Privacy Policy

Last updated October 27, 2026Effective October 6, 2026

This Privacy Policy explains what information buggs.io collects when you play the game or visit our website at https://buggs.io. It also covers why we collect it, who we share it with, how long we keep it, and the rights and choices you have. It applies to the web game, the website, our Android app, and our iOS and desktop apps as each one is released. In the game, Settings ▸ About ▸ Privacy Policy opens this page, and every checkout links to it before you pay.

We built buggs.io to need as little about you as possible. There is no email sign-up and no password: your account is a random ID stored on your device. The game is played online, though, so some information has to reach our servers. This page tells you what that information is.

In short

Your account is a random Player ID kept on your device. The game doesn't ask for your name, email address or phone number.
Your nickname is public. Other players and visitors to our website can see it on leaderboards, in arenas and in clubs. Don't use your real name.
Stripe, Apple or Google handle your payments. We never see your full card number.
We ask for your birth year only when you first go to buy something, use a store offer or watch an ad, such as Start Big, Boost Cubes or a free coin offer. We keep only an age group (child, teen or adult), never the year.
The game can show ads from Google: optional ads you choose to watch for a reward, and short ads between games (never during one). Every ad is non-personalized: it isn't chosen from what you do on other sites and apps, and we never use an advertising ID. A player's age group sets stricter rules for children and teens, nobody sees an ad before the game knows their age group, and our website pages show no ads at all (see Advertising).
The game includes no third-party analytics. Our game server keeps its own statistics about online play, such as how many people play and which bugs they pick. It counts you under a code instead of your Player ID, keeps the daily lists of codes for 35 days and shares them with no one (see Game statistics). Our website pages (not the game) use Google Analytics to count visits, with all its advertising features off. In the EEA, the UK and Switzerland it sets no cookies, and anyone can switch it off (see Analytics on our website). We don't sell your information. The one thing US privacy laws may call "sharing" it for advertising is described in the next point, and you can switch it off.
If you come to buggs.io from one of our ads or campaign links, or install the app from one, our account service notes which campaign it was, so we can tell which campaigns bring new players. On the web it may also keep the ad's click ID for 90 days and tell that ad network (Google, Meta or TikTok) when the click led to a new account or a first purchase, so it can measure our ads. It never does this for a child's or a teen's account, for players in the EEA, the UK or Switzerland, or when your browser sends Global Privacy Control, and you can switch it off (see Where you came from and Your choices).
You can delete your account in the game (Settings ▸ Account ▸ Delete account) or by emailing support@buggs.io with your Player ID.

Who we are

buggs.io is run by POWERUP GAMING LLC, a limited liability company based in TN, United States, doing business as buggs.io. In this policy, "we", "us" and "our" mean POWERUP GAMING LLC, doing business as buggs.io. We decide how and why your information is used. That makes us the "controller" under laws like the GDPR, and the business responsible for your information under US state privacy laws, where those laws apply to us.

Player accounts, purchases and live events run on DPS, our account and purchase service. DPS is run by us or on our behalf. The information in it is used only to run buggs.io. When this policy says "our account service", it means DPS. The game reaches it at https://api.darkpatternssoftware.com.

Email: support@buggs.io is our one address for support, privacy questions, parents' requests and legal notices.
Post: POWERUP GAMING LLC, 311 Chimney Rdg, Nolensville TN, 37135

Information we collect

We get information in six ways, set out below.

(a) Automatically, from your device and connection

Player ID. The first time you open the game, it creates a random ID and saves it on your device. This ID is not based on your device's hardware, your phone number or any advertising ID. It tells our servers which account is yours. It stays the same if you use "Erase save". You get a new one if you delete your account or start a new profile.
Account details. When the game first connects to our account service, it registers your Player ID along with your nickname and your platform (web, iOS, Android or desktop). Our account service gives your device a secret access token and records when your account was created and last used. The game also sends its version number with each request.
IP address. Your device's IP address reaches our servers every time you connect. Our game server and account service hold it in memory for a short time (at most about 24 hours) to limit abuse, for example too many connections or too many wrong transfer or recovery codes from one address. They don't write it to their logs or databases. The only exception is when a payment provider includes an IP address in a purchase message (see (e) below). When you report a nickname, our game server keeps a scrambled code made from it for 24 hours (see (b) below), never the address itself. Cloudflare, which carries all traffic to buggs.io, also processes it (see Who we share information with). When you visit our website pages, Google Analytics receives it too, uses it only to work out an approximate location and then discards it (see Analytics on our website). When the game asks for an ad, Google receives it with the ad request (see Advertising).
Connection and server logs. Our game server keeps a technical log. It records when a player joins or leaves an arena, with the player's nickname, chosen bug and the time. It also records errors. The connection between Cloudflare and our servers keeps its own log of connection status and errors. Both logs are rotated daily, and old ones are deleted automatically after 14 days. We use these logs to keep the game running and to look into problems and abuse.
Screen shape. When you join an arena, the game sends the shape (aspect ratio) of your screen so the server can fit your view. This is used only during the match.
Website visits. When you visit our website, our servers get only what is needed to deliver the page, such as your IP address and the page you asked for. Our home page also asks our game server how many people are playing, and may start loading the game in the background so it opens faster. These requests carry nothing more than any page request does. Cloudflare processes them too. Our website pages (the home page, our help and legal pages and our "page not found" page, not the game) also use Google Analytics, unless you or your browser have switched it off. It sends Google information about your visit, such as the pages you view, your type of device and your approximate location. See Analytics on our website.

(b) Information you give us

Nickname. This is the name you play under. It is public (see What other people can see). Please don't use your real name or anything else that identifies you.
Club names and reports. If you create a club, its name is public. If you report a club, we store the reason you picked and your Player ID so we can act on the report.
Nickname reports. If you report another player's nickname in the game, our game server stores the nickname, the reason you picked, where you saw it (in an arena or on a leaderboard) and when. It doesn't store your Player ID, your nickname or your IP address with the report. To count how many different players reported a name, and to stop the same player reporting it twice in a day, it keeps a scrambled code made from your IP address (or, without one, from your Player ID) that can't be turned back into either, and erases it after 24 hours. The player you report isn't told who reported them.
Age group. The first time you tap something in the lobby that involves buying, a store offer or an ad (such as Buy, Start Big, Boost Cubes, a free coin offer or Watch ad), or once after a few games while the game shows ads, it asks for your birth year. Our account service turns the year into an age group (child, teen or adult) and stores only that group and the date it was set. The birth year itself is never stored. After that, only support can change the age group.
Parental consent. If a parent approves purchases on a child's account, we record that consent was given, when, and how it was checked.
Support emails. When you email us, we get your email address, your message and anything you include, such as your Player ID or purchase details.
Transfers and recovery codes. You can use a transfer code to move your account to another device or merge two accounts. You can also make a recovery code, which brings your account back on any device later. For both kinds of code, we store only a scrambled (hashed) version, never the code itself. We also keep a record of transfers, and of when your recovery code was made and used. Because we don't keep the code, we can't show you a recovery code again.

(c) Gameplay information

When you play online, our game server and account service record:

your runs: the mode and arena, the bug and cosmetics you used, your score (peak size), kills, how long you lasted, your place in the arena, how the run ended, and any boosts you used;
your online XP and level, your per-bug online progress and run records (the online XP each bug has earned; your number of online games, total kills and time played, and your best size, kills and place), the bugs, power-ups and cosmetics you have unlocked, coins earned and spent, and the items you own;
your daily, weekly and monthly leaderboard entries;
your progress in quests, passes, seasons and events, and the rewards you claimed;
your club membership, role and weekly club points;
which in-game news posts you have opened.

