Privacy Policy

Effective date: 2026-09-13
Last updated: 2026-10-04

1. Who we are

Skitgubbe ("the App") is operated by Jonas Borggren, who is the data controller for the personal data described in this policy.

Contact: jonasborggren [at] gmail [dot] com

2. What we collect

The game and the services it uses process the data described below, including the advertising data in section 5.

Account. Your email address, when you register or sign in with Google or Apple. Your password, stored only as a bcrypt hash — we never store the password itself. Accounts that sign in with Google or Apple have no password.

Profile. Display name, chosen avatar, a friend code we generate so other players can add you, and when you were last active.

Gameplay. Matches you take part in, including game state, results, placements and statistics. Achievements you have unlocked and rewards you have claimed.

Social. Friend relationships, pending friend requests, and notifications sent between you and other players.

Purchases. Receipts and purchase tokens from the App Store and Google Play, needed to verify a purchase and grant what you bought. Your in-game coin balance and which items you own.

Device. Device registration can take place before you allow visible notifications. We process a device identifier generated by the App, a push token from Firebase Cloud Messaging, your language setting, which platform the App runs on, the App’s version number, and which notifications you have turned on.

Security. When an account is created we record the IP address the request came from, the App or browser identification it sent, and your email address, so that we can detect and stop automated account creation. We also keep a keyed hash of the IP address — not the address itself — together with a count of accounts created from it, for the same purpose. We do not use any of this to profile you, and we do not use it for advertising.

3. What we do not collect

The game does not request access to GPS location, contacts, photos, camera, microphone or calendar. We do not run a crash-reporting service, and we do not use analytics to follow how you play individual matches. Recent app versions use Google Analytics for Firebase only to measure whether our own ads lead to installs, as described in section 5. We do not use IP addresses to work out where you are or to build a profile of you; we use them only for the security purpose described in section 2. Advertising SDKs may separately process diagnostics and estimate a general location from an IP address, as explained in section 5. We request non-personalised ads; this does not mean that advertising involves no data processing.

The App writes a diagnostic log on your device so you can report problems. That log stays on your device and is never uploaded to us.

4. Why we process your data

Creating and maintaining your account, running matches and statistics, handling friends and notifications, and verifying purchases are all necessary to provide the game to you (performance of a contract).

Push notifications, advertising and measuring our own ads (section 5) are based on your consent, which you can withdraw at any time. Keeping the service secure and free of abuse is based on our legitimate interest.

5. Advertising

The App shows advertisements through Google AdMob.

We only request non-personalised advertisements. These are chosen based on the content you are currently viewing, not on your behaviour over time or across other apps. Google may process IP addresses (including to estimate general location), device identifiers, advertising interactions, crash logs and performance information to deliver and measure ads, prevent abuse and improve its services.

Recent app versions check Google's consent status before requesting ads and provide Settings → Ad privacy when Google requires a privacy-options entry point. Older versions may lack this control; update the app or contact us for help with privacy choices. Notification permission can be changed in your device settings.

Measuring our own ads. When we advertise Skitgubbe in other apps and services, we need to know whether those ads lead to installs. For this, recent app versions use Google Analytics for Firebase. It records when the App is opened for the first time and basic usage events such as sessions, together with an app-instance identifier, the App's version, device model, operating system, language and approximate country. Automatic screen tracking is turned off, and we never allow this data to be used for personalised advertising. Analytics only starts collecting after you have given consent in Google's consent dialog where that dialog is required, and you can change your choice in Settings → Ad privacy.

iPhone and iPad. The App asks for permission under Apple's App Tracking Transparency. If you allow it, Google may receive your device's advertising identifier (IDFA) to attribute installs from our ads. If you decline, no advertising identifier is shared and attribution relies on Apple's privacy-preserving methods (SKAdNetwork). You can change this at any time in iOS Settings → Privacy & Security → Tracking. Declining does not affect the game.

Google's handling of this data is described at policies.google.com/technologies/partner-sites.

