Privacy Policy – Micinka Tower
Version 2.6 · effective 15 October 2026 · applies to the game Micinka Tower from version 0.11.10 (Android and web); the current version is 0.12.1 and to the website https://micinkagames.party
In short
- You can play as a guest without an account. On first launch the game asks for your date of birth (day, month, year). It uses the date only on your device to work out an age band; the date itself is not saved.
- Players under 13 cannot continue. Players aged 13–17 play offline: the online features, accounts and statistics are switched off for them and the game sends us nothing except the update check described in section 9 (a request for a small version file).
- Online features – accounts, cloud save, the online leaderboard, and optional statistics – are for players aged 18+ only. For an adult, the date of birth is sent once to our server for an 18+ check and is not stored there. The server keeps only a hashed identifier, an “adult” flag and timestamps; they are deleted after 12 months of inactivity.
- This version contains no ads and no paid in-app purchases. Coins are earned by playing.
- Players aged 18+ may separately opt in to gameplay statistics (random installation ID, duration bands, game mode, version). Raw records are deleted about 35 days after last activity.
- You can manage your data in the game or request deletion on the Account and data deletion page.
1. Who is responsible
The controller of your personal data is Samir Jahjefendič, a natural person carrying on business, registered in the Czech Trade Register (živnostenský rejstřík; competent trade licensing office: Městský úřad Šlapanice), company ID (IČO) 03187951, place of business Nová ulice 716/51, 664 47 Střelice, Czech Republic (“operator”, “we”).
Contact for all questions and requests: e-mail [email protected], phone +420 725 839 164. We have not appointed a data protection officer, as our processing does not require one.
2. Overview
| Activity | Data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|---|
| Age screen (on your device) | date of birth typed into the screen (used only to compute the band and then discarded); stored on the device: age band (under 13, 13–17, 18+) | configuring which features are available to you; blocking under-13 players | Art. 6(1)(f) – legitimate interest in protecting children | the band stays on the device until you delete data in the game, clear app data or uninstall |
| Age check 18+ (adults only) | date of birth (sent once, held in memory only), the installation ID or the account ID, which the server turns into a keyed hash; server stores the hash, an “adult” flag and timestamps (created, last used) | checking that an online feature is used by an adult | Art. 6(1)(f) – legitimate interest in enforcing the age limit and protecting minors | the date of birth is not stored; hash and timestamps for 12 months after last use, deleted earlier with your player or account data |
| Playing (data on your device) | settings, progress, coins (in-game currency), skills, skins, rewards, local scores, nickname, random installation ID, age band, accepted terms version, leaderboard season; after separate consent also a statistics ID and event queue | running the game on your device | Art. 6(1)(b) | until deleted in the game, app data is cleared or the app is uninstalled |
| Account (18+) | e-mail, password (kept only by Google Firebase in protected form), account ID (UID), sign-in method, e-mail verification status, technical sign-in data | registration, sign-in, e-mail verification, password reset, account security | Art. 6(1)(b) | until the account is deleted |
| Cloud save (18+) | UID and game progress (listed in section 5) | backing up and syncing progress between devices | Art. 6(1)(b) | until the cloud data or the account is deleted |
| Online leaderboard (18+) | installation ID or account ID (the account ID is stored as “fb:” plus the Firebase UID), nickname, equipped skin, season, personal bests (score, floor, combo, time-trial results), run duration, game version, platform and time of the result; a random public moderation reference | publishing personal bests, preventing cheating | Art. 6(1)(f) – legitimate interest, with an opt-out | until opt-out or deletion; see section 6 |
| Leaderboard protection (18+) | plausibility checks, reports of nicknames (see section 6.5), player exclusions, keyed hashes of the IP address or account ID | preventing cheating, abuse and inappropriate content, rate limiting | Art. 6(1)(f) – legitimate interest | reports 90 days, rate-limit keys at most about 2 hours (kept hourly), exclusions at most 24 months |
| Gameplay statistics (optional, 18+) | random separate statistics ID, session/run-duration band, game mode, app version and platform (web/apk/play), UTC day received; short-lived keyed IP hash used only for rate limiting | improve the game and measure player return | consent, Art. 6(1)(a) GDPR; consent for terminal-storage access under ePrivacy Art. 5(3)/Czech Electronic Communications Act §89(3), where applicable | raw records deleted about 35 days after last activity; after withdrawal the ID is deleted and kept as a deletion marker for 35 days; anonymous aggregates are kept |