Some arenas need a match pass. Our account service gives the game a signed, short-lived pass that holds your Player ID, what you're entitled to, your age group and the game's version number, so the game server can apply the right rules. If a match starts without a pass, the game server may instead ask our account service which of the bugs, power-ups and looks you picked your account can use, sending your Player ID and the game's version number; this check stores nothing new. Offline matches against bots are not reported to our servers. Coins you spend in them are still synced with your account.

When you join an online game, the game also tells our game server which platform it runs on (web, iOS, Android, Windows, macOS or Linux) and its version number. Our game server uses this, together with what it already receives while you play, such as the bug and power-ups you picked and how long you played, to keep the statistics described in Game statistics.

(d) Purchase information

What you bought, the price and currency, the date, the platform and the payment provider.
The status of the purchase or subscription: paid, renewed, cancelled, refunded or disputed.
Reference numbers from the payment provider, such as Stripe payment, customer and subscription IDs, Apple transaction IDs or Google purchase tokens.
Your coin balance, a ledger of every coin added or removed, and the items and benefits each purchase gave you.
Refunds and chargebacks, and anything reversed because of them.

On the web and desktop, purchases are sold through Link, a Stripe service that is the merchant of record and processes the payment. Apple processes payments on the App Store and Google on Google Play. We never receive or store your full card number or security code. On the web, checkout runs on Stripe's own pages. Stripe asks for your email address, name and billing address there, which it needs for tax and receipts, and keeps those details under its own policies (see Stripe's privacy policy). You can ask Link to delete the details it holds about your purchases. We send Stripe your Player ID so the payment can be matched to your account.

(e) Information from app stores and payment providers

When you buy something, the payment provider sends our account service a message confirming the purchase. Later messages report renewals, refunds or disputes. We keep these messages with our transaction records. They contain the transaction details: product, price, currency, dates and reference numbers. They can also include the country of your store account. Stripe's messages can also include:

the email address, name and billing address you entered at Stripe Checkout;
limited card details, such as the card brand, the last four digits and the expiry date;
occasionally, an IP address or details of the device used to pay, for example when a payment is checked for fraud or disputed;
links to Stripe's receipt and invoice pages for the payment.

If you use Restore purchases in an app that offers it (the Android app does), we receive the App Store's or Google Play's record of your past purchases so we can return them to your account.

(f) Where you came from

To learn which of our ads and campaigns bring new players, and what each new player costs us, our account service notes where a new account came from. It does this once, in the account's first day:

Web. If you open our website or the game from a link with campaign tags in its address, such as "utm_source" or "utm_campaign", the home page passes them on to the game, which reads them when it starts and removes them from the address bar. A link from an ad can also carry the ad's click ID, a code that Google, Microsoft, TikTok or Meta add to their ad links ("gclid", "gbraid", "wbraid", "msclkid", "ttclid" or "fbclid"). Nothing about this is stored in your browser.
Android. The first time you open the app, it asks Google Play how the app was installed (the "install referrer"), for example from a search in the store, or from a Google ad, which can include the ad's click ID. If the Facebook, Instagram or Facebook Lite app is on your device, the game also asks it whether the install came from one of our ads on Meta (Meta's "install referrer"). Meta's answer is encrypted; our account service decrypts it into the numbers of the campaign and the ad, keeps those as campaign labels and deletes the rest.
iOS. The first time you open the app, it asks Apple's AdServices for a one-time code and sends it to Apple Ads. Apple answers whether the app was installed from one of our Apple Ads campaigns and, if so, which campaign, ad group and keyword. This needs no permission to track you and uses no advertising ID. For our ads on other networks, the app uses Apple's SKAdNetwork: it tells iOS that it was opened for the first time and, on an adult's account, that a purchase was made. If an ad led to the install, iOS later tells that ad network that the install happened and how far it got, without anything that identifies you, your device or your account. We never see these notices.

We store the campaign labels with your account: the source, medium, campaign, content and term, and the platform. We keep a click ID only when nothing says not to. We never keep one for a child's or a teen's account, for a connection from the EEA, the UK or Switzerland, for a connection whose country we can't tell, or when your browser sends Global Privacy Control. On the web, the game also leaves it out when your browser sends Do Not Track or you have switched off analytics and ad measurement on our website, and then asks our account service to delete one it already holds for you (see Your choices). With a click ID from the web we also keep your browser's user agent (the line that names your browser and its version and your operating system), because Meta and TikTok need it with a website event. If an account's age group turns out to be a child's or a teen's, we delete its click ID and user agent. Both are deleted after 90 days in any case.

What we tell ad networks. When we kept a click ID from a Google, Meta or TikTok ad on the web, our account service tells that network, within 7 days, when the account was created (a "sign-up") and when it first made a real-money purchase, with the purchase's value. It sends the click ID, the event, its time, the value and, to Meta and TikTok, your browser's user agent. It sends nothing else: no Player ID, nickname, email address, IP address, device ID or advertising ID. The network uses this under its own terms and privacy policy to count which of our ads led to new players and purchases, and to decide whom to show our ads to, which US privacy laws may call "sharing" for cross-context behavioral advertising. We never do it for a child's or a teen's account, for players in the EEA, the UK or Switzerland, after you opt out, or after you delete your account. Apart from this, we use where you came from only to count new players and paying players per campaign.

What we don't collect

Your precise location. We don't track where you are. When you visit our website pages, Google Analytics works out an approximate location (city and country) from your IP address. A payment provider's message may tell us the country of your store account or billing address.
Your contacts, photos or files, or access to your camera or microphone.
Advertising IDs, such as Apple's IDFA or Google's advertising ID, or hardware device IDs. The iOS app never asks for permission to track you, and the Android app removes the permission that would let it read the advertising ID. Our ads are non-personalized (see Advertising).
Your real name, email address or phone number. The game never asks for them. You give us an email address only if you write to us or enter one at Stripe Checkout. We use a checkout email only for the purchase and the subscription notices described in How we use information.
Your birth year. We keep only the age group.
Chat messages. buggs.io has no chat.
Analytics or tracking by other companies in the game. The game includes no third-party analytics or crash-reporting tools. The only other company's code in the game is Google's, to show ads, and it is set up never to personalize them or track you across other companies' sites and apps (see Advertising). Our own game server counts how the game is played from what it already receives, under a code instead of your Player ID (see Game statistics). The only analytics tool from another company that we use is Google Analytics on our website pages, with its advertising features off (see Analytics on our website). The first time the app opens, it asks Google Play and, if one is installed, Meta's Facebook or Instagram app (Android), or Apple Ads (iOS), only whether it was installed from one of our campaigns, and on iOS it uses Apple's SKAdNetwork, which reports installs from ads without identifying you (see Where you came from).

How we use information

We use information only for the purposes below. If you're in the EEA or UK, each one names the legal basis we rely on. These are explained in EEA and UK.

