Privacy policy

1. Data and how it is used

This policy describes data processing in Yamb of the Balkan and its informational website. The game publisher and data controller is Andrija Milinković, an individual based in Serbia. For data questions, contact andrija.milinkovic12@gmail.com.

During Google sign-in, Google and Firebase Authentication process basic profile information: display name, email address, profile picture and user identifier. The game links its server profile to the Firebase user ID. Google sign-in on the website verifies identity for account-deletion requests.

The game server stores profiles, match results and statistics, progress, virtual Dukati, inventory, preferences, friendships and friend requests. Messages and message reports are processed for communication and moderation. If you permit notifications, a device token is processed to deliver game notifications.

2. Technical data, analytics and advertising

The game and its Google SDKs may process device and app-version information, in-app activity, ad views and interactions, diagnostics, IP addresses, installation and advertising identifiers, and app-integrity signals. IP addresses may be used to estimate approximate location. The game does not require permission for precise GPS location.

These data support game functionality, saved progress, account management, stability, analytics, ad delivery and measurement, reward verification and abuse prevention. Friend lists describe connections between players; the game does not request access to the phone address book.

3. Google Analytics and your choice

In the game version with the Usage analytics option, analytics is off by default. You may voluntarily allow it and turn it off later in Settings. Declining does not prevent playing. The choice applies to the signed-in account on that device. Older versions without this option may use the earlier Analytics setting; update the game to obtain these controls.

When you allow analytics, Google Analytics processes usage events, device and approximate location information, an installation ID and a pseudonymous account ID to understand and improve the game. We do not send your name or email to Analytics. The new version does not use Analytics data for personalized advertising and does not collect the advertising ID through Analytics. AdMob ads and their privacy choices are separate.

The game keeps the association between an account and its Analytics installations while the account exists, so deletion requests can include linked devices. When you delete the account, we submit a separate request to Google to delete linked Analytics data. Google acknowledges receipt and processes it afterwards; the game confirmation distinguishes deleted game-server data from the request submitted to Google.

Older Analytics data that were not associated with an account cannot reliably be attributed to a Google account afterwards. Analytics retention settings apply to those data. Current settings are 2 months for event data and 14 months for user data, with the user-data period reset by new activity. These periods do not cover all standard aggregate reports. Turning analytics off stops future collection on that device; it does not itself request deletion of previously sent data.

4. Visibility and service providers

Display names, avatars and results may be visible to other players in matches, leaderboards and social features. Messages posted to global chat are visible to its participants.

We use Google/Firebase for authentication, analytics, notifications, app integrity and ads; Render for the game server; and MongoDB for the database. Firebase Hosting serves the informational website. Google profile pictures are loaded from their URLs.

When a profile picture is absent, the existing client may send a display name to UI Avatars to generate an avatar. Fonts and flag images may load from Google Fonts and Flagcdn, whose recipients receive ordinary request metadata.

Provider information: Google privacy policy, Firebase privacy, Google AdMob, Render, MongoDB, and UI Avatars. Data these providers independently process for their own services is subject to their policies and available user controls.

5. Choices and security

Google sign-in enables account and synchronization features. You can turn off notifications in your device settings. When “Ad privacy choices” is offered in the game settings, you can use it to reopen your ad-consent choices. Android settings provide additional advertising-ID controls.

The production client communicates with the game server over HTTPS. The server verifies Firebase identity before access to account features. Chat is processed on the server for functionality and moderation.

6. Retention

Profiles, progress, results and associated profile backups are kept to provide the game while the account exists, unless removed through deletion. Two categories of operational diagnostics—result submissions and connection interruptions—have a 30-day automatic retention period.

Operational server logs may contain technical data, display names and account identifiers for maintenance and security. Under the current Render plan, logs are available for the last 7 days. These logs are not individually removed by account deletion; they expire under that retention period.

After completed deletion, the request receipt remains available for 30 days. A minimal security record containing a cryptographic hash of the old identifier, without a name, email or profile picture, is automatically removed after 90 days. It prevents deleted account data from being restored through an old session or old data.

Shared match and tournament history may remain for other players with the deleted account’s name, picture and account ID removed. Older diagnostics containing a display name without a reliable account-ID association may remain until the 30-day period expires. These periods do not promise deletion of data Google independently processes for its own services through the same account-deletion procedure.

7. Account and data deletion

Start deletion in Game settings → Delete account or on the Account deletion page, without an installed game. Verify your identity with the same Google account, then confirm permanent deletion.

The procedure removes the game account, profile, progress, Dukati, inventory, friendships, notification tokens, associated messages and profile backups maintained by the game. Virtual items cannot be restored. Your Google account, Gmail and other Google services are not deleted. Signing out and uninstalling the game do not themselves request account deletion.

Local account data is also removed on a device receiving notice that deletion has started. An offline device cannot receive that change immediately; the old identity is checked on reconnection and cannot recreate the deleted server profile.

8. Questions, requests and children’s data

For data questions, access or correction requests, and deletion assistance, contact andrija.milinkovic12@gmail.com. We may request identity verification to protect the account.

If you are a parent or guardian and believe a child provided data without the necessary consent, contact us for investigation and removal. This policy may be updated as features or processing change; the revision date is shown at the top.