local player ID and secret to authenticate the request; raw secrets are not stored in reports. Purpose: investigating abuse and protecting players (Art. 6(1)(f) GDPR). Moderators can remove a reported profile. A hash of that profile's internal identifier temporarily prevents it from reappearing.
• Technical connection data — your IP address and basic request information, processed by our hosting provider to deliver the service and protect it from abuse (Art. 6(1)(f) GDPR). Kept in short-lived server logs and briefly in memory for rate limiting.
• Purchases — handled by Google Play or the Apple App Store. The app checks your purchases on your device to deliver coins, Double Coins and Remove Ads; purchase information is not sent to our server.

Ads (Google AdMob)

The mobile app shows reward videos that you choose to watch (to continue a run, double the coins of a run or get a free daily boost), and occasionally an ad between runs: never during play, never before your third run, at most once every 3 runs and 3 minutes, and never for players who bought anything or have Remove Ads. Ads are provided by Google AdMob.

• Before enabling ads, the app asks Google’s User Messaging Platform (UMP) for your current consent status and presents a form where required, for example in the EEA, the UK and Switzerland. We request ads only if that updated status permits it. Refusing consent, an unavailable form or a failed consent check can leave ads unavailable.
• iOS: all ad requests are non-personalised. The app does not request Apple’s App Tracking Transparency (ATT) permission or access to the IDFA advertising identifier. Google can still process the other information described below.
• Android: ad personalisation follows your Google consent choices. Google may use the Android advertising ID when available; you can reset or delete it in your phone’s settings. Ads are requested only when UMP permits them.
• Google’s advertising and consent SDKs may process IP-derived approximate location, app- or vendor-scoped device identifiers, ad views and interactions, crash reports, and performance diagnostics for advertising, measurement, consent management and fraud prevention. Non-personalised ads still involve data processing.
• Open Settings → Ad privacy choices to revisit choices where Google makes the form available, including after a purchase. The app checks the current requirement, refreshes consent after the form closes and discards its previously loaded ads before requesting replacements.

More: How Google uses information from apps that use its services, Google Privacy Policy and Google Mobile Ads SDK data disclosure.

Stored on your device

The app keeps your coins, unlocked skins, boosts, best score, settings, player ID and secret key on your device. Hidden leaderboard players are also stored locally by public identifier and display name; use Settings → Hidden players to show them again. The hidden-player list is not sent to our server. Clearing the app’s data or uninstalling it removes local data, unless your operating system restores it from your own device backup (if you have backups turned on). Active non-consumable purchases can be restored through the store used to buy them. Consumable coins are stored locally and are not restored after deletion.

How long we keep it

Leaderboard entries are kept for as long as the leaderboard exists. You can delete yours at any time in Settings → Remove me from the leaderboard, or by writing to us with your leaderboard name.

Open safety reports are retained until reviewed; the queue has a fixed capacity. Resolved reports are removed after 30 days by periodic cleanup. A minimal hashed identifier used to prevent a moderated profile from returning expires after 90 days; it contains no nickname or raw secret and can remain after leaderboard deletion for abuse prevention. Contact us about report-related access or deletion requests. Reporting and hiding are separate: hiding takes effect on your device immediately, while a report needs an internet connection and successful confirmation.

Who processes data for us

• Render Services, Inc. — hosting, servers in Frankfurt, Germany (EU).
• Apple — App Store distribution and in-app purchases on iOS, under Apple’s privacy policy.
• Google — Google Play distribution and billing, and AdMob ads with its consent platform, under Google’s own privacy policy.

We do not sell the leaderboard or safety-report data we hold. Google’s processing and advertising partners are described in its privacy information linked above.

Children

Bubble Tower is intended for teenagers and adults and is not directed at children under 13.

Your rights

You have the right to access, rectify, erase or restrict the processing of your data, to object to it and to data portability. Write to support@quorumwork.com with any request. You may also lodge a complaint with the Polish supervisory authority, Prezes Urzędu Ochrony Danych Osobowych (uodo.gov.pl), or the authority in your country.

Changes

If this policy changes, the new version will be published at this address with a new effective date.