| Update check (all ages) | IP address, browser or app information, time, version number and the time-stamp parameter the game adds to the request | offering a new version | Art. 6(1)(f) | technical records at Cloudflare (section 10) |
| Website and hosting | IP address, time, page address, browser information, security signals | delivering the website and protecting it against attacks | Art. 6(1)(f) | per Cloudflare's operational rules |
| Web leaderboard page | the same age form as in the game; in your browser: a random browser ID, an age token and, for under-18 answers, a local lock | age check before showing the board and sending reports | Art. 6(1)(f) | in your browser until you clear site data; server side as in “Age check 18+” |
| E-mail communication | e-mail address, message content and attachments | handling questions, requests or complaints | Art. 6(1)(c) and (f) | until handled, then at most 3 years for possible legal claims |
3. Data stored on your device
3.1 The game stores on your device (in the app storage on Android, in browser storage in the web version): language, sound, music and vibration settings, game progress and records, coin balance, skill levels, owned and selected character skins, weekly and daily reward progress and daily mission status, the leaderboard season, the local high-score table, nickname, a random installation ID, your age band, the accepted terms version, local lists of blocked nicknames, any age token issued to the device and technical data needed for syncing.
3.2 The installation ID is a random identifier created on first launch. It contains nothing about you or your device. You can find it in the game under Settings → About → About & licences. It is useful when you ask us, without an account, to export or delete your online leaderboard data. It is also sent to our server as the player ID in the online features, including as a parameter of leaderboard read requests (which Cloudflare may record in its technical logs).
3.3 A signed-in player also has a Firebase refresh token stored on the device so they stay signed in after a restart. The password is never stored on the device. Signing out or deleting the account removes the token.
3.4 For players under 18 this data stays on the device; nothing is sent to our servers except the update check (section 9). For players aged 18+ the data is sent only as described below (age check, account, leaderboard, update check and – only after explicit consent – statistics). You can delete local data in the game via Settings → Data & privacy → Delete my data → Everything, by clearing app data or uninstalling; in the web version, clear site data in your browser. Deleted local data cannot be restored.
3.5 Android backup. If Google backup is turned on on your phone, Android may back up app data (which may include guest progress and the installation ID) to your Google account and restore it on a new phone, depending on your device settings. Google manages the backup; we have no access to it. You can turn backup off or delete it in Android settings (usually Google → Backup).
4. Age screen and the 18+ check
4.1 Age screen. On first launch the game asks for your date of birth in three blank fields (day, month, year). The game does not hint at which answer opens which features. The date is used on the device only to compute the age band: under 13, 13–17 or 18+. The date itself is not saved on the device. An impossible, future or pre-1900 date is rejected.
4.2 Under 13. The game shows a screen saying that the app is not available on the basis of the information given. The date you typed is not sent to us.
4.3 Ages 13–17. You can play without any connection to our servers. The band is saved on the device and cannot be changed except by deleting all data (Delete my data → Everything), after which the game asks again. Online features, accounts, cloud save, statistics and the leaderboard are not available and send nothing. Only the update check (section 9) is made. You can still see local results on your device.
4.4 Adults (18+). Online features require a confirmation that you are an adult. When you answer 18+, the game sends the date of birth once over an encrypted connection to our server together with your installation ID (as a guest) or, if you sign in, the check is tied to your account using your sign-in token. The server computes your age, replies with a signed confirmation token and does not store, log or return the date. The server stores only: a keyed hash of the installation ID or account ID, an “adult” flag and timestamps (when created and last used). Nothing is stored about a person who is not an adult. We delete entries unused for 12 months, and also when you delete your online data or account. The confirmation token is kept on your device (for the web leaderboard in your browser) and renewed from time to time; a token already issued remains technically valid until it expires (at most 90 days), even if the server record is deleted earlier.
