Draft, review by a lawyer before publishing. Text in [OWNER TO CONFIRM: …] brackets must be completed or checked before this policy goes live.
This policy explains what information the Artmystique game ("the app") uses, why, who else handles it, and the choices you have. Artmystique is made by Mala ("we", "us").
The short version: you play without giving us your name or email. The online part of the game uses a random account identifier. Usage figures are anonymous and, in the EU, EEA, UK and Switzerland, only collected if you agree. You can delete your account and online data from inside the app at any time.
Who we are
The controller of your information is Mala, [OWNER TO CONFIRM: legal entity name, registered address and company number].
- Website: mala-lab.com
- Email: support@mala-lab.com
- Data protection officer: [OWNER TO CONFIRM: name and contact of a DPO, or state that none is appointed].
- EU/UK representative: [OWNER TO CONFIRM: GDPR Art. 27 representative in the EU and UK, if Mala isn't established there].
What the app does without the internet
You can play evenings against the game's computer opponents fully offline. Your saved games, settings, Collection Book, notification choices and the Grand Finale favour gauge are stored on your device only. We don't receive them unless they become part of the online season data described below.
Information we collect
Your account identifier
When the app first goes online, it signs you in anonymously with Google Firebase Authentication. This creates a random account identifier (a "user ID") that isn't linked to your name, email or phone number. We use it to keep your season progress and Vault on our server and to know which online requests come from you.
You may later choose "Save your collection" and link Sign in with Apple or Sign in with Google, so you can recover your progress on another device. Our game server never receives or stores your name, email address or profile photo from Apple or Google. Firebase Authentication keeps the link between your account and your Apple or Google sign-in [OWNER TO CONFIRM: whether the Firebase account record stores the email address returned by Apple or Google; with Apple you can choose "Hide My Email"].
Your display name
On leaderboards and in public auctions you appear under a display name chosen from names the game provides, plus a number (for example "Velvet Owl #4821"). You can't type your own name, so it never contains personal details.
Game and season data (stored on our server, run on Cloudflare)
To run seasons, public auctions, the weekly quiz and leaderboards, our server keeps, linked to your account identifier:
- your display name, the date your account was created and when it was last active;
- whether you're a Collector's Club member and until when;
- your season wallets, and a record of every change to them (evening earnings, auction purchases, corrections);
- your Vault: the artworks you own in each season, and works unlocked through the weekly quiz;
- the evenings you play online: the game seed, difficulty, versions, the result, and a fingerprint (hash) of the moves. The moves of an evening may be sent to the server to check the result; we keep the result and the fingerprint, not the moves themselves;
- your season standings, such as your score and the time it was reached;
- your answer to the weekly quiz (the choice, whether it was right, and how long you took);
- the auction room you joined for a session.
Inside a live public auction room, the room keeps a log of the session (bids, winners and the account identifiers of participants) for up to 30 days so we can resolve disputes. It's then deleted automatically.
Anonymous engagement figures
To understand which artworks players enjoy (for example to report interest in an artwork or an artist to museums or galleries in the future), and how the game is played, the app sends events such as: an artwork was shown, for how long, whether "Read more" or the Wikipedia link was opened, zoom time, shares, bids on a public lot, quiz results, works kept in the Vault, screens opened, onboarding steps, and evening and season progress.
These events carry a random "install ID" created on your device only for this purpose, your app version, language and the season. They don't carry your account identifier, name, email, sign-in token, or any hidden game information. They're stored on our server (Cloudflare Workers Analytics Engine) and used in aggregate per artwork. Deleting your account resets the install ID.
Whether these events are sent depends on your choice (see "Your choices").
Firebase Analytics
Product figures (screens, onboarding steps, evening and season progress, quiz results) are also sent to Google Firebase Analytics, under the same choice as the anonymous figures above. Automatic collection is switched off, and we have switched off collection of the advertising ID by Firebase Analytics. Firebase Analytics uses an app-instance identifier and basic device information (such as the device model, operating system and approximate country derived from the IP address) [OWNER TO CONFIRM: Google Analytics data retention setting, 2 or 14 months].
