1. Who we are
- Trading name
- PIKTAF STUDIO
- Address
- Disclosed on request
- Contact
- piktafstudio@gmail.com
PIKTAF STUDIO is the data controller for the personal data described in this policy.
2. What we collect
DotGacha (the "App") needs no account and can be played anonymously. We never ask for your phone number or postal address. You may optionally sign in with Google or Apple to carry your progress to a new device. Only if you sign in do we receive the display name and email address of that account.
Information about you
- An anonymous identifier issued automatically by Firebase Anonymous Authentication
- Display name and email address — only if you sign in with Google or Apple. Used to identify your account and carry your data to a new device.
- The profile name and icon shown on the online rankings, if you use them
- Your display board layouts, including any text you place on a board — saved to the cloud, and shown to others only if you choose to publish it
- Game data: the pixel art you have collected, your coin and ticket balances, mission and login progress, and which decorations you own
- Purchase information, if you buy anything in the App (the product bought, the transaction ID)
- The content of any message you send us
Information collected automatically
- An advertising identifier (AAID on Android, IDFA on iOS), used to serve ads
- Device information such as operating system version and device model
- IP address and access timestamps
3. Why we use it
- To run the App and to save and sync your progress
- To carry out in-game actions: gacha draws, granting coins and items
- To process in-app purchases, grant what you bought, and verify receipts
- To detect and prevent abuse
- To serve ads and measure how they perform
- To answer your enquiries
- To improve the App and produce aggregate statistics
- To comply with the law
4. Sharing with others
We do not share your information with third parties except:
- with your consent
- where the law requires it
- with payment providers, to the extent needed to process a purchase
- with our service providers, to the extent needed for them to do their work
5. Services we rely on
The App uses the services below. Each provider's own privacy policy applies to the data it handles.
- Google Firebase (anonymous authentication, Firestore database, Cloud Functions) — policy
- Google Analytics for Firebase (usage analytics: screens viewed, events) — policy
- RevenueCat (managing in-app purchases and verifying receipts) — policy
- Google Play Billing / Apple App Store (payment processing) — Google · Apple
- Google AdMob (advertising) — policy
- Cloudflare R2 (image delivery) — policy
6. Advertising
- The App uses Google AdMob, which may use an advertising identifier to serve ads.
- You can turn off personalised advertising, or reset your advertising identifier, in your device settings.
- Google and its advertising partners may collect usage history in order to show ads matched to your interests.
- Where the law requires consent for personalised advertising, we ask for it when you first open the App, and you can change your answer at any time.
7. Cookies and similar technologies
The App may use cookies and similar technologies, including storage on your device, to work properly and to measure usage. You can restrict these in your device or app settings.
8. Children
The App is intended for people aged 13 and over. If you are between 13 and 18, please get a parent's or guardian's permission before making any purchase. We do not knowingly collect information from anyone under 13.
9. How long we keep it
- Game data
- Until you delete it. You can erase it yourself from "Reset data" in the App.
- Purchase and transaction logs
- At least 7 years, as required by law for accounting and fraud prevention.
- Access logs
- Deleted within a reasonable period.
10. Keeping it safe
We take reasonable measures to prevent loss, damage or unauthorised disclosure of the information we hold. Firestore security rules mean each player can only read their own data, and coins, items and purchases can only be changed by our server (Cloud Functions). Traffic is encrypted with HTTPS/TLS.
11. Your rights
You may ask us to:
- tell you what data we hold about you
- correct or complete it
- delete it, or stop using it
You can also delete your game data yourself, from "Reset data" in the App. Write to piktafstudio@gmail.com to make any of these requests.
12. If you live in the EU or the UK (GDPR / UK GDPR)
The App is distributed in the European Union and the United Kingdom. If you live there, the following applies to you.
Controller
PIKTAF STUDIO is the controller of your personal data. Contact: piktafstudio@gmail.com
Our legal bases
- Performance of a contract (Art. 6(1)(b)) — running the game, saving and syncing your progress, processing purchases
- Consent (Art. 6(1)(a)) — personalised advertising and measuring its performance. We ask when you first open the App, and you can withdraw at any time
- Legitimate interests (Art. 6(1)(f)) — detecting and preventing abuse, and improving the App. We balance these against your rights and freedoms
- Legal obligation (Art. 6(1)(c)) — keeping transaction records
Your rights
- Access — a copy of the personal data we hold about you
- Rectification — correction of anything inaccurate
- Erasure ("right to be forgotten") — deletion of your data. You can also do this yourself: choose "Delete account" from the App's menu
- Restriction of processing
- Portability — your data in a structured, machine-readable format, and transmission to another controller where technically feasible
- Objection — to processing based on legitimate interests, and to direct marketing
- Withdrawal of consent — this does not affect processing carried out before you withdrew
- Complaint to a supervisory authority — in France, the CNIL; elsewhere in the EU, your national authority; in the UK, the ICO
Write to piktafstudio@gmail.com to exercise any of these. We aim to respond within one month.
Transfers outside the EEA
The services we use — Google (Firebase, AdMob), RevenueCat and Cloudflare — may hold data on servers outside the EEA, mainly in the United States. Those transfers rely on the European Commission's Standard Contractual Clauses or on the EU-US Data Privacy Framework to keep your data protected.
Automated decision-making
We do not make automated decisions, or carry out profiling, that produce legal effects concerning you or similarly significantly affect you. Gacha draws are random and are not based on your personal data.
13. Changes
We may revise this policy when the law changes or when the App changes. We will announce anything significant in the App or on this page.