To run the game. We connect you to arenas, show your nickname and score, keep leaderboards and clubs running, save your progress and let you keep and move your account with recovery codes and transfer codes. Legal basis: contract.
To run your account and purchases. We deliver and restore what you buy, manage subscriptions, and handle refunds, chargebacks and payment problems. Legal basis: contract, and legal obligation for the records we must keep.
To send you notices about a web subscription. If you subscribe on the web or desktop, we use the email address you entered at Stripe Checkout to send notices the law or our Terms require, such as renewal reminders, price-change notices and confirmations of a cancellation or refund. These are not marketing. Legal basis: contract and legal obligation.
To apply age rules. We use your age group to set up purchases that suit your age, for example by requiring a parent's consent for children. We also use it to turn off some features for younger players. Legal basis: legal obligation, and our legitimate interest in protecting young players.
To keep the game fair and safe. This covers rate limits, checking match results, detecting cheating, fraud and abuse, moderating nicknames and club names (our game servers automatically replace some offensive nicknames with "Bug", and a nickname several players reported until we review it), and enforcing our Terms of Service and Community Guidelines. Legal basis: legitimate interests.
To fix and improve the game. We investigate errors and use the gameplay records we already hold to balance the game. Our game server also keeps its own game statistics, such as how many people play, for how long, and which bugs, power-ups and loadouts they use, so we can understand how the game is played and improve it (see Game statistics). We don't use third-party analytics in the game. Legal basis: legitimate interests.
To show ads and give you what you watch them for. We decide which ads the game may offer you, check that a reward ad was watched to its end before giving its reward (for example coins, a revive, Start Big or doubled coins), limit how often you see ads, and count which ads were shown. Your age group sets stricter rules for children and teens. Legal basis: contract for the rewards you choose to watch an ad for; legitimate interests for showing ads between games, which keep the game free (see Advertising).
To learn which ads and campaigns bring players. We count new players and paying players per campaign, from the campaign labels and click IDs described in Where you came from, so we can decide where to advertise. When you came from a Google, Meta or TikTok ad on the web, we also tell that network that the click led to a new account or a first purchase, so it can measure our ads and show them to people likely to play. We don't use any of it to choose which ads you see in the game. Legal basis: legitimate interests. For players in the EEA and UK we keep no click IDs and tell ad networks nothing.
To understand and improve our website. On our website pages, not in the game, we use Google Analytics to count visits and to see which pages are used, how people find us, what devices they use and how many press Play. We use it only for this, never for advertising or to build profiles of visitors (see Analytics on our website). Legal basis: legitimate interests. In the EEA and UK, Google Analytics sets no cookies.
To help you. We answer your emails, check that a request comes from the account holder, handle privacy requests and record parental consent. Legal basis: contract, legal obligation and legitimate interests.
To keep records and follow the law. This covers tax and accounting, responding to lawful requests, and setting up, using or defending legal claims. Legal basis: legal obligation and legitimate interests.
To tell you about the game. We do this through in-game messages and news. We don't send marketing emails. We email you only to answer you, or to send the subscription notices described above. Legal basis: legitimate interests.

The game applies some rules automatically. For example, it enforces purchase rules based on your age group, rejects match results that are impossible, and shows other players "Bug" instead of a nickname our filter finds offensive, or one that several players reported, until a person reviews it. We don't make decisions about you based solely on automated processing that have legal or similarly significant effects. If you think a rule was applied to you wrongly, contact us.

What other people can see

Leaderboards. Daily, weekly and monthly leaderboards show your nickname, the bug you played, your score, your kills and the time of the run. A run that used a paid boost is marked. Leaderboards appear in the game and on our website. The leaderboard data is public, so anyone can read it, including other websites and apps.
Arenas. Other players in your arena see your nickname and bug. They also see the live top 10, messages when players join, and the feed of who knocked out whom.
Clubs. Anyone who views a club can see its name and each member's nickname, role, weekly points and join date. Club tournament standings are public.
Party rooms. Only people with a party's private code can join it. We never publish the code.

Your Player ID is not shown on public leaderboards. However, the game includes it when it loads leaderboards so it can highlight your own entry. This puts it in the web address of that request, so it can appear in network logs such as Cloudflare's. Your Player ID identifies your account but is not a password. Before we act on a request about an account, we ask for more than the Player ID (see Your privacy rights).

Once something is public, other people can copy it, for example in screenshots. We can't control those copies.

We don't sell your personal information. We share it for cross-context behavioral advertising, meaning ads targeted at people based on what they do on other companies' sites and apps, in one case only: telling Google, Meta or TikTok that a click on their ad on the web led to a new account or a first purchase (see Where you came from). You can switch this off (see Your choices). We share information only in the following cases:

Cloudflare provides our domain name service, content delivery, security, and the secure connection between the internet and our servers. All traffic to buggs.io and to our account service passes through Cloudflare's global network, including your IP address, the addresses you request and what the game sends. See Cloudflare's privacy policy.
Hosting providers that run the servers and databases for our account service in the United States. They store and process information only on our instructions.
Google (Google LLC) provides Google Analytics on our website pages, not in the game. When analytics is on, your browser sends Google information about your visit, as described in Analytics on our website. Google processes it for us as our service provider, with Google signals and all advertising features turned off. See how Google uses information from sites that use its services.
Google (Google LLC and Google Ireland Limited) shows the ads in the game: Google AdMob in our iOS and Android apps, and Google's H5 Games Ads (part of Google AdSense) in the web game at https://buggs.io/play/. When an ad is requested and shown, your device sends Google what any ad request carries, as described in Advertising. For reward ads in the apps, we also give Google a random code for the ad and a code made from your Player ID (not the Player ID itself), which Google sends back to our account service to confirm the ad was watched. See how Google uses information from sites and apps that use its services.
Stripe sells web and desktop purchases to you through its Link service, as merchant of record, and processes the payment. We send Stripe what you're buying, its price and your Player ID. Stripe collects your payment details, email address, name and billing address directly and uses them under its own privacy policy, for example for tax, receipts, fraud prevention and payment support.
Apple (Apple Ads) receives the one-time attribution code our iOS app sends the first time it opens, and answers whether the install came from one of our Apple Ads campaigns (see Where you came from). The code is made on your device and carries no advertising ID. Apple also runs SKAdNetwork on your device, which tells an ad network that an install came from its ad without identifying you.
Google (Google Ads), Meta (Meta Platforms, Inc.) and TikTok receive, when you came to our website from one of their ads and we kept the ad's click ID, that click ID, whether the account was created or made its first purchase, when, the purchase's value and (Meta and TikTok) your browser's user agent, as described in Where you came from. Each uses it under its own terms and privacy policy: see Google's, Meta's and TikTok's.
Apple and Google process in-app purchases in their stores under their own terms. We give them an account reference made from your Player ID so they can match purchases to your account. They send us back the transaction details. See Apple's privacy policy and Google's privacy policy.
DPS, our account and purchase service. This is our own system, run by us or for us, not an outside buyer of data.
Our email provider, which receives and stores the emails you send to support@buggs.io.
Other players and the public see what is described in What other people can see.
For legal reasons. We share information when the law requires it. We also share it when we believe in good faith that it is needed to respond to a valid legal request such as a court order, to protect someone's safety, to prevent fraud or abuse, or to protect our rights and enforce our Terms.
Business transfers. buggs.io may be sold, merged or transferred, including in a bankruptcy. If that happens, your information may pass to the new owner, who must keep treating it as this policy describes. If they want to change that, they must tell you first and get your consent where the law requires it.
At your request. For example, we share information with an agent or parent you authorize.