6. Who we share data with

We do not sell your personal data, and we do not share it for advertising purposes beyond what section 5 describes.

We use Google AdMob for advertising, Google Analytics for Firebase to measure installs from our own ads, Google Firebase Cloud Messaging to deliver push notifications, the Apple App Store and Google Play to verify purchases, and Fly.io to host our servers and database.

Google Play Games and Apple Game Center receive your achievements and win count, but only if you choose to link your account. Linking to your Skitgubbe account requires your confirmation in recent versions. The platform may authenticate you separately. If you choose to import a name during onboarding, the App reads your platform profile to prefill an editable name; this does not link achievements.

Sign in with Apple. Recent versions send Apple’s one-time authorization code to our server. We exchange it for an encrypted token used to revoke Apple authorization when you delete your account. Passwords and Apple private keys are not sent to other players.

7. Where your data is stored

Your data is stored on servers in Europe. Where a processor transfers data outside the EU/EEA, that transfer is covered by the European Commission's standard contractual clauses or an adequacy decision.

8. How long we keep it

We keep your account data for as long as your account exists.

Deleting from inside the App takes effect immediately. Deleting through the website takes effect 30 days after you ask. The delay exists because the web form has only your email address and password to go on, and without it a leaked password would be enough for someone else to delete your account for good. You can cancel during those 30 days by emailing us.

When the deletion takes effect we delete your account, profile, friends, statistics, achievements, purchases and device registrations. This is not reversible. Matches still in progress are aborted, and coins or items you have bought are not refunded.

Account-link abuse prevention. A keyed hash of a linked Game Center or Google Play Games identity remains after account deletion to prevent reusing that identity on another account. Its link to your deleted Skitgubbe user ID is removed. We retain this reservation for the lifetime of the account-linking service. It is a pseudonymous identifier, not the original platform ID. We process it for our legitimate interest in preventing repeated rewards and account-link abuse.

Apple token revocation. Encrypted Apple tokens are kept while the account exists. On deletion they are queued for revocation without the deleted user ID and removed after Apple confirms revocation. Temporary Apple outages may delay that step; they do not delay deletion of your game account. For older sign-ins where no usable Apple token was obtained, you can remove Skitgubbe under your Apple Account’s Sign in with Apple settings.

Security records. Server logs containing IP addresses are kept for as long as our hosting provider retains them and are not copied anywhere else. The keyed hash and account count described in section 2 are kept for as long as the App is operated, because their purpose is to recognise repeated automated sign-ups over time. The hash cannot be turned back into an IP address.

Ad measurement. Google Analytics for Firebase event data is kept for 2 months and then deleted automatically.

Records we are required to keep for accounting purposes, such as proof of a purchase, are retained for as long as the law requires. Accounts inactive for more than 2 years may be deleted.

9. Deleting your account

In the App: Settings → Delete account. You will be asked to type a confirmation phrase, and the deletion takes effect immediately.

On the web: spelaskitgubbe.se/radera — enter the email address and password registered to the account. The deletion takes effect 30 days later, and you can cancel it before then by emailing us.

If you sign in with Google or Apple your account has no password, so the web form cannot verify that it is you. Delete from inside the App instead, or email us from the address registered to your account.

10. Your rights

Under the GDPR you have the right to access your data, to have it corrected, to have it erased, to receive a copy in a portable format, to object to processing based on legitimate interest, and to restrict processing. Email us to exercise any of them.

If you believe we handle your data incorrectly, you may lodge a complaint with the Swedish Authority for Privacy Protection (IMY), imy.se, or with the supervisory authority in your own country.

11. Children

The App is not directed to children under 13. We do not knowingly collect personal data from children under that age. If you believe a child has given us personal data, contact us and we will delete it.

12. Changes to this policy

If we change this policy we will update the date above. Significant changes will be announced in the App before they take effect.

13. Contact

jonasborggren [at] gmail [dot] com