Privacy Policy

1. Who we are

Do The Thing! is published by Flaw Interactive, [Address] ("we", "us"). We are the data controller for the personal data described here.

Contact for anything related to your data: contact@flawinteractive.com.

2. Playing as a guest

Without an account, your settings, character, trophies, stats and high scores are stored only on your phone. No account data is sent to our servers.

To check whether online features are available, the app opens a technical connection to our online service provider GD-Sync when it starts. Like any internet connection, this reveals your IP address to GD-Sync, but no username, e-mail or game data is sent while you play as a guest.

3. Your account

An account is optional. It is needed for leaderboards, friends, cloud saves and online parties. When you create one, our online service GD-Sync stores:

• your username and e-mail address, and your password (used to log in; GD-Sync e-mails you a verification code and handles password resets);
• your best scores on the leaderboards (the Rumble ranking and one per game);
• your friends, friend requests and party invitations;
• your trophies and stats, and your character and colour theme;
• during an online party, the match data needed to play together (username, character, round scores, ready status, a random player number).

Your login is also saved on your phone so that you stay signed in.

Continue with Google

If you choose "Continue with Google", Google gives the app a sign-in token. Our server (Google Cloud Functions) checks that token, and we keep only your verified Google e-mail address, which becomes your account e-mail. The token also contains your Google account identifier and name: the identifier is used on the fly to generate your account password (it is not stored), and your name is only used on your phone to suggest a username. We never see your Google password or your contacts.

4. Push notifications

Notifications are optional. They are only set up when you are logged in, have allowed notifications in Android, and have at least one type turned on in Profile tab → Notifications: friend requests and party invites, "a friend beat your score" challenges, and reminders if you haven't played for a while. Before that — and always for guests — the app creates no notification token.

For this, our Firebase server (Google Cloud) stores, linked to your username:

• your phone's notification token (Firebase Cloud Messaging) and a random installation identifier created by the app;
• the app language (English or French), the platform (Android) and your notification choices;
• your phone's time zone offset (for example UTC+2), so that we don't send notifications at night and send reminders around 6 pm your time;
• the time you last opened the app and how many reminders were sent (at most 3, 2, 5 and 12 days after your last visit).

Turning notifications off, logging out or deleting your account removes this data. It is also deleted automatically when the token stops working (for example after you uninstall the app).

5. What other players see

Your username, character and scores are visible to other players on the leaderboards, in their friends lists and during online parties. Please don't put personal information in your username.

6. Data kept only on your phone

Your settings, language, profile picture, trophies, high scores, saved login and current online match are kept in the app's private storage. Your profile picture never leaves your phone. Uninstalling the app or clearing its data deletes them.

7. Security and anti-spam

To protect the service against abuse, our server counts requests per IP address and per user over short periods (a few minutes to one day). These counters are stored under an irreversible code (a hash), not in plain text, and are deleted shortly after the period ends. Our hosting providers also keep technical logs (which include IP addresses) for a limited time, for security and troubleshooting. All data is sent over encrypted connections (HTTPS).

8. Advertising and purchases

Unless you have Premium, the game shows ads provided by Google AdMob. To choose, show and measure ads and to prevent fraud, AdMob collects directly from your phone:

• your device’s advertising identifier (the Android advertising ID);
• your IP address, from which an approximate location is derived;
• device and app information (model, operating system, language, app version);
• how you interact with ads (views, taps).

In the European Economic Area, the UK and Switzerland, a consent message from Google’s consent tool lets you accept or refuse personalised ads the first time you open the game, and you can change your choice at any time in the app’s settings. If you refuse, you still see ads, but they aren’t personalised. You can also reset or delete your advertising ID in your phone’s settings. Google explains how it uses this data in How Google uses information from sites or apps that use its services. [Ads aren’t in the app yet: confirm the ad formats and the settings menu once they are added.]

Premium, an optional subscription, removes the ads. It is sold and handled by Google Play, which processes your payment and tells the game only whether your subscription is active. We never see your card or bank details.

We don't sell your data.

