Menu
Nederlands

Privacy

Dit document is beschikbaar in het Engels.

This Privacy Policy explains how Martin Smith, an individual developer and the controller, at Vollebakken, 4631 Kristiansand, Norway, handles personal information when you use Nail Ball, its account and online services, this website, or contact support. Contact: nailballofficial@gmail.com.

Effective date: 10 October 2026

We receive information directly from you through the age question, account setup and support; automatically from the game, its SDKs, our API and website requests; and from platform sign-in, app stores and the providers listed below. Some records are linked to your player ID; replacing your name with an identifier does not make them anonymous.

  • Account information: a player identifier, display name, avatar, linked platform identifiers and authentication records. Apple Game Center (iOS) and Google Play Games v2 (Android) supply platform player IDs and permitted profile information during background sign-in, subject to platform settings. If you choose NailBall ID, we process your email address and email-code verification records. We do not ask for your Apple or Google password.
  • Age and privacy choices: the birth year you provide, the resulting age group, consent choices and records needed to apply age restrictions.
  • Game activity: progress, stars, Gold and Diamond balances, wallet ledger entries, cosmetic ownership, rewards, quests, settings and, when online duels become available, matchmaking and match results.
  • Device and diagnostics: app and operating-system versions, device type, language, IP address, session events, diagnostic logs, crash traces and relevant device or app-instance identifiers. Firebase Analytics measures game usage; Firebase Crashlytics helps diagnose crashes; Azure Application Insights records backend errors and request diagnostics. IP addresses may indicate an approximate country or region; we do not request precise GPS location. The precise fields depend on SDK configuration and your choices.
  • Purchases: product identifiers, transaction or receipt information and entitlement and refund status supplied through the App Store or Google Play and processed with RevenueCat to validate purchases and maintain the server wallet. Those stores process your payment details; we do not receive your complete payment-card number.
  • Advertising and consent: consent choices, advertising IDs only with your consent and, on iOS, Apple App Tracking Transparency (ATT) permission; ad impressions, interactions, reward-verification events, IP address and technical device information used by Google AdMob and its Unity Ads mediation partner to deliver and measure ads and prevent fraud. Consent to tracking is separate from device identifiers necessary for sign-in or security.
  • Support: your email, messages and attachments that you choose to send. Do not include passwords, sign-in codes or unnecessary sensitive information.

Under GDPR and UK GDPR Article 6, the grounds depend on the purpose:

  • Contract — Article 6(1)(b): account creation and authentication, email sign-in codes, saved progress, matchmaking when available, purchase validation, wallet and refund records, and support needed to deliver the service you request.
  • Legitimate interests — Article 6(1)(f): proportionate security, abuse and fraud prevention, essential crash and server diagnostics, and support administration. Our interests are a safe, reliable game; we balance them against your rights, especially children's rights. This ground does not replace consent where device-access or other law requires it.
  • Legal obligation — Article 6(1)(c): tax and accounting records, legally required age and consent safeguards, and responses to lawful requests.
  • Consent — Article 6(1)(a): optional analytics, personalised advertising, advertising IDs, tracking and device access where consent is required. Consent is separate from agreeing to the Terms. Refusal does not block basic play; you may withdraw it in privacy settings or by contacting us, without affecting earlier lawful processing.

For Türkiye, the corresponding conditions are KVKK Article 5(2)(c) for necessary contract processing, 5(2)(ç) for legal obligations, 5(2)(e) for establishing, exercising or protecting rights, and 5(2)(f) for legitimate interests that do not harm fundamental rights and freedoms. Optional analytics and personalised advertising rely on explicit consent under Article 5(1) where required. We do not ask for special-category data; any such processing would need a separate condition under Article 6.

The game offers optional rewarded ads and interstitial ads between eligible CPU matches. The permanent “No ads” purchase removes interstitial ads; any Diamond purchase also removes them. Rewarded ads remain optional, and buying “No ads” does not itself withdraw analytics or privacy consent.

Google's User Messaging Platform (UMP) presents applicable privacy choices. Open Settings → Privacy options to change consent or opt out of personalised ads. On iOS, ATT permission is also required before accessing the advertising ID or tracking across other companies' apps and websites. UMP consent and ATT permission are separate; neither replaces the other. Device privacy settings can restrict tracking or reset advertising IDs. Refusing consent still allows basic play and may result in limited or non-personalised ads where lawful. Even non-personalised ads can involve technical data and may require consent for device access.

These providers receive only the data needed for their roles. They act as processors under applicable agreements or as independent controllers for their own platform, payment or advertising activities. Their privacy information is linked below:

  • Google / Firebase: app-instance and device information, usage events and crash diagnostics for Firebase Analytics and Crashlytics; platform player IDs for Play Games; purchase information for Google Play. Google Privacy Policy and Firebase privacy information.
  • Google AdMob and UMP: consent and age flags, device and network information, permitted advertising IDs, ad interactions and reward verification. Google advertising privacy information and Privacy Policy.
  • Unity Ads: AdMob mediation partner for ad delivery and measurement, subject to age and consent restrictions; receives the relevant advertising and device data described above. Unity Privacy Policy.
  • Apple: Game Center authentication and permitted profile information, App Store purchases and applicable tracking permission. Apple Privacy Policy.
  • Microsoft Azure: our own API on Azure Container Apps and Postgres stores account, gameplay and wallet records; Application Insights processes backend diagnostics. Microsoft Privacy Statement.
  • PlayFab (Microsoft): player and session identifiers, matchmaking requests and related match information when online play is enabled. Microsoft / PlayFab Privacy Statement.
  • Edgegap: game servers for online matches process connection information, player/session identifiers and match traffic. Edgegap Privacy Policy.
  • Azure Communication Services (Microsoft): delivers NailBall ID email codes and account messages; processes email addresses, message content and delivery records. Microsoft Privacy Statement.
  • RevenueCat: purchase validation, transaction and refund events, entitlement records and the server account ID used to keep your wallet consistent. RevenueCat Privacy Policy.