Our service providers, such as our email provider and any company that hosts our servers, may use your information only to provide their services to us, under data protection terms that require them to protect it at least as well as this policy does. Cloudflare may also use traffic data, such as IP addresses, to protect and improve its own network, as Cloudflare's privacy policy describes. Google processes Google Analytics data on our behalf, as a service provider (a "processor" under the GDPR), under the Google Analytics terms and Google's data processing terms. For ads, Google is an independent company that uses ad request data under its own policies and its terms with us; for players in the United States we have turned on Google's restricted data processing, so Google uses that data only to serve and measure our ads and to prevent fraud, as our service provider, and not to build advertising profiles. Stripe, Apple and Google (for Google Play) are independent companies: they handle payment information under their own privacy policies.

Where we process information

Our servers are in the United States. Cloudflare runs a worldwide network, so a Cloudflare location near you may handle your connection before it reaches us. Stripe, Apple and Google may process information in the United States and other countries. That includes the Google Analytics data from our website pages and the data in ad requests from the game.

If you play or visit our website from outside the United States, your information is sent to and processed in the United States. Privacy laws there may differ from those where you live. Where the law requires safeguards for information our service providers handle for us, we rely on recognized safeguards in their data protection terms. Examples are the European Commission's Standard Contractual Clauses and the UK's International Data Transfer Addendum. For Google Analytics, Google LLC is also certified under the EU-U.S. Data Privacy Framework. You can ask for a copy of these safeguards by emailing support@buggs.io.

Game statistics

Our game server keeps its own statistics about online play, so we can understand how the game is played and improve it. It works them out from information it already receives when you play online. The only extra information the game sends for them is its platform and version number, when you join. No other company is involved: the game includes no third-party analytics tools, nothing is stored on your device for these statistics, and they stay on our own server.

What we count

how many people play each day, week and month, how many are new and how many come back;
how long sessions and lives last, and how many people are online at once, hour by hour;
which bugs, power-ups and loadouts (combinations of power-ups) are played, and for each bug the sizes reached, kills and deaths;
game modes, platforms and game versions;
how lives end, such as the cause of death, and how often boosts and match passes are used.

Offline games against computer-controlled bugs never reach our servers, so they are never counted.

How you are counted

Before anything is stored, the server replaces your Player ID with a code made with a secret key that only our server holds. The code can't be turned back into your Player ID. If the game doesn't send a Player ID, the code is made from your nickname instead. The statistics never contain your Player ID, your nickname or your IP address.

For each day, the server keeps a list of the codes of the players who played online that day, with the bugs, game modes and platforms each one used. These lists let us count daily, weekly and monthly players and returning players without counting anyone twice. Each day's list is deleted 35 days after that day. What stays are totals for each day, such as the number of players or the number of games played with each bug. The totals contain no codes, Player IDs or nicknames and aren't linked to any player, and we may keep them indefinitely.

What we don't do with them

We use game statistics only to understand and improve the game, for example to balance bugs and power-ups and to see when people play. We don't use them to make decisions about you, to build profiles, or for advertising, and we never sell them. No service provider or other company receives them. The legal and business-transfer cases in Who we share information with apply to them as they do to all information we hold.

Analytics on our website

We use Google Analytics, a service of Google LLC, to count visits to our website and understand how it is used, so we can improve it. It runs only on our website pages: the home page at https://buggs.io, our help and legal pages, such as this one, and our "page not found" page. It never runs in the game at https://buggs.io/play/ or in our apps, so Google Analytics measures nothing while you play. Our pages load it with our own script, which fetches Google's code from www.googletagmanager.com.

What it measures

the pages you view, how long you spend on them and how far down you scroll;
clicks on links that take you to other websites (which link, not anything about you on that site);
the website that sent you to us, if any;
your approximate location (city and country), which Google works out from your IP address;
your type of device, browser, operating system, screen size and language;
two actions on our home page: pressing Play (with whether you chose online or offline) and pressing "Choose your bug".

It never receives your nickname, your Player ID or anything you type. Google Analytics doesn't log or store IP addresses: Google uses your IP address only to work out the approximate location, then discards it. The information isn't linked to your Player ID, nickname or account.

No advertising

We have turned off Google signals and ad personalization. We also tell Google, for every visitor everywhere, that all advertising uses are refused (in Google's Consent Mode, ad storage, ad user data and ad personalization are all set to "denied"). We use Google Analytics only to count and understand visits, never for advertising, and we don't use it to build profiles of visitors.

Cookies, and visitors in the EEA, the UK and Switzerland

In the European Economic Area (EEA), the UK and Switzerland, Google Analytics sets no cookies and stores no identifiers on your device. Google receives only cookieless pings: messages about a page view or an action, with no ID stored on your device to connect them. We don't show a consent banner, so you are never asked, and analytics stays cookieless for you. Google works out where you are from your IP address.
Everywhere else, Google Analytics sets two first-party cookies on our website, "_ga" and "_ga_<ID>". They hold a random ID that lets it tell visits apart and count returning visitors. Each expires 2 years after your last visit (see Cookies and browser storage).

Your choices: analytics and ad measurement

These choices also opt you out of the "sharing" with ad networks described in Where you came from.

Global Privacy Control and Do Not Track. If your browser sends either signal, our website doesn't load Google Analytics at all, the game keeps no ad click ID, and our account service deletes any it already holds for you and tells no ad network about you.
Switch it off here. You can switch analytics and ad measurement off for this browser with the button below. We remember your choice in your browser's storage ("buggs.analytics") and delete the Google Analytics cookies on our website. The game on this website reads the same choice: it keeps no ad click ID and asks our account service to delete any it holds for you, so no ad network is told about you. You can switch it back on the same way. If you clear your browser's site data for buggs.io, the choice is forgotten. Without JavaScript, the button doesn't appear, and neither Google Analytics nor the game can run.
By email. You can also ask us to opt you out at support@buggs.io. Include your Player ID (Settings ▸ Account).

You can also install the Google Analytics opt-out browser add-on, which stops Google Analytics on every website you visit, including ours.

Who handles it, and for how long

Google processes this information for us as our service provider (a "processor" under the GDPR), under the Google Analytics terms and Google's data processing terms. It may be processed in the United States; Google LLC is certified under the EU-U.S. Data Privacy Framework. We have set Google Analytics to keep detailed, event-level data for 2 months, after which it is deleted. Aggregated reports made from it, such as the number of visits per day, may be kept longer. Because the data isn't linked to your account, deleting your account doesn't affect it. See how Google uses information from sites that use its services and Google's privacy policy.

Advertising

The game can show ads, so it can stay free to play. Our website pages, including this one, never show ads.

Where you see ads

Reward ads you choose to watch. In some places the game offers an ad in exchange for a reward it names before the ad plays, such as coins in the Store, a revive or Start Big, or doubled coins after a game. Watching is always optional. You get the reward only if the ad plays to its end; closing it early, or an ad that doesn't load, gives nothing.
Short ads between games. Sometimes an ad plays as you leave the end-of-game screen, never during a game. The game limits how often: never before your first few games in a session, a minimum time between ads, and a maximum per session. No Ads and Premium remove these ads. They never remove reward ads, which stay optional.
Who provides them. Google provides every ad: Google AdMob in our iOS and Android apps, and Google's H5 Games Ads in the web game. Our desktop apps show no ads.

Non-personalized, for everyone

Every ad the game asks for is non-personalized, for every player, everywhere. A non-personalized ad is chosen from things like the game it appears in, your general location (such as your country or city) and the time, never from what you do on other companies' sites and apps, and never to build an advertising profile of you. We don't use advertising IDs: the iOS app never asks for permission to track you, and the Android app removes the permission that would let it read Google's advertising ID.

