Privacy Policy

Information we handle

Age and privacy bracket

BubblePop asks for a date of birth through a neutral age screen. The date is evaluated only on your device and is immediately reduced to one of three brackets: child (under 13), teen (13–17) or adult (18 or older). BubblePop stores only the resulting bracket, the age-screen version and the date on which the check took place. The entered date of birth is not saved or sent to us. The check is repeated approximately once a year.

In versions that support Google Play age and approval checks, Google Play may also provide an age range and app-approval status. BubblePop reduces the range to a broad privacy restriction for the current session. Raw age bounds and installation identifiers from this check are not saved or sent to our statistics or advertising services. A younger age range can make privacy treatment more restrictive; it cannot enable adult advertising. Where Play requires verification or parental approval, access is paused until that requirement is resolved. App or purchase approval through Google Play is separate from permission for advertising-related data processing.

Local game data

BubblePop stores information on your device so your game can continue between sessions. This may include settings, tutorial progress, selected mode and World, scores, XP and level, BubbleCoins, Rare Bubble inventory and loadout, challenges, daily streak information, achievement statistics and recent reward records used to prevent duplicate grants.

The game-save system does not upload your gameplay progress to BubblePop Games. Android backup is enabled, so Google may back up and restore eligible app data according to your Android device and Google Account settings.

Local notifications

If you enable reminders, BubblePop asks Android for notification permission and schedules reward-ready or streak reminders on your device. BubblePop does not currently register a remote push token or use Firebase Cloud Messaging. You can disable reminders in BubblePop or in Android settings.

Messages you send us

If you contact support, we receive the email address, name and message information you choose to provide. We use it only to respond, investigate problems, protect the game and meet legal obligations. Please do not send passwords, payment-card details or unnecessary personal information.

External services

BubblePop uses Google Play for optional purchases and our purchase-verification service to validate receipts and deliver purchases. Advertising uses Google AdMob, subject to the age and privacy controls described below. Gameplay statistics and optional Firebase analytics are described separately below. These services do not provide a cloud copy of your game save. Some features may be unavailable in particular versions of the game.

Google AdMob and consent

For players with a current adult (18+) classification, BubblePop uses Google AdMob for an optional rewarded Second Chance and interstitial adverts at natural post-match breaks. Google's advertising services may process IP address and approximate location, advert views and interactions, diagnostics, performance information and device or account identifiers, subject to consent, device and age-treatment settings.

BubblePop does not initialise its advertising service or request adverts for children, teenagers, or players whose age group is unknown or needs to be checked again. Adverts can start only after a current adult classification and any required Google privacy flow. Adults may receive personalised adverts where permitted by their privacy choices and applicable rules. Where Google requires an advertising privacy-options entry point, you can open Ad Privacy Choices in Settings to review or change your choices. Depending on those choices and ad availability, Google may provide personalised, non-personalised or limited adverts, or no advert. Watching a rewarded advert is voluntary; no reward is granted if the advert fails or is not completed. Read Google's privacy policy and the Google Mobile Ads data disclosure.

Google Play purchases

In billing-enabled builds, fixed BubbleCoin packs and the one-time Remove Ads product use Google Play Billing. Google handles complete payment-card and bank details; BubblePop Games does not receive them. Purchase identifiers, product details, purchase state and entitlement information are processed to verify and deliver purchases, recover interrupted delivery and restore verified ad removal.

Purchase verification — Cloudflare and Google Play

Billing-enabled builds create a signing key on your device. Its private part stays in Android Keystore. A fingerprint of its public part is used as a pseudonymous installation identifier and passed to Google Play when starting a purchase. It is not your name, email address, advertising ID or date of birth.

To check or restore a purchase, BubblePop sends our Cloudflare-hosted service the Google purchase token, product identifier, public key, installation fingerprint, request time, unique request value and signature over HTTPS. The service checks the token with Google Play, including purchase, acknowledgement and consumption status and, for original delivery, the purchase's installation identifier. No player login or general gameplay history is sent to this service.

Our receipt database stores a cryptographic fingerprint of the purchase token, a receipt ID, installation identifier, product, test/real purchase classification, reward allocation and creation time to prevent duplicate delivery. The database does not store the raw purchase token or public signing key. Raw tokens and request proofs are processed during verification. Cloudflare also processes network information such as IP address, request time and HTTP metadata to deliver and protect the service. See Cloudflare's privacy policy and Google's privacy policy.

This is not a backup of your coins or progress. Clearing app data or uninstalling may lose local progress and delivered coins, including purchased coins. Verified ad removal can be restored through the Google Play account that owns it; restoration does not award another purchase gift.