Online duels are coming soon; listing their providers does not mean they are currently live. Opponents may see your public platform name, avatar, emotes and match information when online play is available. We do not publish your email address. We may disclose necessary information to authorities when legally required, professional advisers for legal claims, or a successor in a lawful business transfer, with appropriate safeguards and notice.

Your data may be processed outside your country, including in the United States, by the providers listed above and their subprocessors. Data protection laws there may differ from those in your country. When data from the EEA or the United Kingdom is transferred to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum for UK data) or other lawful safeguards, such as the EU–US Data Privacy Framework and its UK Extension where the provider is certified under it. For Türkiye, domestic disclosures follow KVKK Article 8, and transfers abroad follow KVKK Article 9.

Contact nailballofficial@gmail.com for the applicable safeguards or a copy, with necessary confidential details redacted.

Security measures include encrypted network connections, restricted staff access, authentication checks and controlled access to server records and backups. No system guarantees absolute security. Do not send passwords or email sign-in codes to support.

We keep your personal data for as long as your account is active or as needed to provide the game and its services. Inactive accounts may be periodically de-identified. After a verified deletion request, we delete or irreversibly anonymise your account data within 30 days. We may keep limited records where needed for our legitimate business interests, to meet legal obligations (such as accounting and tax), to resolve disputes and to enforce our agreements. Records of privacy requests are kept for as long as needed to show that we handled them lawfully. Isolated backups are not used for ordinary operations and are overwritten on their normal cycle.

Retained records are limited to what is necessary, used only for the purpose for which they are kept and deleted when that need ends. Properly anonymised aggregate analytics may be retained without identifying you; pseudonymous or device-linked records are not anonymous. Providers acting independently may retain their own records under their notices.

Where applicable, you may request access, correction, deletion, restriction, portability, or object to processing based on legitimate interests. You may withdraw consent at any time and complain to your local data protection authority. We normally respond within one month; lawful extensions are explained to you. We may request information proportionate to verifying that the request concerns your account. Wallet reconciliation and refund adjustments are automated and may block Diamond spending when a balance becomes negative. Contact support to dispute an error and request human review. Where GDPR Article 22 applies, its protections, including human intervention and the ability to contest a decision, remain available.

Under Article 11 of Law No. 6698, where applicable, you may learn whether your personal data is processed, request information about processing, learn its purpose and whether data is used accordingly, and know domestic or foreign recipients. You may request correction, deletion or destruction when the legal conditions are met, notification of those actions to recipients, object to an adverse result from exclusively automated analysis, and seek compensation for damage from unlawful processing. Apply in writing to Vollebakken, 4631 Kristiansand, Norway, or email nailballofficial@gmail.com from an address previously provided to us and recorded in our system, as permitted by the Turkish application rules. Include your name, contact address, request and the identity information legally required for the chosen method. If you have no registered email or need another accepted method, contact us for instructions; do not send identity documents unless we request them through a suitable channel. We respond as soon as possible and within 30 days, subject to applicable law. Processing and transfers must meet the conditions in KVKK Articles 5, 6, 8 and 9 as applicable.

If applicable, California residents may request to know or access collected information, its sources, purposes and recipient categories, correct inaccurate information, delete information, and receive equal treatment when exercising rights. You may use an authorized agent, subject to appropriate verification. We generally respond within 45 days and explain any permitted extension. We do not sell personal information for money. Some advertising disclosures may constitute “sale” or “sharing” under California law; where applicable, you may opt out through Settings → Privacy options or email nailballofficial@gmail.com with “Do not sell or share my personal information”. You do not need to delete your account to opt out. For players known to be under 16, sale or sharing is disabled unless the legally required affirmative authorisation is obtained; for under-13s, behavioural advertising remains disabled. We honor applicable opt-out preference signals, including Global Privacy Control where relevant. Sensitive personal information is used only for permitted necessary purposes; any additional use would require the applicable notice and controls.

At first launch we ask a neutral birth-year question to apply age-appropriate settings. Players identified as under 13 receive child mode: only non-personalised, age-appropriate ads; no advertising ID access, behavioural targeting or ATT prompt; restricted analytics; and a parental notice before purchases. Player-to-player communication uses preset emotes, with no free-text chat. A purchase notice is not a substitute for parental consent to data processing.

For US children under 13, the Children's Online Privacy Protection Act (COPPA) requires verifiable parental consent before collection, use or disclosure beyond a permitted exception. Limited persistent identifiers may be used solely to support internal operations where COPPA permits; that exception does not authorise behavioural advertising or unrestricted analytics. Features requiring additional personal data, including an optional email account, must remain unavailable to a child unless the required consent or a specific lawful exception is in place. We do not condition participation on supplying more information than is reasonably necessary.

Parents or guardians can contact nailballofficial@gmail.com to review or delete their child's information, withdraw parental consent or stop further collection, subject to proportionate verification. If we find data collected without required consent, we stop the affected processing and delete it. Turning 13 does not automatically authorise tracking: regional consent ages, including GDPR ages of 13–16 depending on country, and local child-protection rules still apply.

This static website does not embed analytics, advertising SDKs, third-party fonts or tracking cookies. Its hosting provider may process standard request logs such as IP address, time and requested URL to deliver and secure the site. Email contact uses your chosen mail service. The game's SDK processing described above does not run merely because you visit this website. We will update this policy for material changes and provide additional notice or obtain renewed consent where required.

For privacy requests, contact nailballofficial@gmail.com. See Account verwijderen for deletion instructions.