Age groups

No age group yet: no ads at all, not even reward ads. The game asks for your birth year before the first one (see Children).
Children (the child age group): every ad request is tagged as directed to a child (as COPPA requires) and as coming from someone under the age of consent, and only ads suitable for everyone (Google's "G" rating) are shown.
Teens: every ad request is tagged as coming from someone under the age of consent, and no ad above Google's "T" (teen) rating is shown.
Adults: the same non-personalized ads, up to the content rating we choose.

What Google receives

To show an ad, the game asks Google for one. Like any ad request, it carries your IP address (which Google uses to work out your approximate location), information about your device, operating system, browser or app and its settings (such as the language), the game and the place in it asking for the ad, the age tags above, and what happens with the ad (whether it was shown, watched to the end or clicked). In the apps, the Google Mobile Ads software may also use a device-scoped ID that Google sets for the app (not an advertising ID) for frequency capping, measurement and fraud prevention. For a reward ad in the apps, we also give Google a random code for that ad and a code made from your Player ID (never the Player ID itself); Google sends both back to our account service to confirm that the ad was watched, so that you get your reward exactly once. Google never receives your nickname, your Player ID, your age group or your purchases from us.

Google uses this information to deliver and measure the ads, cap how often you see them and prevent fraud. For players in the United States, we have turned on Google's restricted data processing, so Google uses it only as our service provider for those purposes. See how Google uses information in advertising.

In the EEA, the UK and Switzerland

Here Google shows only limited ads: ads that use no cookies or other storage on your device, and no device identifiers, for advertising. So we don't ask for your consent to ads. Google still uses the information in each ad request, as described above, to deliver and count the ad and to prevent fraud.

What we keep

Our account service records which reward ads you watched, when, through which network and what they gave you, and which ads were shown (the placement, when and on which platform). We use these records to give rewards exactly once, to apply the limits on how often ads appear, and to keep the game fair. They are part of your account information (see How long we keep information).

Cookies and browser storage

The game stores nothing in your browser or app for analytics: our game statistics are worked out on our server (see Game statistics). Apart from the Google Analytics cookies and Google's ad storage described below, we use only the storage that is strictly necessary to run the website and the game. Our website pages never use advertising cookies. Google Analytics sets its cookies only on our website pages, and only outside the EEA, the UK and Switzerland. In those places, where analytics cookies need your consent, it sets none. That's why there is no cookie banner (see Analytics on our website).

What	Where	What it's for	How long
Game save	IndexedDB in your browser, or the app's private storage	Your progress, device XP, settings, nickname and the unlocks it gives for offline play	Until you clear your browser's site data, use Erase save or uninstall the app
"buggs.save.mirror"	localStorage (web only)	A second copy of the game save above, with the same contents, written the moment the game saves. If you leave the page during a game, the browser may close it before the save reaches IndexedDB; this copy keeps that game's progress	Replaced each time the game saves, until you clear your browser's site data
Account file	IndexedDB in your browser, or the app's private storage	Your Player ID, the access tokens from our account service, your age group, a copy of the items you own and of your online progress (online XP, per-bug online progress and run records), and any checkout in progress. It also notes whether to remind you to save a recovery code, and when the recovery code you last copied was made, but never the code itself. It keeps you signed in to your account.	Until you clear your browser's site data or uninstall the app. Deleting your account replaces it with a new Player ID.
"buggs.nick"	localStorage	Remembers your nickname, whether you typed it on our home page or changed it in the game, so the home page can fill it in	Until you clear your browser's site data
"buggs.launch"	sessionStorage	Passes your nickname, and whether to start a game straight away, from the home page to the game when you press Play	Removed by the game as soon as it has read it; otherwise when you close the tab
"buggs.analytics"	localStorage (website and web game)	Remembers that you switched analytics and ad measurement off for this browser (see Your choices)	Until you switch analytics back on or clear your browser's site data
Google Analytics cookies "_ga" and "_ga_<ID>"	Set only by our website pages, never by the game, as first-party cookies for buggs.io; only outside the EEA, the UK and Switzerland, and only while analytics is on. Your browser also sends them with requests to the game, which ignores them.	Hold a random ID so Google Analytics can tell visits apart and count returning visitors. Not linked to your Player ID or nickname.	2 years after your last visit. Switching analytics off deletes them.
Google ad cookies and storage, such as "__gads", "__gpi" and "__eoi" (web game), and the Google Mobile Ads software's own storage (apps)	Only in the game while it shows ads (the web game at /play/, or the apps), never on our website pages. In the EEA, the UK and Switzerland, Google sets none for advertising: it shows limited ads there (see Advertising).	Set by Google to deliver non-personalized ads, limit how often you see them, count them and prevent fraud. Never used to personalize ads.	Set by Google, up to 13 months
Stripe cookies	Stripe's checkout and customer portal pages	Payments, fraud prevention and security. Stripe sets them under its own policies.	Set by Stripe
Cloudflare security cookies, such as "__cf_bm" and "cf_clearance"	Our website and game	May be set by Cloudflare to tell people from bots and protect the site	Short-lived, set by Cloudflare

Be careful when clearing site data. Clearing your browser's site data for buggs.io, or playing in a private window, deletes the game save and the account stored in that browser. To keep the account, save a recovery code first and keep it somewhere safe outside the browser, or move the account to another device or browser with a transfer code. A transfer code works only for 15 minutes, so make it when you are ready to use it. Without a recovery code or a transfer code, the account can't be opened again. If you bought something, items and subscriptions bought through Google Play can be restored in the Android app; no app store can restore coins, which come back only with your account. For web purchases, email us your receipt (see Help & Contact). Clearing site data also forgets your choice to switch analytics and ad measurement off.