4.5 When you sign in or create an account on a device, the game asks the server whether that account has already been confirmed as adult. If not, it shows the date-of-birth screen for the account. If you answer as a minor, the account is signed out on the device, your progress stays on the device and the answer is not sent. The age screen relies on your own statement; we do not verify identity documents and cannot guarantee that every answer is true.
4.6 Web leaderboard page. The page https://micinkagames.party/leaderboard shows the same neutral day/month/year form before it displays the board. The date is first checked in your browser; a minor answer locks the page locally (in browser storage) and nothing is sent. An adult answer is sent once to our server as described above, together with a random browser ID created for this purpose; the returned token is kept in browser storage.
4.7 Age is not used for advertising, because the game contains no ads (section 8).
5. Account and cloud save (18+)
5.1 An account is optional and available only to players aged 18+. You can play as a guest without one. You can create an account with an e-mail address and password (Firebase sends you a verification e-mail and, if needed, a password-reset link), or sign in with a Google account. Sign-in is provided by Google Firebase Authentication. When you sign in with Google, Google passes your e-mail address to Firebase, and possibly also the name and profile picture of your Google account. The game neither uses nor displays them.
5.2 After you sign in, the game stores the following data under your account ID in Google Cloud Firestore: coin balance, best score, levels of the 16 skills, number of games played, total number of claimed reward days and date of the last daily reward, leaderboard season number, daily mission status, up to the last 10 scores and floors reached, nickname, sound, music, vibration and language settings, owned and selected character skins, and the record revision number. Your e-mail, password and tokens are not stored in this record. If you take part in a coin-gift campaign (for example the “thanks” campaign of October 2026), a record that marks you as a recipient and whether you collected the gift is stored in Firestore under your account ID.
5.3 Only the signed-in owner of the account can read and change the record; this is enforced by the database security rules. Only the operator and the people the operator has put in charge of technical administration can access the Firebase project console. They use the data only for support, security and handling your requests. For accounts verified as 18+ we set an “adult” flag in Firebase Authentication (a custom claim, with no date of birth); the database security rules use it to allow cloud saves only for verified adults.
5.4 If you use several devices, the game automatically merges your cloud save with the progress on the device, so that progress made on any device is not lost. If the two copies cannot be reconciled automatically, the game asks which copy to use. The progress you had as a guest before signing in is kept as a separate local backup. The game switches back to it after you sign out or delete the account.
5.5 Deleting your account: in the game via Settings → Account → Delete account (confirm with your password or by signing in with Google again), or on the Account and data deletion page. This deletes the cloud record, the account's online leaderboard data, the age confirmation record for the account and finally the Firebase account. Delete my data → Everything deletes the cloud progress without deleting the account. Only your local progress remains on the device; you can delete it separately (section 3.4).
6. Online leaderboard (18+, automatic, with opt-out)
6.1 The game has three boards: top score, highest floor and fastest time-trial result (one personal best per track). The website provides score and floor boards; the time-trial board is in the game. We do not send the history of individual runs. The boards are available only to players aged 18+ who have completed the age check; players under 18 neither submit nor read results.
6.2 When an eligible player sets a new personal best (and once after start if the server does not have it yet), the game sends to our server the nickname, equipped skin, season, score, floor and combo bests, any new time-trial result and track, run duration for plausibility checks, game version and platform, together with the age-confirmation token. A guest is identified by the random installation ID; for a signed-in account the server verifies a Firebase token and stores the account ID (“fb:” plus the Firebase UID). When the board is displayed, the game sends the installation ID in the request address so that you can see your own row.
6.3 Nickname. Eligible players choose a nickname of 3–16 characters (letters, digits, space and _ - .) that complies with the Terms of Use. We do not collect a country code. To protect the server against flooding we store a keyed hash of the IP address with a daily rotating key and a request counter, never the IP address itself; these rate-limit rows are kept by the hour and deleted within about two hours of the next housekeeping run.
6.4 Public data. The board shows other players a nickname, rank, equipped skin and a result value (score, floor or time). The server also returns a random, stable moderation reference per player and a flag indicating a hidden nickname; players use the reference to report or block an entry, and it identifies no one outside the leaderboard. The Leaderboard page shows score and floor.
