Curl Clash — Privacy Policy
Last updated: 10 October 2026
Curl Clash collects only what it needs to run online matches, rankings and friends, crash reports to fix bugs, and — through Google AdMob — what is needed to show the ads that keep the game free. It does not sell your data, keeps only simple daily usage counts on its own server, and uses no third-party analytics or tracking.
Who we are
This policy covers the Curl Clash mobile game and the website curlclash.com. The data controller is Åke Joakim Gudmunds, an individual developer based in Sweden ("we", "us").
Contact for anything about your data: privacy@curlclash.com.
This policy applies to everyone who installs or plays Curl Clash, whether offline against the bot or online against other players.
What data we collect
Curl Clash has no sign-up. When you first go online, the game creates an account tied to an identifier of your device. We never ask for your real name, email, phone number, location or contacts.
| Data | Examples | When | Stored |
|---|---|---|---|
| Device identifier | An app-specific ID generated by your device | First time you go online | Game server |
| Account data | Internal user ID, a random username, the display name you choose | When you go online / pick a name | Game server |
| Gameplay data | Match results, scores, opponents, ranked division and rating, placement progress | Online and ranked matches | Game server |
| Social data | Friends list, friend requests, match challenges, private match codes | When you use friends or play with a friend | Game server |
| Cosmetics | Stone skins you own and have equipped | When you unlock or equip items | Game server and your device |
| Technical data | IP address and connection times in server logs | Every connection to the game server | Game server logs |
| Crash and error reports | Error message, device model, OS version, app version, recent in-game events (e.g. "match started") | When the game hits an error on a phone | Sentry (EU) |
| Usage counts | Daily totals per account: ads shown and watched, ticket prompts, how long the ranked queue took | During play | Game server |
| Advertising data | Your device's advertising ID, IP address, device and app information, ad interactions, your consent choice | When the game loads or shows an ad | Google (AdMob) |
| Local settings | Sound, language, graphics quality, tutorial progress, ticket and ad counters | On your device | Your device only |
Your display name, ranked division and match results are visible to other players you play against or who search for you, and on the leaderboard. Crash reports never contain your display name or friends, and the game has no chat.
How we use it
We use your data to run the game, keep it fair and working, and pay for it with ads. We do not profile you for advertising ourselves and we do not sell or rent your data.
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Run online and private matches, matchmaking, friends and challenges | Device identifier, account, gameplay and social data | Contract — providing the game you asked to play (Art. 6(1)(b)) |
| Ranked ladder, divisions and the leaderboard | Gameplay data | Contract (Art. 6(1)(b)) |
| Keep your cosmetics and progress across sessions | Account data, cosmetics | Contract (Art. 6(1)(b)) |
| Prevent cheating, abuse and spam (e.g. rate limits, result validation) | Gameplay data, technical data | Legitimate interest in a fair, secure game (Art. 6(1)(f)) |
| Find and fix crashes and bugs | Crash and error reports | Legitimate interest in a stable game (Art. 6(1)(f)) |
| See how ads, tickets and matchmaking work so we can tune them (e.g. fewer ads, shorter queues) | Usage counts | Legitimate interest in a balanced, working game (Art. 6(1)(f)) |
| Personalised ads (Google AdMob) | Advertising data | Your consent (Art. 6(1)(a)), asked in the game before any personalised ad is shown |
| Non-personalised ads, ad fraud prevention and frequency limits | Advertising data without the advertising ID used for profiling | Legitimate interest in funding a free game (Art. 6(1)(f)); storage on your device only with consent where the law requires it |
| Answer your requests | Whatever you send us by email | Legitimate interest / legal obligation (Art. 6(1)(f), (c)) |
We make no decisions about you based solely on automated processing that have legal or similarly significant effects. Matchmaking and ranking only decide who you play and which division you are shown.
