1. Who we are
SPiGAME is operated by Fulcrum Group Ltd, a company registered in England and Wales. We are the controller of your personal data. ICO registration number: ZC267475. Contact: privacy@spigame.com.
2. Who can play
- You must be 13 or over to play. We do not knowingly collect data from children under 13. If we learn an under-13 has an account, we delete it.
- Players aged 13 to 17 ("Cadets") get a protected experience, set on our servers:
- adults cannot target, track or message Cadets;
- Cadets play PvP only with other Cadets, in daylight, at public places;
- Cadets' positions on the map are never shown precisely;
- there is a monthly spending cap.
3. What we collect, why, and our lawful basis
| Data | Why | Lawful basis (UK GDPR Art. 6) | How long |
|---|---|---|---|
| Email, password (stored hashed by our authentication provider), player ID, agent name | Your account, sign-in, support | Contract | While your account exists |
| Date of birth / age band, Cadet status, consent status | Age-appropriate design; meeting our legal duties to children | Legal obligation; legitimate interests | While your account exists |
| Parent or guardian's name and email (Cadets) | Asking for and recording consent | Legal obligation; legitimate interests | While the Cadet account exists. If a parent refuses, or a request expires unanswered: deleted 30 days later |
| Precise location, while you use the app only | Missions at real places, nearby players, keeping restricted areas out of play, cheat prevention | Contract; legitimate interests (fraud prevention) | Live map position: replaced on each update and deleted after 24 hours. Location history samples: 30 days. Mission results keep no coordinates |
| Gameplay data (missions, items, credits, rank, organisations) | Running the game | Contract | While your account exists |
| Chat messages and content you create | Communication between players; safety and moderation | Contract; legitimate interests (safety) | 12 months from sending. Reported messages and moderation records: 2 years after the case closes. Messages are not end-to-end encrypted. |
| Push notification token | Sending notifications you allowed | Consent (device prompt) | Until you sign out, turn notifications off, or 270 days without use |
| Purchase records (store transaction IDs, product, amount; never card details) | Delivering purchases, refunds, fraud prevention, Cadet spending cap | Contract; legal obligation (tax) | 6 years after the purchase (UK tax rules) |
| Crash and performance data | Fixing bugs | Legitimate interests | 90 days at most |
| Gameplay analytics (first-party) | Improving the game | Legitimate interests. Not used to profile Cadets. | 13 months, then kept only as totals with no identifiers |
| Advertising identifiers and ad interaction data (Google AdMob) | Showing ads, including optional rewarded ads | Consent for personalised ads (UK/EEA consent form). Cadets, unverified-age players and all iOS players get non-personalised ads only. | As set by Google |
| Camera feed | The optional AR view | Contract | Processed on your device. Not stored or uploaded. |
| Support emails | Answering you | Legitimate interests | 2 years after your request is closed |
| Security and audit logs (sign-ins, admin actions) | Keeping accounts and the service secure | Legitimate interests | 12 months |
Backups roll over within 7 days.
We do not sell your personal data. We do not use it for cross-app tracking, and we don't ask iOS for tracking permission.
4. Who we share data with
These service providers process data for us under contract:
- Supabase (database, authentication, server functions), hosted in the EU (Ireland, AWS eu-west-1).
- Expo / EAS (app delivery and push notifications).
- Apple and Google (app stores, payments, push).
- RevenueCat (purchase validation).
- Sentry (crash reports).
- Google AdMob (ads). For personalised ads, AdMob may act as an independent controller under Google's terms.
- AI image tools used by our studio to make card art before release. No player data is sent to them, and players cannot generate AI content in the app.
We may disclose data where the law requires it, or to protect players' safety.
International transfers: some providers process data outside the UK (for example, in the US). We rely on UK adequacy regulations, the UK International Data Transfer Agreement or Addendum, or EU Standard Contractual Clauses.
5. Children's privacy (UK Age Appropriate Design Code)
We follow the ICO's Children's Code for players under 18:
- high-privacy settings by default;
- no profiling for advertising;
- location used only while playing and never shown precisely to others;
- no nudges to share more data;
- parental controls that can only make settings stricter.
6. Your rights
You can ask to access, correct, delete, restrict or move your data, or object to how we use it. Parents can exercise these rights for Cadets. Email privacy@spigame.com. We reply within one month. You can complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113.
7. Deleting your account
- In the app: Settings > Delete account.
- On the web: spigame.com/delete-account
8. Security
- Data is encrypted in transit (TLS) and at rest by our hosting provider.
- Access is restricted by row-level security and least-privilege server functions.
- We do not claim end-to-end encryption.
9. Changes
We'll tell you in the app before material changes take effect.
10. Contact
Fulcrum Group Ltd. privacy@spigame.com. ICO registration number ZC267475.