Optional combined game statistics

In supported builds, Share Combined Game Statistics in Settings lets you help improve BubblePop. From the default-on statistics update, it starts on in the UK and US unless you previously turned it off. A notice in the game explains this. You can turn it off in Settings at any time, with no effect on gameplay or rewards. Earlier builds require opt-in. In other supported regions it remains off until an adult enables it. Availability is checked using the country of the network connection. Younger players can use this feature in the UK and US; elsewhere it is currently limited to players classified as adults. This availability check is not a report of your location or proof of age.

The game combines counts and totals in memory before sending them to our Cloudflare-hosted reporting service. These cover mode starts and finishes, play time, scores, gameplay XP, replays, Rare Bubble use, levels gained in broad bands, challenge completions by category and milestone reward claims. The service stores combined daily totals rather than individual gameplay histories. These statistics are used only to understand and improve the game, not to advertise to you or make decisions about an individual player. For the UK default-on service, we rely on the statistical-purposes exception and our legitimate interests in improving the game for any personal information necessarily processed during delivery and aggregation. You can object simply by switching this feature off.

The totals contain no player ID, Firebase ID, billing identity, name, email, birth date or saved-game copy. Cloudflare processes network information, including IP addresses, to deliver requests, determine regional availability and limit abuse. Our reporting database does not store IP addresses or country. Request logging is disabled for this service; Cloudflare may separately process operational information under its service terms.

You or your parent can turn sharing off in Settings at any time. This clears unsent totals. Already combined statistics cannot be located using your identity. The local sharing preference is stored separately from your progress. This feature is independent of Google Analytics below. Read Cloudflare's privacy policy.

Optional Google Analytics for Firebase

In analytics-enabled builds, players classified as 18 or older can opt in through Share Gameplay Analytics in Settings. It is off by default. Declining does not affect gameplay or rewards. Collection stays off for children, teenagers and players with an unknown or expired age classification.

With your consent, we use Google Analytics for Firebase to understand play and improve the game. Events may include modes and Worlds played, sessions, round duration, scores, XP and levels, challenges, milestone rewards, streaks, coins earned or spent, Rare Bubble use, and interactions with the Shop, purchases and adverts when those features are available.

Google processes an app-instance identifier, app and device information, session activity and approximate location derived from network information. Its SDK may also record purchase events such as product and price when purchases are enabled. This is not anonymous data, but we do not send your name, email, entered birth date, purchase-verification tokens or a full game-save copy as analytics parameters. Advertising-ID collection and advertising personalization are disabled for this analytics integration.

You can withdraw consent at any time using the same Settings control. This stops further collection and resets analytics data stored locally; it does not erase information already received by Google. Analytics uses encrypted connections. Read Google's privacy policy and Google's Analytics SDK data disclosure.

Children and families

BubblePop is a mixed-audience casual game intended for players aged 9 and above. Children can play without creating an account or providing a name, email address, precise location, photograph, voice recording or contact list. The date entered into the age screen is not retained.

Children, teenagers and players whose age group is unknown receive no adverts. The Watch Ad revive and Remove Ads purchase offers are hidden for these players. This does not remove the normal game modes or earned Rare Bubble power-ups. Purchases use Google Play's purchase interface, where family approval and authentication settings may apply. Parents and guardians can manage these controls through Google Play.

Parents or guardians can use the contact details in this policy to request a review or deletion of their child's personal information, or to refuse further collection or use. Tell us which feature or interaction the request concerns; do not send passwords, payment-card details or purchase tokens. We may need proportionate information to verify parental authority and locate a record before disclosing or deleting it. We also take account of the child's own rights and ability to exercise them. We explain any lawful limits that apply to a request.

A parent can turn off combined game statistics in Settings. Google Analytics is unavailable to children and teenagers. Clearing local game data is separate from requesting deletion of information held by us or a service provider, and may erase progress and purchased coins. Already combined statistics cannot be separated into an individual child's contribution.

How information is used and shared

Information is used to operate and secure BubblePop, apply age-appropriate privacy settings, provide requested support and, when the relevant features are enabled, deliver adverts, purchases or verified rewards and analyse gameplay as described above, with consent where required. Limited information may be shared with the named service providers, professional advisers or authorities when necessary to provide those functions or comply with law.

Some disclosures to advertising partners for personalised advertising may be considered a "sale" or "sharing" of personal information under US state privacy laws. Eligible players can use Ad Privacy Choices in Settings to opt out. BubblePop does not request adverts or send ad requests to AdMob for children, teenagers or players whose age group is unknown.