Crash reports (Firebase Crashlytics)
If the app crashes or hits an error, a report may be sent to Google Firebase Crashlytics: the technical error, the device model, operating system and app version, and a few game facts (the screen, game phase, round, difficulty, number of opponents and language). We don't attach your account identifier, name or email; the app removes anything that looks like an email address from reports [OWNER TO CONFIRM: whether crash reporting follows the in-app "Share anonymous usage data" switch or the consent prompt in the EU/EEA/UK; and Crashlytics retention].
Advertising (Google AdMob)
If you aren't a Collector's Club member, the app shows banner ads on a few screens and offers optional rewarded ads (for example "watch an ad to add the quiz work"). Ads are provided by Google AdMob. AdMob receives information from your device such as the IP address, device type, operating system, app identity and ad interactions, and uses it to deliver ads, limit how often you see them, measure them and prevent fraud.
- Today the app requests only non-personalised ads. [OWNER TO CONFIRM: if personalised ads are enabled later, Google's consent message (UMP) will be shown in the EU/EEA/UK and Switzerland, and this section must be updated.]
- On iPhone and iPad, the app asks for your permission through Apple's App Tracking Transparency prompt ("Artmystique uses this to show you more relevant ads. The game works the same either way.") before the advertising identifier (IDFA) can be used. If you decline, it isn't used. [OWNER TO CONFIRM: the prompt is configured in the app but isn't shown yet; confirm when it is.]
- On Android, you can reset or delete your advertising ID in your device settings.
- When you finish a rewarded ad, AdMob confirms it to our server with a code we created for that offer, so we can unlock your reward. The code refers to your account identifier and the quiz; it contains nothing else about you.
Purchases (Collector's Club, through RevenueCat)
The Collector's Club subscription is sold and billed by Apple (App Store) or Google (Google Play). We use RevenueCat to manage subscriptions. RevenueCat receives the purchase receipt and transaction details from the store (product, dates, price, country/currency and subscription status) and your account identifier, and tells our server whether your Club membership is active and until when. We never receive your card or bank details. [OWNER TO CONFIRM: RevenueCat isn't integrated in the app yet; confirm this description when it is.]
Notifications
Auction reminders and highlights are scheduled by the app on your device, from the public auction schedule. You choose how many you get in Settings, and your operating system asks your permission first. We don't currently collect a push-notification token. [OWNER TO CONFIRM: if server-sent pushes through Firebase Cloud Messaging are added later, for example "we miss you" reminders, update this section.]
Technical data needed to deliver the service
Like any internet service, our servers and our hosting provider Cloudflare process your IP address and basic request information to deliver content (season files and artwork images), protect the service and limit abuse (for example a cap on how often events can be sent from one IP address). We don't store IP addresses in our game database or in the engagement figures. [OWNER TO CONFIRM: Cloudflare request-log settings and retention for the account.]
What we never collect
- Your name, email address, phone number, address or photo (in our game database).
- Your contacts, photos, microphone, camera or precise location. To decide whether to ask for analytics consent, the app looks at your device's region setting and time zone on the device; this guess isn't sent to us.
- Payment card or bank details.
- Free text: the game has no chat and no typed names.
- Anything that reveals hidden game information to other players.
We don't sell your personal information.
Why we use it (legal bases)
| Purpose | Legal basis (GDPR / UK GDPR) |
|---|---|
| Running your account, seasons, Vault, public auctions, quiz and leaderboards | Performance of our contract with you (the Terms of Use) |
| The Collector's Club subscription | Performance of contract; legal obligations for tax and accounting records kept by the stores |
| Fair play, security, abuse limits and auction disputes | Our legitimate interest in a fair, working game |
| Anonymous engagement figures and Firebase Analytics | Your consent in the EU, EEA, UK and Switzerland; elsewhere our legitimate interest in improving the game, with an opt-out at any time |
| Crash reports | [OWNER TO CONFIRM: consent or legitimate interest, matching how crash reporting is switched on] |
| Ads | Our legitimate interest in funding the free game (non-personalised ads); your consent for any personalised ads or use of the advertising identifier |
Who we share information with
We use these service providers. They process information for us, or as independent controllers where their own terms say so:
- Google (Firebase Authentication, Firebase Analytics, Firebase Crashlytics, AdMob, Google Sign-In, Google Play billing). Google privacy policy
- Cloudflare (hosting our server, database, analytics storage and content delivery). Cloudflare privacy policy
- Apple (Sign in with Apple, App Store billing, App Tracking Transparency). Apple privacy policy
- RevenueCat (subscription management). RevenueCat privacy policy
Other players can see your display name, your leaderboard scores and ranks, and your bids and wins in public auction rooms. Opponents in public auctions may include the game's own computer-controlled collectors, who are shown as the game's characters and never as real players.