9. Why we use your data (legal bases)

Purpose	Data	Legal basis (GDPR)
Creating and running your account, leaderboards, friends, cloud saves, online parties	Account data, scores, friends, trophies, character, match data	Performance of the contract (our Terms) — art. 6(1)(b)
Sign-in with Google	Google e-mail, Google account identifier	Performance of the contract — art. 6(1)(b)
Push notifications (friend requests, invites, score challenges, reminders)	Notification token, installation id, language, preferences, time zone offset, last activity	Your consent (Android permission and in-app switches), which you can withdraw at any time — art. 6(1)(a)
Personalised ads, and the use of your device’s advertising identifier	Advertising identifier, IP address, device information, ad interactions	Your consent (consent message), which you can withdraw at any time — art. 6(1)(a)
Non-personalised ads, ad measurement and fraud prevention	IP address, device information, ad interactions	Our legitimate interest in funding a free game — art. 6(1)(f)
Premium subscription	Subscription status	Performance of the contract (our Terms) — art. 6(1)(b)
Security, anti-spam, abuse prevention	IP address and usernames (hashed counters), technical logs	Our legitimate interest in keeping the service safe — art. 6(1)(f)
Answering your e-mails	Your e-mail and message	Our legitimate interest in helping you, or the contract — art. 6(1)(f)/(b)

10. How long we keep it

• Account data: until you delete your account. [Optional: accounts inactive for [X] years may be deleted.]
• Notification data: until you turn notifications off, log out, delete your account, or the token stops working.
• Anti-spam counters: a few hours at most after their period (up to about 25 hours).
• Technical logs of our providers: about 30 days.
• Advertising data: kept by Google under its own policies (how Google retains data).
• Support e-mails: as long as needed to answer you, and at most [3 years].
• After an account deletion, copies may remain in our providers' backups for a limited time [period to confirm with GD-Sync] before being overwritten.

11. Service providers

We don't sell or rent your data. It is processed on our behalf by:

• GD-Sync (gd-sync.com) — accounts, e-mail verification, friends, leaderboards, cloud saves and online multiplayer. [Legal entity and server location to confirm]
• Google Firebase / Google Cloud (Google Ireland Limited for users in Europe) — our server functions, the notification database and Firebase Cloud Messaging, which delivers notifications to your phone.
• Google Sign-In — only if you choose "Continue with Google".

For advertising, Google AdMob (Google Ireland Limited for users in Europe) acts as an independent controller. Google Play handles Premium payments.

We may also disclose data if required by law.

12. International transfers

Our server functions run in the European Union (Google Cloud region europe-west1, Belgium). The notification database is hosted by Google in the United States (Firestore multi-region "nam5"), and Google may process data in other countries. These transfers are covered by the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses included in Google's data processing terms. [Add GD-Sync's server location and transfer safeguards.]

13. Children

Do The Thing! is intended for players aged 13 and over. Online features (account, friends, notifications) are not meant for children under 13. In countries where the age of digital consent is higher (for example 15 in France), a younger teenager needs the permission of a parent to create an account. Children can play as guests without giving any personal data. If you believe a child has created an account without permission, contact us and we will delete it.

14. Your rights

Depending on where you live (for example under the GDPR in Europe), you have the right to access your data, correct it, delete it, receive a copy (portability), object to or restrict its use, and withdraw your consent at any time.

• Change your username in Profile tab → Profile.
• Turn notifications off in Profile tab → Notifications (or in Android settings).
• Delete your account in Profile tab → Privacy & CGU → Account Security → "Delete my account", or on the account deletion page.
• Change your ad choices in the app’s settings, and reset or delete your advertising ID in your phone’s settings.
• For anything else (a copy of your data, a correction, a question), write to contact@flawinteractive.com from your account e-mail. We answer within one month.

You can also file a complaint with your data protection authority (in France, the CNIL: cnil.fr).

15. Changes

We may update this policy, for example when we add a feature. The date at the top shows the latest version. If a change is important, we will tell you in the app.

16. Contact

Flaw Interactive — [Address]
E-mail: contact@flawinteractive.com · Website: flawinteractive.com