6.5 Moderation, reports and blocking. Nicknames are checked by an automatic filter (profanity, links, impersonating staff). Players can report a nickname from the board; the report contains the target’s moderation reference, board, scope, the displayed nickname, a reason and a keyed hash identifying the reporter (a hash of the account ID or, for guests, of the IP address; we cannot read the IP or account from it). Reports are kept 90 days. If at least three different players report a nickname within 7 days, it is hidden automatically and replaced with “Hráč” (“Player”) and the last four characters of the ID. A player can also block an entry; blocks are stored only on the player’s device (in the browser on the web). We can also hide or rename a nickname manually and exclude a player from the leaderboard. The server rejects implausible results (for example a score too high for the length of the run). The nickname rules are in the Terms of Use.
6.6 Legal basis and retention: legitimate interest (Art. 6(1)(f) GDPR) in running the competitive part of the game. We balanced this interest against your privacy: only a nickname, equipped skin and personal bests are published, with no e-mail, name, country or run history, and a single switch opts you out. We keep the data until you opt out or delete it. A player who has not sent a record for 24 months is deleted entirely. An exclusion record (ID, reason, date) is kept for at most 24 months, even if you delete your data, so the exclusion cannot be bypassed. Weekly results of older versions are no longer stored; remaining ones disappear within 8 weeks.
6.7 Opting out (objection) and deletion: the Settings → Don’t show me on the leaderboard switch deletes entries and stops further submissions. You can also use Settings → Data & privacy → Delete my data → Leaderboard only, delete your account, or use the Account and data deletion page. Reports you have made about others are tied to a keyed hash and cannot be exported or deleted by installation ID alone (see section 14.3).
6.8 Seasons. The leaderboards run in seasons. When a new season starts, we delete all results of the previous season from the online leaderboards, and the game clears your personal bests and the recent-score history on your device and in your cloud save. Coins, skills, skins, daily progress, missions and your nickname are kept. The server rejects results from older seasons, and the game asks you to update.
7. Optional gameplay statistics (18+ only)
7.1 If you are 18+ and expressly enable statistics in the game, we process a random ID for this installation (separate from the leaderboard ID), an approximate duration band for a completed session or run (bands 0–5), game mode (ranked or time trial), app version and platform (web/apk/play); the server adds the UTC day of receipt and counts per day. We do not send your nickname, e-mail, UID, age, score, language, country, device model, leaderboard ID or any advertising identifier. Statistics are not linked to your account or the leaderboard. A short-lived keyed IP hash is used only for rate limiting; the raw IP is not a statistics field. The statistics request carries the age-confirmation token, which the server checks but does not link to the statistics ID.
7.2 Processing is optional and based on consent under Art. 6(1)(a) GDPR. We also obtain consent before storing the statistics ID on the device, as required by ePrivacy Art. 5(3) and Czech Electronic Communications Act §89(3), where applicable; these are distinct consent questions. Refusing or withdrawing consent does not affect gameplay. You can withdraw at Settings → Data & privacy (statistics are also deleted by Delete my data → Everything).
7.3 Retention. Raw records linked to the ID are deleted about 35 days after last activity (the purge runs periodically, so deletion can lag slightly). On withdrawal the game stops sending and asks the server to delete the records linked to the ID; if the device is offline, the request is stored on the device and repeated. After a deletion request the server keeps the ID as a deletion marker for 35 days only, to ignore late events, and then deletes it. Anonymous daily aggregates (counts by day, platform and version, and anonymous return cohorts) are kept without a time limit; they cannot be tied back to an ID, but deletion does not reduce aggregates already created.
7.4 Cloudflare hosts the statistics endpoint as our processor. Statistics cannot show who uninstalled the game; for Google Play, uninstall information is available only in Google Play’s aggregate reports.
8. Ads and purchases
8.1 Version 0.11.12 and later versions distributed through Google Play (and version 0.11.10 and later in the web version) show no ads and contain no paid in-app purchases. The Android build contains no advertising SDK, no billing library and requests no advertising ID. Coins are earned by playing (see the Terms of Use).
8.2 The web version uses no ad network and no analytics tools. If we ever introduce ads or purchases, we will update this policy and the in-game information beforehand.
