Squadly

Privacy Policy

Effective date: 14 July 2026

This policy explains what personal data Squadly, operated by The Squadly Co ("we", "us"), collects when you use thesquadly.com or our mobile applications (the "Service"), how we use it, and the choices you have. We collect as little as the game needs to work.

1. Data we collect

• Account data. If you register: e-mail address, username, and a password (stored only as a salted hash — we never store your plain password). If you sign in with Google: your Google account e-mail and identifier, provided by Google with your consent.
• Profile data. An optional avatar image you upload, and gameplay progression (XP, level, rating, rank, match results, win/loss counts).
• Guest data. If you play as a guest: a random device identifier stored in your browser, used to track daily lives until 00:00 UTC. It contains no personal details.
• Technical data. IP addresses appear in short-lived server logs and are used in-memory for security rate limiting (e.g. limiting account creation attempts). We do not build profiles from them.
• Payment data. If you subscribe to Squadly Pro, payment is handled entirely by our merchant of record, Paddle. We never see or store your card details; we receive only your subscription status, a customer/subscription reference, and the billing period needed to activate Pro on your account.

2. What we do NOT do

• No advertising networks, no third-party analytics trackers, no tracking cookies.
• We do not sell or rent personal data to anyone.
• We use your e-mail only for account verification, password resets, and important service or billing notices — not for marketing, unless you explicitly opt in.

3. Local storage

The Service stores a small amount of data in your browser's local storage: your session token, guest identifier, language preference, and interface settings. These are functional necessities, not tracking mechanisms. The Service also uses a service worker cache so the app loads faster and works offline.

4. Service providers

We share data only with the providers needed to run the Service:

• Paddle (Paddle.com Market Ltd, UK) — payment processing as merchant of record. See Paddle's privacy policy.
• Brevo — sending transactional e-mails (verification links, password resets).
• Google — only if you choose Google sign-in.
• Hetzner (Germany) — server hosting. Game data is stored on servers in the European Union.
• Cloudflare — network routing, DDoS protection, and content delivery.

5. Retention

• Account data is kept for as long as your account exists.
• Guest identifiers lose their gameplay meaning after the daily reset and stale records are periodically purged.
• Subscription references are kept for as long as required for accounting and legal obligations.

6. Your rights

Depending on where you live (including under the EU/UK GDPR and Türkiye's KVKK), you have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise any of these rights — including full deletion of your account and its data — e-mail us at [email protected] from the address linked to your account. We respond within 30 days.

7. Children

The Service is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child under 13 has created an account, contact us and we will delete it.

8. Security

We use industry-standard measures: TLS encryption in transit, salted password hashing, signed session tokens, and rate limiting. No system is perfectly secure; if a breach affecting your personal data occurs, we will notify you as required by law.

9. Changes

We may update this policy as the Service evolves. Material changes will be reflected in the effective date above and, where appropriate, announced in the app.

10. Contact

Privacy questions and requests: [email protected]