Privacy Policy

Controller

Galaxy Reclaimer is published on Google Play by Babiak Studio. The data controller is BS4U Przemysław Babiak, Polish tax ID (NIP) 7551916520, Kościuszki 2/4, 48-200 Prudnik, Poland. Privacy requests may be sent to pb.bs4u@gmail.com.

Data processed by the game

The game stores progress, settings, missions, virtual currency and upgrades on the device. When Google Play Games sign-in and Saved Games are available, progress may also be synchronized with the player's Google account through Google Play Games. To keep only the newest account session active, the game sends the publisher's server a random installation reference that is not derived from hardware or advertising identifiers. The server stores only a cryptographic hash of that reference with the API session.

For purchase verification, delivery, restoration and refunds, the publisher's purchase server processes the Google Play Games player identifier, API session records, product identifier, purchase token hash and encrypted token, Google order and purchase status, entitlement and settlement state, revocation source and reason, the hash of a pending chargeback-review token, the refund preference and product-delivery evidence sent to Google, Google response data and technical timestamps. The server does not receive payment-card details.

The game does not request precise GPS location, contacts, messages, photos, user files, microphone or camera access.

Leaderboard and Play Integrity

When the player voluntarily chooses a unique pilot name, the game publishes that name, the cumulative score and the current ship level in the global leaderboard. The server also stores the technical Google Play Games profile identifier, one-use hashes of started-run tokens, score, ship level and technical timestamps. The Google Play profile identifier is never shown to other players.

Score submissions are protected by Google Play Integrity. For this purpose Google processes a hash of the specific request, package name, app version, signing-certificate information, licensing status and app/device integrity signals. The publisher's server receives Google's verified verdict and accepts the score only when the request originates from a recognized, licensed build on a device that meets the integrity requirements. The request hash contains no free-form text or password.

Optional diagnostics

Optional diagnostics are disabled by default. Only when the player enables “Share optional diagnostics” in the game settings, the game sends the publisher's server a limited allow-listed set of stability, campaign and coarse integration-failure categories: app version, technical timestamps, an unclean previous-session indicator, mission start, completion or abandonment, galaxy identifier, numeric planet or round index, and a category indicating an API, billing, purchase-verification or Play Integrity failure. These pseudonymous events are linked to the existing Play Games server session so duplicate submissions can be prevented. The game does not include free-form text, advertising identifiers, a device identifier, IP-derived location or purchase tokens in this diagnostic payload. Disabling the option stops collection and removes events waiting on the device.

Advertising and consent

Galaxy Reclaimer uses Google AdMob and Google's User Messaging Platform. The Google Mobile Ads SDK automatically collects and shares IP address, user interactions including app launches, taps and video views, diagnostic information, and device or account identifiers for advertising, analytics, and fraud prevention, security and compliance. Google and its advertising partners may also process approximate location inferred from the IP address, advertising identifiers, consent choices and technical, session and advertising data to deliver and measure ads and maintain the service. Where required, the consent form is shown before advertising services are initialized. Consent choices can be reviewed from the game's settings.

Purchases

Payments are processed by Google Play Billing. The game and the publisher's server receive only the information needed to verify and deliver a product, restore an entitlement, prevent duplicate grants, handle a refund or revocation and prevent abuse. Purchase tokens are never written to application logs by design.

After a refund or chargeback, the purchased benefit may be revoked. Unused coins are removed, and any unrecovered portion of a spent package becomes a debt repaid by later coin awards before those coins can be spent. Repeated chargebacks may temporarily disable paid purchases or send the account for manual review. A new order created while such a restriction is active is not delivered and is refunded through Google Play. The No Ads benefit is disabled when its purchase is revoked. A player may dispute an enforcement action using the contact address below and the Google order number, without sending a purchase token or password.

Purposes and legal bases

Data is processed to provide the game and requested cross-device features, perform the purchase contract, secure the service and prevent fraud, meet accounting and legal duties, display or measure advertising on the basis required in the player's region and, only with opt-in consent, identify stability problems and improve campaign balance. Consent can be withdrawn at any time in the game settings where consent is the applicable basis.

Retention

Local data remains until the app data is cleared or the game is uninstalled. Google Play Games cloud data remains under the player's Google account until deleted through the relevant Google service or a deletion request. The leaderboard profile and accepted score history remain active until a profile-deletion request is completed. Unfinished run tokens expire after 6 hours. Purchase API sessions expire after at most 30 days. Optional diagnostic events are deleted from the publisher's server after 90 days. Purchase and refund records are kept only as long as needed to deliver and audit entitlements, resolve disputes, prevent repeated grants and satisfy legal or accounting obligations, after which they are deleted or anonymized.

Recipients and international transfers

Data may be processed by Google as the provider of Google Play Games, Google Play Billing, Play Integrity, AdMob and consent services, and by infrastructure providers used to host the API and database. These providers may process data outside Poland or the European Economic Area using the safeguards described in their privacy terms.

Security

Connections to the purchase API use HTTPS. Session and purchase tokens are stored as hashes where lookup is sufficient; recoverable purchase tokens are encrypted at rest when required for settlement with Google. Access to production secrets and the database is restricted to the service.

Rights and deletion

Depending on applicable law, the player may request access, rectification, deletion, restriction, portability or objection, and may withdraw consent. Requests should be sent to pb.bs4u@gmail.com. The request should include enough information to identify the relevant Play Games profile without sending a purchase token or password. A complaint may be lodged with the President of the Polish Personal Data Protection Office.

Children

The game is intended for users aged 16 and older and is not directed to children under 16.