How long we keep information

Information	How long we keep it
Account information: Player ID, nickname, platform, age group, parental consent record, coins, items, online XP and what it unlocked, per-bug online progress and run records, quests and passes, club membership	As long as your account exists. When you delete your account, we delete it or strip your Player ID and nickname from it (see Deleting your account).
Ad records: the reward ads you watched, when, through which network and what they gave you, and which ads were shown	As long as your account exists. When you delete your account, we keep them only under the random replacement ID, like the account's other records (see Deleting your account). Google keeps ad request data under its own retention policies.
Where you came from: the campaign labels (source, medium, campaign, content and term) and platform	As long as your account exists. When you delete your account, they stay only under the random replacement ID, like the account's other records (see Deleting your account).
Ad click IDs, and the browser user agent kept with a click ID from the web (see Where you came from)	90 days, then deleted. Deleted sooner if you opt out, delete your account, or its age group turns out to be a child's or a teen's.
Meta's encrypted install referrer (Android)	Until our account service decrypts it into campaign labels, usually within a day, and at most 30 days
Records of what we told an ad network: the network, the event (sign-up or first purchase), its time and value, and whether it was sent	As long as your account exists. When you delete your account, they stay only under the random replacement ID, like the account's other records (see Deleting your account). The ad networks keep what they received under their own retention policies.
Leaderboard entries	Until the board's period ends, then dropped. Daily boards reset at midnight, weekly boards on Monday and monthly boards on the 1st, all in US Central time. Removed sooner if you delete your account. If a leaderboard file is damaged, the server sets the damaged copy aside and deletes it automatically within 14 days.
Live arena data, such as positions, live scores and party codes	Only in memory, during the match
Game statistics: the daily lists of codes made from Player IDs, with the bugs, game modes and platforms each one used	35 days after the day they cover, then deleted. Deleting your account doesn't remove your code from them sooner (see Deleting your account). If a statistics file is damaged, the server sets the damaged copy aside and deletes it automatically within 14 days.
Game statistics: daily totals, such as the number of players and the games played with each bug	Indefinitely. They contain no codes, Player IDs or nicknames and aren't linked to any player.
IP addresses used to limit abuse	Only in memory, for as long as a limit needs it: usually a few minutes, and at most about 24 hours. Restarting our servers clears it. Never written to our logs or databases.
Server and connection logs, which may include nicknames and connection details	Up to 14 days. The logs are rotated daily and old ones are deleted automatically.
Gameplay reports waiting on the game server to be sent to our account service	Up to 72 hours. Reports that can't be delivered are set aside for us to check, and are deleted automatically within 14 days, or sooner if you delete your account.
Transfer codes	A code works for 15 minutes, and we store only a scrambled version of it. Unused codes are deleted about a day after they expire. A record of used codes stays with the account's transfer history.
Recovery codes	We store only a scrambled version of a recovery code. An active code is kept until it is used or replaced, or the account is deleted or combined into another account. After that it no longer works, and a record that the code existed, and when it was used or stopped working, stays with the account's history.
Deletion records	Our game servers keep a scrambled (hashed) version of a deleted Player ID for about 3 days so they can remove it from leaderboards. Our account service keeps it for up to 7 years, as a record that the deletion happened.
Purchase and transaction records: purchases, receipts, messages from payment providers and app stores, refunds and chargebacks, the coin ledger, and audit records of account events	Up to 7 years after the transaction, for tax, accounting, fraud prevention and legal reasons. This applies even after you delete your account.
Nickname reports: the nickname, the reason picked, where and when it was seen, and a scrambled code made from the reporter's IP address	The scrambled code: 24 hours. The report: until we have reviewed it, and no longer than 30 days. A nickname shown as "Bug" after several reports is kept until we have reviewed it, and a nickname we block stays on our list of blocked names until we remove it. Neither is linked to any account.
Club reports: the reason picked and a link to the reporting account	Until we have dealt with the report, and after that as part of the club's record, so we can spot repeated problems. If you delete your account, a report you made stays linked only to the random replacement ID.
Support emails and records of your requests	As long as we need them to help you and to keep a record of what we did, and no longer than 7 years
Short-term technical records, such as those that stop a request being processed twice	24 hours
Information on your device	Until you clear it, use Erase save or uninstall the app. Device XP stays on the device and unlocks nothing online, so deleting your account does not erase it or your settings. Online XP belongs to your account.
Website visit data in Google Analytics (our website pages only, never the game)	Detailed, event-level data for 2 months, then deleted. Aggregated reports made from it, such as visits per day, may be kept longer. It isn't linked to your account, so deleting your account doesn't affect it.
Information held by Cloudflare, Stripe, Apple and Google for their own purposes, including Google's ad request data	Under their own retention policies

After you delete your account, the records we still keep are held under a random replacement ID, with your nickname and Player ID removed. This covers the transaction records above and a stripped-down account record linked to them. That record still notes the age group, any record of a parent's consent (when it was given and how it was checked), the platform, dates, the coin balance and items the account held, totals such as XP, the history of past games without your nickname or Player ID, and the record of its transfers and recovery codes (never the codes themselves). We keep it only as long as the transaction records it belongs to. The one exception is purchase receipts signed by Apple or Google. We keep them exactly as the store sent them, because editing them would break the store's signature. They contain no name or email address, but they may still contain the account reference we gave the store, which is based on your old Player ID. We may also keep information longer when the law requires it, or when we need it for a dispute, a fraud investigation or a legal claim.

Security

We take reasonable measures to protect your information. For example:

connections to our website, the game and our account service are encrypted (HTTPS and secure WebSockets);
our account service stores only scrambled (hashed) versions of access tokens, transfer codes and recovery codes;
match passes are digitally signed;
card details are handled only by Stripe, Apple and Google;
we limit repeated attempts, such as wrong codes, from the same address and in total.

No system is perfectly secure, so we can't guarantee the security of your information. If a security breach affects your information, we will tell you and the authorities as the law requires.

Keep your recovery code and transfer codes secret. Anyone who enters your code can take over your account and everything in it. Never send a code to anyone, including us: we will never ask you to send one. A recovery code doesn't expire, so keep it somewhere safe. If you think someone has seen it, replace it in the game (Settings ▸ Account ▸ Recovery code) or ask us to stop it working. Also, anyone who can use your device or browser profile can use your account.

Your privacy rights

Everyone

Wherever you live, you can ask us to:

tell you what information we hold about you and give you a copy of it;
correct it;
delete it;
answer your questions about it.

Some information we must or may keep by law, such as transaction records. If that stops us doing everything you ask, we'll explain why. You can also do some things yourself in the game:

change your nickname;
delete your account (Settings ▸ Account ▸ Delete account);
reset the progress on your device, including device XP, with Erase save (your account, its online XP, coins and items stay).

On our website, you can switch analytics and ad measurement off for your browser (see Your choices).

EEA and UK

You have the right to:

access your personal data;
have it corrected (rectification);
have it erased;
restrict how we use it;
receive it in a portable format;
object to our use of it, including any use based on our legitimate interests;
withdraw consent at any time where we rely on it;
complain to a supervisory authority.

See EEA and UK.

United States

Wherever you live in the US, you can:

know what personal information we collect and access it;
delete it;
correct it;
get a portable copy;
opt out of its sale or sharing, of targeted advertising and of profiling (we don't sell it or use it for profiling; to opt out of the sharing described in Where you came from, see Your choices);
limit the use of sensitive personal information (we don't use it in ways that trigger this right);
not be discriminated against for using your rights;
appeal our decision.

See US state privacy notice.

How to make a request

Email support@buggs.io from any device.
Include your Player ID, which you'll find in Settings ▸ Account (tap Copy), and tell us what you'd like us to do.
If you can't get your Player ID, for example because you lost your device, tell us what you can. Approximate dates and items of purchases, or a Stripe receipt, help us find the account.

To delete your account you can also use the game: Settings ▸ Account ▸ Delete account.

Checking that it's you

Your account has no password or email address. A Player ID alone doesn't prove an account is yours, because it isn't secret. Before we share or delete data, we may ask for details that only the account holder would know, or for a step only they can take, for example:

details of a recent purchase, such as the date, the item or a receipt number;
making a new transfer code in the game at a time we agree by email. We can see on our side that a code was made, so you don't send the code to us.

Never send a transfer code or a recovery code to anyone, including us. If we can't confirm that a request comes from the account holder, we'll tell you and explain what we can still do.

How long it takes

We'll confirm we received your request, normally within 5 business days and never later than 10 business days. We aim to complete requests within 30 days. A complex request may take longer, as far as the law allows: up to two more months under the GDPR, or up to 90 days in total under California law. If so, we'll tell you why. Requests are free. Where the law allows, we may refuse or charge a reasonable fee for requests that are clearly unfounded or excessive.

Agents and parents

You can use an authorized agent to make a request for you. We'll ask the agent for your signed permission, and we may ask you to confirm your identity with us directly. A parent or legal guardian can make requests for their child. See our Parents' Guide.