Google and Cloudflare may process information outside your country, including in the United States. Where they process personal information on our behalf, their data-processing terms describe their duties and international-transfer safeguards. Depending on the transfer, these include recognised adequacy arrangements such as the applicable Data Privacy Framework, or standard contractual clauses with UK protections where required. See Google's data-processing terms and Cloudflare's data-processing addendum. You can contact us for more information about applicable safeguards. Google also processes information for its own purposes when providing Google Play and advertising services, as explained in its privacy policy. Network communication for enabled online services uses HTTPS encryption in transit. No security measure can guarantee absolute protection.

Why we may use personal information

Where UK or European data protection law applies, the reason depends on the feature and purpose. These reasons do not replace consent required by separate rules about device storage, advertising or children's information.

• Providing a purchase: processing needed to deliver an agreed purchase and resolve delivery problems is necessary to perform that purchase agreement.
• Security and support: we rely on legitimate interests to protect the game, prevent duplicate or fraudulent claims and answer ordinary support enquiries, where those interests are not overridden by your rights, especially children's rights. Support needed to fulfil a purchase also relates to that agreement.
• Optional analytics and advertising choices: optional Google Analytics uses your consent. We obtain consent for personalised advertising and device access where required, using the choices described above.
• Combined game statistics: the regional choices and the UK statistical-purpose and legitimate-interest basis are explained in the combined-statistics section. This does not enable personalised analytics for children.
• Legal duties: we process information when necessary to comply with an applicable legal obligation, including responding to valid privacy-rights requests.

You can withdraw consent using the relevant Settings control. Withdrawal does not affect the lawfulness of processing before withdrawal. You can object to processing based on legitimate interests by contacting us; combined statistics can also be switched off directly in Settings.

Retention and deletion

Combined game statistics use a rolling 30-day reporting window. Older daily totals are removed by daily scheduled cleanup, normally within 32 days of collection. Cloudflare's short-lived database recovery copies may retain deleted totals for up to a further seven days. Unsent statistics are kept only in memory and disappear when the app closes or sharing is turned off.

Analytics event data is set to a two-month retention period and user data to 14 months. New activity resets the user-data period. Google processes expiry through its scheduled deletion cycle; aggregated reports can remain available longer. Turning analytics off does not delete those existing reports.

Local game data remains on your device until you clear BubblePop's storage or uninstall the game. Eligible data may be restored by Android backup if that feature is enabled in your Google Account. You can turn off BubblePop reminders at any time.

Support messages are retained only while reasonably needed to answer the request, investigate related problems, protect against abuse or meet legal obligations. They are normally deleted or anonymised within 24 months after the matter is closed, unless a longer period is required by law or an ongoing dispute. Where we use a child's contact information only to answer a one-off request under the applicable children's privacy exception, we delete it after answering instead of applying this general support period.

Purchase-verification records are kept while needed to deliver purchases, recover interrupted delivery, prevent duplicate rewards, and investigate purchase problems or fraud. This applies to both live and test purchases. Once delivery is confirmed complete, records become eligible for deletion after 90 days and are checked by a daily cleanup process. Interrupted or unconfirmed deliveries are reviewed at 90 days and then monthly, and retained only while needed to resolve delivery or a documented dispute. Older records without a completion confirmation need this review too. Clearing the app's data does not delete these server records or Google's own purchase records. We do not keep remote gameplay saves.

Cloudflare's database recovery history can retain deleted purchase records for up to a further seven days on our current Free plan. Recovery copies are used for recovery, not normal purchase processing. If we restore a database, we review and reapply valid deletion requests.

Contact support to request access, correction or deletion of information we hold. We may need information to identify the relevant purchase and verify your request. Do not email raw purchase tokens, signing keys or payment-card details. Records still needed for an unresolved purchase, security investigation or legal obligation may need to be retained. Google and Cloudflare manage their own service records under their applicable policies.

Your privacy rights

Depending on where you live, you may have rights to request access, correction, deletion, restriction or portability of your personal information, to object to certain uses, or to withdraw consent. Contact us to exercise a right. We may need enough information to locate the relevant record and verify the request.

UK users may also complain to the Information Commissioner's Office. If you are in the European Economic Area, you may complain to your local data protection authority; the European Data Protection Board lists those authorities.

Where applicable US state law grants these rights, you may also opt out of sale, sharing or targeted advertising, use an authorised agent, and appeal a refused request. Use Ad Privacy Choices for available advertising choices, or contact the email below for a request or appeal. We may verify the request and an agent's authority. We do not discriminate against you for exercising an applicable privacy right.

Changes to this policy

We may update this policy when BubblePop's features, providers or legal duties change. We will change the effective date and provide additional notice in the game or its Google Play listing when a material change affects players.