Version 1.5 – November 1, 2026 · Version française
This policy explains what data the Crooks Arena mobile app (Android and iOS) collects, why, how long it is kept, who it is shared with and how to delete it.
Google user data
This section describes how Crooks Arena handles data obtained through "Sign in with Google".
Data accessed
The app requests only the following basic Google scopes, and no other Google service (no Drive, Gmail, contacts or calendar):
openid: provides a unique identifier for your Google account.email: provides your email address.profile: provides your name and profile picture.
Data usage
Only the unique identifier of your Google account is used, to create your game account and to find it again at each sign-in. Your email address, name and profile picture are neither stored nor used.
Data sharing
Google user data is not sold, not shared and not transferred to third parties, except where required by law. It is not used for advertising and not used to train artificial intelligence models.
Data storage & protection
Data is stored on servers located in the European Union (IONOS). Communication is encrypted and access is restricted.
Data retention & deletion
The identifier is kept as long as your account exists and is erased when the account is deleted (see the Data deletion page and section 8 below). You can also revoke Crooks Arena's access to your Google account at any time: myaccount.google.com/permissions.
Crooks Arena's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
1. Data controller
The data controller is Anthony Mendes Salle (trading as InDev'O), sole proprietor, SIRET 938 066 834 00020, 84420 Piolenc, France. Contact: [email protected]. No data protection officer has been appointed; this contact handles all requests relating to your data.
2. Data collected, purposes and retention
- Google or Apple account identifier (unique ID provided at sign-in). Purpose: create your game account and recognize you at each sign-in. Kept while the account exists, then erased when the account is deleted.
- Game data: your Crooks' names and appearance, level, experience, items, equipment, fight history and statistics, ranking. Purpose: run the game (fights, progression, ranking). Your Crooks' names, appearance, level and ranking are visible to other players. Kept while the account exists, then see section 8.
- Friends data: your friends list and friend requests. Purpose: let you add friends and challenge them to duels. Your nickname and Crooks are visible to your friends. Kept while the account exists.
- Purchase history: product, date and store transaction reference. Purpose: deliver purchases and handle refunds. Kept while the account exists and for the legal retention period. We never see your payment details.
- Push notification token: a device token. Purpose: send notifications (friend requests, rewards available, energy refilled). Kept while the account exists or until the token is replaced.
- Session data: sign-in tokens (stored hashed) and last sign-in date. Purpose: keep you securely signed in. Kept until sign-out or session expiry.
- Technical request data: IP address, date and time, app version. Purpose: service security (abuse limiting, prevention of replayed requests). Kept for 30 days at most.
- Hash of a banned account: only if the account is banned at the time of erasure. Purpose: enforce the ban. Kept for 12 months (see section 8).
We do not collect your email address, name, photo, contacts or location. Advertising data processed by Google is described in section 3.
3. Advertising (Google AdMob)
The app displays ads through Google AdMob: rewarded videos and interstitial ads. To serve them, Google processes your advertising identifier, device information and IP address, under its own privacy policy. In the European Union, your consent is requested before any personalized advertising. You can reset or disable the advertising identifier in your device settings. A subscription removes ads.
4. Purchases and subscriptions
In-app purchases and subscriptions are processed by Google Play and the App Store. We never see your payment methods. Our purchase history is described in section 2.
5. Push notifications
Notifications are sent through Firebase Cloud Messaging (Google) for friend requests, rewards available and energy refill. You can turn them off in your device settings.
6. Legal basis
Account, session, friends, purchase and game data: performance of the contract (terms of use). Technical data and the hash of a banned account: legitimate interest in securing the service and enforcing the game rules. Personalized advertising: your consent, which you can withdraw at any time.
7. Recipients and processors
- IONOS SE (Montabaur, Germany, European Union): server and database hosting.
- Cloudflare, Inc.: secure routing of traffic to our servers.
- Google LLC (Sign-In, AdMob, Firebase Cloud Messaging, Google Play) and Apple Inc. (Sign in with Apple, App Store): authentication, advertising, notifications and payments.
Data is neither sold nor transferred, except as described above. Our own servers are located in the European Union.
8. Account and data deletion
You can delete your account in the game (Settings › Account › Delete my account) or on request (see Data deletion). The account is deactivated immediately; you have 30 days to cancel by signing in again. After this period, the data linked to the account is erased or pseudonymized: what remains carries no name or identity. The following may remain:
- fight results and Crooks under a neutral name, needed for other players' games;
- the accounting records that we must keep by law, including the purchase history;
- backups, until they expire;
- data held by Apple, Google, AdMob and Firebase, under their own policies;
- for a banned account, the hash described below.
Banned account and data erasure. If your account is banned at the time you request the erasure of your data, we erase your data as we would for any other account, with one exception: we keep a non-reversible cryptographic hash of your Google or Apple identifier. This hash contains neither your name, nor your email address, nor any other data, and it is not linked to any account. Its sole purpose is to refuse sign-in and the creation of an account with the same identity, in order to enforce the ban. This processing is based on our legitimate interest in protecting the game and its players against the circumvention of sanctions (Article 6(1)(f) of the GDPR). The hash is kept for 12 months and then deleted automatically. You may object to it by writing to us at the address given in this policy. If your account is not banned at the time of erasure, we do not keep any hash.
9. Your rights
You have the rights of access, rectification, erasure, portability, restriction and objection. To exercise them: [email protected]. You may also lodge a complaint with the French data protection authority, CNIL (www.cnil.fr).
10. Children
Crooks Arena is intended for people aged 13 and over. We do not knowingly collect data from children under 13; if you believe we have, contact us and we will delete it.
11. Changes
When this policy changes, the version and date at the top of this page are updated.