Appeals

If we turn down your request, you can appeal by replying to our decision email with "Appeal" in the subject line. We'll answer within 45 days and explain our reasons. If you're still not satisfied, you can contact your state Attorney General if you're in the US, or your data protection authority if you're in the EEA or UK.

Do Not Track and Global Privacy Control

If your browser sends a Global Privacy Control (GPC) or Do Not Track signal, our website doesn't load Google Analytics at all, so no information about your visit is sent to Google. We also treat a GPC signal as a valid request to opt out of sale and sharing, and we honor Do Not Track signals the same way: the game keeps no ad click ID, deletes any our account service holds for you, and no ad network is told about you (see Where you came from). Our ads in the game are never personalized and we don't sell personal information, so there is nothing else for these signals to switch off. Apart from Google Analytics on our website pages (see Analytics on our website), Google's ad services in the game, which serve only non-personalized ads (see Advertising), Stripe's fraud-prevention tools on its own checkout pages, Cloudflare's security tools and what we tell an ad network whose ad brought you, as described in Who we share information with, no other company receives information about your activity through buggs.io.

US state privacy notice

This section adds the information required by the California Consumer Privacy Act (as amended by the California Privacy Rights Act) and other US state privacy laws. It is also our notice at collection. We give the rights in this policy to all US players, whether or not a particular state law applies to us.

In the last 12 months, we collected these categories of personal information:

Category	What it means for us	Sources	Why we use it	Who we disclose it to
Identifiers	Player ID; account ID and access tokens; nickname; IP address; the code made from your Player ID for game statistics; payment and store reference numbers; your email address if you write to us or enter it at Stripe Checkout; on our website, the random ID in Google Analytics cookies; the click ID of an ad that brought you, where we keep one (see Where you came from)	You; your device; Stripe, Apple and Google; the ad link you followed and Google Play's install referrer	Running the game and your account; delivering purchases; security; support; understanding and improving the game and our website; measuring our ads	Service providers (hosting, Cloudflare, our email provider, Google for website analytics: IP address and the Google Analytics cookie ID only, and Google for ads in the game: IP address, Google's own app or browser IDs, and for reward ads in the apps a code made from your Player ID); Stripe, Apple and Google for purchases; other players and the public (nickname only); shared with Google, Meta or TikTok for cross-context behavioral advertising: the click ID of their own ad that brought you to our website. The game statistics code: no one.
Personal records (Cal. Civ. Code § 1798.80(e))	Name, email, billing address and limited card details (such as brand and last four digits) in Stripe's payment messages; your email and what you tell us in support emails	Stripe; you	Transaction records; refunds and disputes; subscription notices (renewal reminders and price changes); support; legal compliance	Stripe; service providers (hosting, our email provider)
Characteristics of protected classifications	Your age group (child, teen or adult), worked out from the birth year you enter	You	Age-appropriate purchase rules and features; parental consent; legal compliance	Service providers (hosting and Cloudflare)
Commercial information	Purchases, subscriptions, prices, refunds and chargebacks; coin balance and ledger; items and benefits you own	You; Stripe, Apple and Google	Delivering and restoring purchases; refunds; accounting and tax; fraud prevention; measuring our ads	Stripe, Apple and Google (for their own transactions); service providers; shared with Google, Meta or TikTok for cross-context behavioral advertising: that an account their ad brought made its first purchase, when, and its value
Internet or other electronic network activity	Gameplay records (runs, scores, XP, unlocks, quests, passes, clubs); leaderboard entries; platform and game version; game statistics (the days you played online and the bugs, game modes and platforms you used, under a code instead of your Player ID); server and connection logs; on our website, the pages viewed, time on page, the referring site, device type, browser, operating system, screen size and language, how far pages are scrolled, clicks on links to other websites, and interactions on our home page (pressing Play or "Choose your bug"); in the game, the ads requested and shown to you, the reward ads you watched and what they gave you; the ad or campaign that brought you (campaign labels); with a click ID from the web, your browser's user agent; that your account was created (a sign-up)	Your device; our servers; Google Analytics on our website; Google's ad services in the game; the link you followed, Google Play's install referrer, Meta's install referrer and Apple Ads	Running the game and leaderboards; anti-cheat and security; fixing problems; understanding and improving the game (game statistics) and our website; showing non-personalized ads and giving their rewards exactly once; counting new players per campaign; measuring our ads	Service providers (hosting and Cloudflare, Google for website analytics, and Google for ads in the game); other players and the public (leaderboards and clubs); shared with Google, Meta or TikTok for cross-context behavioral advertising: that their ad's click led to a new account, when, and (Meta and TikTok) your browser's user agent. Game statistics: no one.
Geolocation data (approximate only)	The approximate location (city and country) that Google Analytics works out from your IP address when you visit our website pages; the country of your store account or billing address in payment messages	Google Analytics on our website; Stripe, Apple and Google	Understanding and improving our website; transaction records	Service providers (Google for website analytics, and hosting)
Sensitive personal information	Account access credentials, meaning the access token on your device, transfer codes and recovery codes (we store only scrambled versions); under some state laws, personal information of a known child	Your device; you	Letting you into your account and keeping it secure; providing the game to children as described in our Parents' Guide	Service providers (hosting and Cloudflare)

We do not collect:

precise geolocation;
biometric information;
audio, visual or similar recordings;
professional, employment or education information.

We don't draw inferences about you to build a profile. The only derived information we hold is the age group described above and, for website visits, the approximate location (city and country) that Google Analytics works out from your IP address.

Purposes. We use personal information for the business purposes in How we use information: providing the game and your account, processing transactions, security and integrity, fixing errors, understanding and improving the game (our own game statistics) and our website, and following the law.
Retention. See How long we keep information.
No sale; sharing only to measure our ads. We don't sell personal information. We share it for cross-context behavioral advertising only as described in Where you came from: when you came to our website from a Google, Meta or TikTok ad, we tell that network that the click led to a new account or a first purchase (identifiers, commercial information and internet activity, as the table says). You can opt out with Global Privacy Control, Do Not Track, the switch in Your choices or by email. We don't use personal information for profiling that produces legal or similarly significant effects. Our use of Google Analytics on our website is neither a sale nor sharing: Google processes the data as our service provider, and Google signals and all advertising features are off, so it isn't used for cross-context behavioral advertising. The ads in the game aren't either: every ad is non-personalized, so nothing is used for cross-context behavioral advertising, and with Google's restricted data processing on for US players, Google handles ad request data as our service provider. We don't sell or share the personal information of anyone we know is under 16: nothing is shared for a child's or a teen's account.
Sensitive personal information. We don't use or disclose sensitive personal information to infer characteristics about you. We use it only for purposes that California law allows without offering a right to limit, such as providing the service you asked for and keeping it secure.
No financial incentives. We don't offer any rewards, prices or service levels in exchange for personal information.
Non-discrimination. We won't refuse you service, charge you a different price or give you a worse service because you used your privacy rights.
Direct marketing. We don't disclose personal information to third parties for their own direct marketing (California "Shine the Light" law, Cal. Civ. Code § 1798.83).
Minors in California. If you're under 18 and live in California, you can ask us to remove content you posted publicly on buggs.io, such as your nickname on leaderboards or the name of a club you created. Email us to ask. We can't remove copies other people made.

To use your rights, see Your privacy rights.

