1Introduction
This Policy explains how personal data related to MESCLA, an app for iOS and Android developed by Onrizon Social Games (“Onrizon”, “we” or “us”), is processed. Onrizon is responsible for decisions about the processing of data under its control.
For privacy questions, complaints and requests, including from parents or guardians, write to team@gartic.com.
2Information we use
Gameplay
The devices are synced through a connection between the participants, with the device that sets up the room, called the host, acting as the central point of the match. To run the game, the app uses the room code, information about participation in the session, the assigned colors, the chosen mode, and the commands and results needed for the game to work.
This information is used to sync actions between the devices. We do not produce statistics on matches or on players' performance. This is separate from the general app usage statistics described below.
MESCLA's hosting infrastructure is provided by Vultr. Network connections may involve processing IP addresses and technical session identifiers needed to establish and maintain communication and to protect the infrastructure. Joining a room does not give access to the other apps or to the private files on another device.
Usage statistics
We use Google Analytics for Firebase to understand how MESCLA is used and to improve its features. Depending on the configuration adopted, the service may process usage events, sessions, screens viewed, interactions, and technical information about the app and the device, such as the version, the operating system and the language.
The service may also use identifiers of the app's installation or instance. These identifiers make it possible to tell installations or sessions apart. The data actually collected must match the features and settings adopted in MESCLA.
Crash reports
We use Firebase Crashlytics to identify and fix crashes. Reports may include information about the error, the app's state and version, the device's technical characteristics and installation identifiers. You don't need a MESCLA account for these reports to contain data about how a device is used.
Purchasing Full
The one-time purchase of Full is made directly through the App Store or Google Play and is tied to the Apple or Google account used to make it. Your store account is independent of MESCLA: you don't need to create an account in the game to make a purchase or to join matches.
The store handles authentication and payment data. MESCLA does not ask for your Apple or Google password, or your full card details, to complete the transaction. To unlock or restore Full, the app uses the purchase confirmation and the product access information provided by the store.
Records kept by Apple and Google are subject to their respective privacy policies. Purchase information under Onrizon's control is used to recognize access to Full, provide support, prevent fraud and meet legal obligations related to the purchase.
Contact and requests
If you contact us, we will receive your email address, your message and any attachments you choose to send. We will use this information to reply, provide support, and handle requests or obligations related to your message. Please avoid sending sensitive data, passwords or third parties' information that isn't necessary.
3Purposes and legal bases
We process information to enable participation in matches, recognize access to Full, provide support, understand how the app is used, fix crashes, protect the service, and meet legal obligations and requests to exercise rights.
Processing must be limited to what is necessary for each purpose and rest on a legal basis compatible with applicable law. Depending on the operation, this may be the performance of the service you requested, compliance with a legal obligation, the exercise of rights, consent, or legitimate interest, where permitted and after assessing its necessity, its proportionality and its impact on data subjects.
Relying on legitimate interest does not replace the consent required for certain technologies or operations. Data of children and teenagers is subject to the principle of their best interests and to the specific requirements that apply.
4Choices and consent
Accepting the Terms of Use, purchasing Full or continuing to use the app does not, by itself, constitute consent to any collection that depends on a specific choice.
We use Firebase Analytics and Crashlytics to understand how the app is used and to identify crashes. Where the law requires consent for a particular collection, we will ask for your permission before it begins. You may refuse or withdraw that consent, and request information about the processing, by emailing team@gartic.com.
Withdrawing consent stops future processing that depends on it, without affecting the lawfulness of processing carried out before. Deletion requests will be handled in accordance with applicable law, subject to the cases in which the law requires data to be kept.
Diagnostic information may remain temporarily stored on the device. Storing it locally does not, by itself, mean that it has been sent to Onrizon or Google. Sending it must also respect your privacy choices and the applicable legal requirements.
5Service providers and sharing
Google provides the Google Analytics for Firebase and Crashlytics services used in MESCLA. The processing is subject to the terms that apply to each service and to the controls contracted or configured by Onrizon.
Apple and Google also process information in connection with their respective stores, accounts and payments, under their own policies. Information under Onrizon's control may be shared when necessary to comply with a legal obligation, comply with a valid order from a competent authority or exercise rights, subject to the legal requirements.
Vultr provides the hosting infrastructure used by MESCLA and may process the technical information needed to provide that service. Providers' access to data under Onrizon's control must be limited to the contracted purposes, with the applicable data protection and security obligations.
See also:
6Retention and deletion
We keep information for as long as necessary for the purpose that justified its processing. To set this period, we consider the length of the session, the need for support or crash investigation, the settings of the services used, and legal retention obligations.
- Matches and connection: the information needed for syncing is used during the session. We do not keep a database meant to produce match statistics. Any technical connection and security logs are handled separately and kept for as long as necessary for operation, incident investigation and compliance with legal obligations.
- Analytics: usage data follows the project's retention settings and the limits that apply to the service. Its retention must be limited to analyzing and improving the app. Truly anonymous statistics may be kept for historical comparison.
- Crashlytics: according to the provider's documentation, reports and their associated identifiers are kept for 90 days before being removed from active and backup systems. This period does not guarantee complete deletion on the 90th day.
- Purchases: information under Onrizon's control is kept for as long as necessary to recognize the access you purchased, restore purchases, resolve requests and comply with legal obligations. Store records follow the stores' own policies and do not depend on a MESCLA account existing.
- Contact and requests: information is kept for as long as necessary to reply to and resolve the matter, show that it was handled, comply with obligations and exercise rights, and never indefinitely without a legal basis.
Once the purpose has ended and there is no basis for keeping the data, it must be deleted or anonymized. Uninstalling the app does not automatically delete information already sent to providers or legitimately kept by the store.
7International processing and security
Using Vultr, Google's services and the app stores may involve processing data in other countries, depending on each provider's infrastructure. Syncing between the devices does not change the processing carried out separately by the hosting, diagnostics, usage statistics and payment services.
When data under Onrizon's control is transferred internationally, the mechanisms and safeguards required by applicable law must be observed, including the relevant contractual protections. Onrizon must adopt technical and administrative measures proportionate to the risks, limit access to the people and providers who need it, and respond to incidents as required by law. No system eliminates every risk; this does not remove our data protection responsibilities.
8Updates and contact
This Policy may be updated to reflect changes in the app, in providers or in the law. The current version will show the date it was last updated. Material changes will be communicated appropriately, and new consent will be requested when necessary.
Privacy and support contact: team@gartic.com.