If you use the share button, the artwork or result is handed to your device's share sheet and goes wherever you choose to send it.
We may disclose information if the law requires it, to protect players or the service, or as part of a merger or sale of the business, in which case this policy continues to apply.
How long we keep it
- Account and game data: until you delete your account. [OWNER TO CONFIRM: accounts that were never linked to Apple or Google and are inactive for 90 days may be deleted automatically; this clean-up is planned but not built yet.]
- Public auction room logs: up to 30 days after the session.
- Anonymous engagement figures: up to about 3 months in their raw form (the retention of Cloudflare Workers Analytics Engine); aggregated reports per artwork, which identify no one, may be kept longer.
- Firebase Analytics, Crashlytics, AdMob and RevenueCat: according to each provider's retention settings. [OWNER TO CONFIRM: the retention periods set in each console.]
- Season leaderboards are kept as a record after a season ends, but a deleted account no longer appears on them.
- Backups: [OWNER TO CONFIRM: database backup / point-in-time recovery window, after which deleted data is gone from backups too.]
Deleting your account
In the app: Settings → Delete account and online data. This:
- deletes your account row, evenings, wallet history, Vault and standings from our server;
- deletes your Firebase sign-in account (if Firebase asks you to sign in again first and that isn't possible, the app signs you out instead; the remaining sign-in record holds no game data);
- clears the season data on your device and resets the install ID used for anonymous figures.
Offline games and settings on your device stay until you remove the app. Deletion can't be undone. Deleting your account doesn't cancel a Collector's Club subscription: cancel it in your App Store or Google Play subscription settings. You can also ask us to delete your data by emailing support@mala-lab.com with your in-game display name.
Your choices
- Usage figures: Settings → "Share anonymous usage data". In the EU, EEA, UK and Switzerland, nothing is collected until you say yes; elsewhere it's on until you switch it off. Switching it off stops collection and clears figures not yet sent.
- Notifications: Settings → Notifications (Highlights only, Every auction, Only my reminders, Off), and your device's notification settings.
- Ads: your device's ad settings (Limit Ad Tracking / App Tracking Transparency on iOS, the advertising ID settings on Android), or the Collector's Club, which removes ads.
- Account linking is optional.
Your rights
Depending on where you live, you may have the right to access, correct, delete or receive a copy of your information, to object to or restrict its use, and to withdraw consent at any time (this doesn't affect what happened before). Because we don't know your name or email, we may ask you for your display name or other in-game details so we can find your account. You can also complain to your local data protection authority.
California and other US states: we don't sell personal information and we don't "share" it for cross-context behavioural advertising while only non-personalised ads are requested [OWNER TO CONFIRM: revisit if personalised ads are enabled]. We don't use sensitive personal information. You won't be treated differently for exercising your rights.
To exercise a right, email support@mala-lab.com. We'll answer within the time the law requires (usually one month).
Children
Artmystique is designed for adults and isn't directed at children under [OWNER TO CONFIRM: minimum age, for example 13, or 16 in the EEA]. We don't knowingly collect information from children under that age. If you believe a child has used the online features, contact us and we'll delete the account.
International transfers
Our providers may process information outside your country, including in the United States. Where the law requires it, transfers rely on safeguards such as the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework [OWNER TO CONFIRM: the safeguards in each provider's data processing terms].
Security
Connections to our server are encrypted (HTTPS and secure WebSockets). Every online request except public information is checked against your sign-in token. Access to our systems is limited and secrets are stored only in our hosting provider's secret store. No system is perfectly secure, so we can't guarantee absolute security.
Changes to this policy
When we change this policy we update its version and effective date at the top. If the change is significant, the app will tell you before it applies. Previous versions are available on request.
Contact
Mala, [OWNER TO CONFIRM: legal entity name and address]