EEA and UK

Legal bases

Data protection law in the European Economic Area (EEA) and the United Kingdom requires a legal basis for each use of personal data. These are the bases we rely on:

Legal basis	When we rely on it
Contract (providing the game under our Terms of Service)	Running the game, your account, leaderboards and clubs; purchases, restores, transfers and recovery codes; answering your support requests. If you are too young to enter into a contract where you live, we rely instead on our legitimate interest in providing the game you or your parent chose to use.
Legitimate interests	Security, rate limiting, anti-cheat and fraud prevention; server logs; moderation; fixing and balancing the game; showing non-personalized limited ads between games, which keep the game free (see Advertising); our own game statistics (see Game statistics); protecting young players with age rules; keeping records for legal claims; telling you about the game in the game; measuring visits to our website pages with Google Analytics, without cookies (see Analytics on our website); counting which of our campaigns bring new players, from campaign labels only, with no click IDs kept (see Where you came from). Our interest is running a game and a website that work, are fair and are safe, and understanding how the game and our website are used so we can improve them. You can object to these uses. For website analytics, you can also switch it off yourself.
Legal obligation	Tax and accounting records; responding to lawful requests; handling your privacy rights; age-related protections the law requires; recording a parent's approval of purchases on a child's account
Consent	We don't rely on consent for anything. Analytics cookies would need your consent in the EEA and UK, so we don't set them there: Google Analytics measures visits there without cookies. Ad cookies would need it too, so in the EEA, the UK and Switzerland Google shows only limited ads, which use none (see Advertising). We never show personalized ads. If we add a feature that needs consent, we'll ask first. You can withdraw consent at any time. Doing so doesn't affect what was done before.

Your Player ID and gameplay information are needed to play online. Your birth year is needed only if you want to buy something, use a store offer or see ads. You choose your own nickname.

International transfers

Your information is processed in the United States, including by Google for Google Analytics on our website. See Where we process information for the safeguards we rely on.

Complaints

You have the right to complain to a data protection supervisory authority. In the EEA, that is the authority in the country where you live or work, or where you think the problem happened (see the list of EEA authorities). In the UK, it is the Information Commissioner's Office.

Contacting us

We are based in the United States and have no office in the EEA or the UK. Our representative in the EU under Article 27 of the GDPR is [EU REPRESENTATIVE: name, postal address, email]. Our representative in the UK under Article 27 of the UK GDPR is [UK REPRESENTATIVE: name, postal address, email]. You can contact them about any privacy matter instead of us. You can also contact us directly at support@buggs.io with any privacy question or concern, so we can try to resolve it.

Children

buggs.io is a general-audience game for players of all ages. Anyone can play without telling us their age. The first time a player taps something in the lobby that involves buying, a store offer or an ad, or after a few games when ads are on, the game asks a neutral question, "Your birth year", with no year selected in advance. We keep only the age group, never the year.

If the year means you could be under 13, the account is treated as a child's account. Children can play, but a purchase needs verifiable consent from a parent, which our support team records. The parent can withdraw that consent at any time by emailing us.
Children never get personalized ads; no one does. Every ad request for a child is tagged as directed to a child and as under the age of consent, and only ads suitable for everyone are shown. A player whose age group isn't known yet sees no ads at all (see Advertising).
The game includes no third-party analytics. Our own game statistics work the same way for every player: they count a code instead of the Player ID, the daily lists of codes are deleted after 35 days, and we use them only to understand and improve the game, as part of running it (what COPPA calls support for internal operations), never for advertising (see Game statistics). Our website pages are for a general audience and don't know a visitor's age, so Google Analytics works the same way for every visitor there, as described in Analytics on our website. We use it only to understand and improve our website, never for advertising or to build profiles.
We note which of our campaigns brought a new account, as described in Where you came from, to count new players per campaign. We never keep an ad's click ID for a child's or a teen's account, we delete one kept before the age question as soon as the answer shows a child or a teen, and we never tell an ad network anything about a child's or a teen's account.
To run the game, we use a random Player ID, the nickname and gameplay information, even before the age question. Nicknames are public, so children should never use their real name or anything that identifies them. Our game servers replace some offensive nicknames with "Bug", but they don't look for personal information. If you find a child's real name or other personal information in a nickname or club name, email us and we will remove it.
A parent can review or delete their child's information, or ask us to stop collecting it. To do this, email support@buggs.io with the child's Player ID, or delete the account in the game (Settings ▸ Account ▸ Delete account).
If we learn that we collected personal information from a child under 13 in a way the law doesn't allow, we will delete it. If you think this has happened, please tell us.

Our Parents' Guide & Children's Privacy notice has the full details, including how a parent gives consent.

Deleting your account

In the game: go to Settings ▸ Account ▸ Delete account and confirm. Your account is deleted in our account service straight away, and your device starts fresh with a new Player ID.
By email: email support@buggs.io from any device with your Player ID. This works even if you can't open the game or don't see the Account section. We'll check the request comes from the account holder (see Your privacy rights), then delete the account by its Player ID, with the same effect, within 30 days.

What deletion removes. We remove your nickname and Player ID from your account, your run records and our audit records. We also blank out the personal details in payment provider messages: names, email and postal addresses, phone numbers, IP addresses and device details, card and other payment-method details (such as the card brand, last four digits and expiry date), links to receipts and invoices, and what a dispute says about you. This also applies to messages that arrive after the deletion, such as a renewal or a dispute. Amounts, dates and payment reference numbers stay, so our records still add up. We delete any ad click ID and browser user agent kept with the account, and tell no ad network anything more about it (see Where you came from). Your access tokens, transfer codes and recovery code stop working, and you leave your club. If you owned the club, ownership passes to the longest-standing member, or the club closes if you were its only member. The coins, items, online XP, purchases and subscription benefits on the account are gone for good. Your leaderboard entries are removed, usually within an hour and in any case when the board's period ends.

What deletion keeps. We keep the transaction records described in How long we keep information, under a random replacement ID, and the campaign labels that say which campaign brought the account, so our counts per campaign still add up. Signed App Store and Google Play receipts are kept unchanged and may still contain a reference based on your old Player ID, because editing them would break the store's signature. Device XP stays on the device and unlocks nothing online, so your device keeps it and your settings. Online XP belongs to your account and goes with it. Server logs that may include your nickname are deleted on their normal schedule, within 14 days. Our game statistics hold only a code made from your Player ID, which our deletion process doesn't match to your account, so your code stays in the daily lists until each list is deleted, 35 days after its day (see Game statistics). The daily totals contain no codes and aren't linked to your account. Stripe, Apple and Google keep their own records, which our deletion doesn't reach. Stripe keeps your Player ID as a reference on past payments, and the email you entered at Checkout. If you paid through Stripe and want that customer record deleted too, say so in your email. We will delete it from our Stripe account once no subscription, refund or dispute is still open, except what Stripe must keep by law.

Deleting your account does not cancel a subscription. Cancel it first on the platform where you bought it. See Purchases, Subscriptions & Refunds.

For step-by-step instructions, see Delete Your Account & Data Requests.

Changes to this policy

We may update this policy, for example when we add a feature or the law changes. The date at the top of this page shows when it last changed. If a change is significant, we'll give notice before it takes effect, in the game or on our website. Where the law requires your consent to a change, we'll ask for it. One example is a new use of children's information, which would need a parent's consent. Older versions are available on request.

Contact

For questions about this policy or your information, or to make a request, email support@buggs.io and include your Player ID if you have one. You can also write to POWERUP GAMING LLC, 311 Chimney Rdg, Nolensville TN, 37135. We normally reply within 5 business days.