Privacy policy

1. Who we are

The game and this website are made by Andrii Ashomok, an independent developer, Av. Diego Ramírez Pastor 184, 03182 Torrevieja (Alicante), Spain. We are the data controller.

Contact: support@cheekpuffhamster.app. We have no data protection officer because the law does not require one for us; write to the email above for any privacy question.

2. Who the game is for: age screen and profiles

The game is for everyone: children, teens and adults. On first start it asks only for the year of birth from a neutral list. The game then picks a profile on the phone:

• Child: under 13.
• Teen: 13 up to the digital-consent age of the player's country (for example 16 in Spain; 16 if the country is unknown).
• Adult: older.

The country comes from the phone's SIM card or language settings and is used only on the phone. The year of birth is saved only in the game save on the phone. We do not receive it.

Where the law asks for it, Google Play may give the game an age range (Play Age Signals API). The game uses it only to make the profile stricter. We do not send it anywhere and do not use it for ads or analytics.

3. Data that stays on the phone

The game saves on the phone: the hamster and its name, coins, items, progress, settings, the year of birth and the profile. We cannot see this data. There is no account and no sign-in.

The game does not ask for location, contacts, camera, microphone or photos. It uses only two permissions: internet, and notifications (asked only when reminders are switched on). The advertising ID permission is removed from the app.

4. Ads: Google AdMob

The only ads are optional reward videos (“watch a video for coins”, at most 3 a day). Ads start only after the age screen. We use only Google AdMob, which takes part in Google Play's program for family-safe ad SDKs, and no other ad networks.

To show an ad, Google receives technical data: the IP address (which can show the approximate area), device and app information, interactions with the ad (for example, that a video was watched), diagnostic data and the app set ID (an ID for this app on this phone, used by Google for analytics and fraud prevention). For child requests, Google turns off personalised ads, remarketing and calls to third-party ad vendors.

Adults in the EEA, UK and Switzerland can change their ad choice at any time through Google's consent form. More: How Google uses information from apps that use its services.

5. Purchases: Google Play

Coin packs, a starter pack and “No ads” are sold through Google Play Billing. Google handles the payment; we never see card or bank details. Google Play gives us the order number, product, purchase token and dates, so that the game can deliver the purchase and we can handle refunds and tax.

For a child profile, real-money purchases are off until a grown-up switches them on. For children and teens a parent check appears before every purchase.

6. Firebase services (Google)

We use these Google Firebase services. We do not use Firebase Analytics.

• Crashlytics (only in the published app): when the game crashes, Google receives the crash details, device model, Android version, app version and Crashlytics and Firebase installation IDs (random IDs for this app install). We use it only to fix bugs. Kept for 90 days.
• Remote Config: the game downloads settings such as prices and game balance. Firebase uses a Firebase installation ID for this.
• Purchase check (only when we switch it on): the game sends the product, the purchase token and a random install ID made by the game (not linked to a person) to our server function. We store a hashed purchase token, the product, the Google order number, the random install ID, a test flag and dates, to stop the same purchase being used twice. Records are deleted automatically after about 13 months.
• Server time (only when we switch it on): the game asks our server for the current time, to protect daily gifts from clock changes. Nothing is stored.

Our server functions and their database run in Google Cloud in Belgium (europe-west1). Server functions see the IP address of a request for a short time to answer it.

7. Emails to us

If you write to support@cheekpuffhamster.app, we receive your email address and what you write. The email sent from the game also contains the app version and the game language. Emails are forwarded by Cloudflare Email Routing to our mailbox hosted by Google (Gmail). We use emails only to answer you.

8. Why we may use data (legal bases)

Under the GDPR we rely on:

• Contract: to provide the game and the things you buy.
• Consent: personalised ads for adults in the EEA, UK and Switzerland. You can withdraw consent at any time.
• Legitimate interests: non-personalised ads that keep the game free, crash reports to fix bugs, fraud prevention, and answering emails.
• Legal obligation: tax and accounting records for purchases.

9. Children's privacy

We follow the Google Play Families policy, the US Children's Online Privacy Protection Act (COPPA), the GDPR and the UK Age Appropriate Design Code. For children we:

• collect no name, email, photo, voice or location, and have no chat or sharing with other players;
• show only optional, non-personalised, child-safe ads, without the advertising ID;
• keep real-money purchases off by default and put a parent check before purchases, the grown-ups' section and outside links;
• use privacy-friendly settings by default and send no notifications at night.

The only data that leaves the phone for a child is the technical data described above (ads, crash reports, settings download, purchases made by a grown-up). A parent can ask us to review or delete any information about their child: write to support@cheekpuffhamster.app.

10. Who receives data

Google and Cloudflare act as our processors or as independent controllers under their own terms. We do not sell or rent data to anyone.

11. International transfers

Google and Cloudflare may process data outside the European Economic Area, for example in the United States. They are certified under the EU–US Data Privacy Framework and also use the European Commission's Standard Contractual Clauses.

12. How long we keep data (retention policy)

We keep data only as long as needed for the purposes above, and then delete it.

13. How we protect data (security program)

We have a written information-security program for the small amount of data we handle. Andrii Ashomok is responsible for it. It includes: the least data possible; encryption in transit (HTTPS/TLS) for everything the app and website send; two-step sign-in on all developer accounts; access for only one person; a yearly review of risks and of the services we use; and telling users and authorities about a data breach as the law requires.

14. Your rights

You can ask us to see, correct, delete or limit the use of your data, to receive it in a portable form, and to object to its use. Where we rely on consent, you can withdraw it at any time. Parents can use these rights for their children.

Because there is no account, please tell us anything that helps us find the data (for example, the Google Play order number). Write to support@cheekpuffhamster.app. We answer within one month. How to delete data: Delete my data.

You can complain to a data protection authority. In Spain this is the Agencia Española de Protección de Datos (AEPD). People in other countries can contact their local authority. Residents of US states have similar rights under their state laws and can use the same email.

15. This website

This website uses no cookies, no analytics, no trackers, no forms and no third-party fonts or scripts. It is hosted by Cloudflare, which may log IP addresses for a short time for security and to stop attacks.

16. Changes to this policy

If we change this policy, we update the date at the top and explain what changed. If the game starts using new data, we update this policy and the Google Play Data safety form before that version of the game is published.

This policy is available in English, Spanish, Russian and Ukrainian. If the versions differ, the English version applies.