Privacy Policy
Last updated: [[EFFECTIVE DATE]]
This privacy policy covers the game Superkrass in the browser, the later apps on the App Store and Google Play, and the website superkrass.com. It is written under the EU General Data Protection Regulation (GDPR) and, where applicable, the UK GDPR and the UK Data Protection Act 2018.
1. Controller
Hypez LTD
Office TW, Greengate Business Centre
Oldham, OL4 1FN
United Kingdom
Director: Ismail Ramadan
Email: hallo@superkrass.com
We have not appointed a data protection officer. [[verify]] For privacy questions, please write to the email address above.
2. EU representative
As we are established outside the EU, we have appointed the following representative in the EU under Art. 27 GDPR: [[EU REPRESENTATIVE]]
3. Guest account and game progress
When you open the game for the first time, our server creates a guest account automatically. You do not have to give an email address or a name.
We process:
- a randomly generated key (token) that is stored on your device and links your device to the guest account,
- a short player ID (for example "ABCD-1234") shown in the profile menu,
- your game state, such as Konfetti, Blitze, boss cards, boosters, trophies, league rank, purchases and progress.
The purpose is to provide the game and save your progress. The legal basis is Art. 6(1)(b) GDPR (contract for the use of the game).
If you clear your browser data or lose the device, the token is gone. Without sign-in, we can then usually no longer link the guest account to a device.
4. Storage on your device
The token is stored in the local storage of your browser or the app. This is strictly necessary for the service you asked for (§ 25(2) no. 2 TDDDG). We do not use cookies or similar technologies for advertising.
5. Gameplay events for balancing and bug fixing
The game sends events from your matches to our own server, for example the boss you picked, round results, boosters used or match length. These events are linked to your player ID but contain no name and no email address.
We use them to balance the game, find bugs and detect cheating. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is a fair and stable game. The data is not passed to third parties for advertising.
6. Server logs
When you use the game or the website, our servers process technically necessary data such as IP address, time, requested address, browser type and error messages. This keeps the service secure and helps fend off attacks. The legal basis is Art. 6(1)(f) GDPR.
7. Purchases with real money
In the browser, purchases of Blitze are handled by RevenueCat Web Billing, with payment processing by Stripe. You enter your payment details (such as card number) directly with these providers. We do not receive them. We receive information about the purchase such as product, price, time, transaction ID and payment status, and where given, the email address you enter at checkout.
In the apps, purchases run through the Apple App Store or Google Play. Their own privacy notices also apply there.
Our server uses this information to credit the purchase to your player account. The legal basis is Art. 6(1)(b) GDPR. For keeping transaction records, Art. 6(1)(c) GDPR applies together with statutory retention duties.
8. Sign-in with Google or Apple (planned)
We plan to offer sign-in with Google and Apple so you can use your progress on several devices. When this becomes available, we will add the data processed for it to this policy.
9. TikTok LIVE
Creators can connect their TikTok LIVE to Superkrass. Gifts and likes from viewers then affect the running duel. To do this, we process publicly visible event data from the LIVE, in particular the viewer's username, the gift type and the count. We receive this data through a connector service: [[LIVE CONNECTOR PROVIDER]].
Towards the creator, the legal basis is Art. 6(1)(b) GDPR. Towards viewers, it is Art. 6(1)(f) GDPR. Our legitimate interest is to provide the in-game interaction the creator asked for. We only keep this data as long as needed for that purpose: [[RETENTION LIVE DATA]].
Superkrass is not affiliated with TikTok. TikTok's own privacy policy applies to processing by TikTok.
10. Creator characters
If a creator wants their own playable character, we process the photos they send, their name or creator name and their contact details. From these, we produce concept art, a 3D model and animations. The legal basis is Art. 6(1)(b) GDPR, based on the individual creator agreement. To pay out revenue shares, we also process payment and invoicing details.
11. Support
When you write to us, we process your message, your email address and whatever you send along, such as your player ID or a receipt. The legal basis is Art. 6(1)(b) or (f) GDPR.
12. Website analytics
[[WEB ANALYTICS TOOL]]
13. No advertising
Superkrass shows no ads. We do not sell personal data and do not build advertising profiles.
14. Hosting and service providers
We use service providers who process data on our behalf (Art. 28 GDPR):
- Railway (hosting of game server and website), data centre in the EU (Netherlands),
- Supabase (PostgreSQL database), data centre in Frankfurt am Main [[verify]],
- RevenueCat (checkout in the browser) and Stripe (payment processing),
- [[LIVE CONNECTOR PROVIDER]] (TikTok LIVE events),
- [[OTHER PROVIDERS, e.g. email inbox]].
15. Transfers to third countries
We are based in the United Kingdom, for which the European Commission has issued an adequacy decision. Some service providers are based in the USA. Where data is transferred there or can be accessed from there, we rely on the EU-US Data Privacy Framework if the provider is certified, or on the European Commission's standard contractual clauses. [[verify]]
16. Retention
- Guest account and game state: as long as the account is used. We delete inactive guest accounts after [[DELETION PERIOD INACTIVE GUEST ACCOUNTS]].
- Gameplay events: [[RETENTION GAMEPLAY EVENTS]], then deleted or anonymised.
- Server logs: [[RETENTION LOGS]].
- Purchase records: for the statutory retention period [[verify: period]].
- Support requests: until resolved, then at most [[RETENTION SUPPORT]].
17. Children and teenagers
Superkrass has no age check. Minors may use the game. For the guest account we deliberately collect no names or contact details. Minors may only make purchases with real money with the consent of a parent or guardian. Parents and guardians can contact us at any time to request access or deletion.
18. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) GDPR (Art. 21).
So we can find your guest account, please tell us your player ID from the profile menu.
We do not use automated decision-making within the meaning of Art. 22 GDPR. [[verify: automatic bans on suspected cheating]]
19. Right to complain
You can lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live. In the United Kingdom, the competent authority is the Information Commissioner's Office (ICO), ico.org.uk.
20. Changes
We update this policy when the game or the law changes, for example when sign-in with Google or Apple is introduced. The version published here applies.