Who we share it with
We share data only with the service providers below, who process it on our behalf under a data processing agreement, and with authorities when the law requires it.
| Provider | What it does | Data | Location |
|---|---|---|---|
| Hetzner Online GmbH | Hosts our game server (Nakama) and its database | All game-server data and server logs | Finland (Helsinki) |
| Functional Software, Inc. (Sentry) | Crash and error reporting | Crash and error reports | EU (Germany) data region |
| Vercel Inc. | Hosts the curlclash.com website | Standard web server logs (IP address, browser) when you visit the site | Global edge network (USA-based company) |
| Google (Google Play) | Distributes and updates the app | Governed by Google's own privacy policy | |
| Google Ireland Ltd. (Google AdMob) | Shows ads in the game and asks for your consent (Google's User Messaging Platform) | Advertising data | EU and USA |
Other players see your display name, ranked division, equipped stone skin and match results.
Ads. The game shows ads from Google AdMob: an optional ad to refill ranked tickets, and an ad break between ends in bot matches. Players in the EU/EEA, the UK and Switzerland are asked for consent the first time the game starts, before any ad is requested. If you decline, you can still play and see ads, but they are not personalised. You can change your choice at any time in the game under Settings → Privacy settings, and reset or delete your advertising ID in your phone's settings (Android: Settings → Google → Ads). Google uses this data as described in Google's privacy policy and how Google uses information from apps that use its services. Google lists the ad technology partners it works with in the consent dialog.
Not used: third-party analytics or tracking SDKs, in-app purchases. The usage counts above stay on our own server and are never shared. If we add purchases, we will update this policy first.
How long we keep it
We keep your account and game data while your account is in use, and delete it on request or after 24 months without any online play.
| Data | Kept for |
|---|---|
| Account, gameplay, social and cosmetics data | Until you delete your account, or 24 months after your last online session |
| Usage counts | Same as your account |
| Match history | Same as your account; in other players' history your name is replaced by "Deleted player" |
| Server logs (IP address, connection times) | 30 days |
| Crash and error reports | 90 days (Sentry retention) |
| Advertising data | Set by Google; see Google's privacy policy. Your consent choice is stored on your device until you change it or clear the app's data |
| Data on your device | Until you clear the app's data or uninstall it |
Deleting your account: see curlclash.com/delete-account. In the game: Settings → Delete account. Or email privacy@curlclash.com with your display name. We delete the account and all its game-server data within 30 days. Uninstalling the game removes local data but does not delete your online account.
Your rights
You can ask us at any time to see, correct, export or delete your data, and we answer within one month.
Under the GDPR you have the right to:
- Access — get a copy of the data we hold about you
- Rectification — have wrong data corrected (you can also change your display name in the game)
- Erasure — have your account and data deleted
- Restriction — ask us to pause using your data while a request is handled
- Portability — receive your game data in a machine-readable format
- Objection — object to uses based on our legitimate interest, such as crash reporting
- Withdraw consent — for personalised ads, at any time in Settings → Privacy settings, without affecting what happened before
To use any of these rights, email privacy@curlclash.com with your display name. We may ask a question to make sure the request comes from the account owner.
If you think we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection (IMY) or the data protection authority where you live.
Children
Curl Clash is not directed at children under 13, and we do not knowingly collect data from them. In the EU, players under 13 (the age of digital consent in Sweden) should only play online with a parent's permission. If you believe a child has given us data without that, email us and we will delete it.
Security and transfers
All traffic between the game and our server is encrypted (HTTPS/TLS), and the server only accepts game actions it can validate. Our game server and crash reporting are hosted in the EU. Google and Vercel may process data in the USA; for that we rely on the EU–U.S. Data Privacy Framework (both companies are certified) or the EU Standard Contractual Clauses.
Changes to this policy
We will post any change on this page and update the date at the top. If a change affects how we use data you already gave us, we will also tell you in the game before it takes effect.
Contact
Åke Joakim Gudmunds, Sweden — privacy@curlclash.com