8.3 The Android version from our website (APK), version 0.11.12 and later, likewise contains no advertising SDK, no billing library and requests no advertising ID. It updates by downloading the new APK from our website after you confirm and handing it to the Android installer (for this it needs Android's “install unknown apps” permission). The website APK of older versions (up to 0.11.8) and older Google Play versions may still contain advertising or purchase components; their processing is governed by the earlier policy versions, which we send on request.
9. Update check
When the game starts, and for an adult (18+) player also about every 30 minutes, the game downloads a small file with the latest version number (version.json) from our website. The request carries the game's version code and a time-stamp parameter; like any internet request, it also carries your IP address and technical information about the app. If a new version is available, the game asks you to update. If you installed the game from Google Play, it updates through Google Play, using Google Play's in-app update feature (Google Play services); Google handles that under Google Play's rules as an independent controller and we receive no data from it. The Android version from our website downloads the installation file from our website after you confirm and hands it to the Android installer. The web version reloads. The game of a player under 18 makes only the launch request (no profile data is attached) and can otherwise be played offline. We do not store data from these requests in your profile.
10. Website https://micinkagames.party
10.1 The website runs on Cloudflare Pages. We use no analytics tools, no advertising pixels and no advertising or analytics cookies. Cloudflare processes the technical data needed to deliver the pages and protect them against attacks (IP address, time, page address, browser information). If traffic looks suspicious, it may set a strictly necessary security cookie. We do not keep our own access logs; the logs of Cloudflare as a provider are outside our storage and we have not reviewed their exact retention.
10.2 The web version of the game stores progress and settings in browser storage (IndexedDB and localStorage). For Google sign-in it loads the Firebase library from Google's server (www.gstatic.com) and opens a Google sign-in window. Google processes the related data under its own policies.
10.3 On the Account and data deletion page your e-mail and password go directly to Google Firebase over an encrypted connection, never through our server. Our server only receives a short-lived sign-in token so it can delete the account's online leaderboard data.
11. Who receives data
| Recipient | Role | Purpose |
|---|---|---|
| Google LLC and affiliates (e.g. Google Ireland Limited) – Firebase Authentication, Cloud Firestore | processor (Firebase and Google Cloud data processing terms) | sign-in, e-mail verification, password reset, cloud save |
| Google – Google Play | independent controller | app distribution and updates (under Google Play's rules) |
| Google – Gmail | provider of the operator's mailbox | receiving and sending e-mails |
| Cloudflare, Inc. – Pages, Pages Functions, D1, R2 | processor (Cloudflare Data Processing Addendum) | website, age check, online leaderboard and statistics endpoints, version file, app download |
| other players | public | see the nickname, rank, equipped skin and result value (score, floor, time) |
| public authorities | recipient by law | only where the law requires it |
We do not sell personal data and do not hand it over to anyone for payment.
12. Transfers outside the European Economic Area
The online leaderboard database (Cloudflare D1) is configured with EU jurisdiction. Google (Firebase Authentication, Firestore, Gmail) and Cloudflare (global network for delivering the website and running the server functions) may, however, also process data outside the EEA, in particular in the USA. Google LLC and Cloudflare, Inc. are certified under the EU–US Data Privacy Framework. Their contract terms also include the standard contractual clauses approved by the European Commission. We will send you a copy or description of these safeguards on request.
13. Children and teenagers
13.1 Players under 13 cannot use the game: after the age screen they see a blocked screen and the date you typed is not sent to us.
13.2 Players aged 13–17 can play offline. Accounts, cloud save, the online leaderboard and statistics are not available to them and send no data; only the update check (section 9) is made. The answer cannot be changed without deleting all data (section 4.3).
13.3 The age screen is neutral and relies on your own statement. Online features for adults additionally use the check in section 4.
13.4 If you find that a child or teenager has given us personal data (e.g. created an account despite the age gate), write to us at [email protected]. We will delete the data.
14. Your rights
14.1 You have the right of access to your data, to rectification, erasure and restriction of processing, and the right to data portability. You also have the right to object to processing based on legitimate interest and to withdraw consent at any time. Withdrawing consent does not affect processing carried out before the withdrawal.
14.2 You can exercise most rights directly in the game:
- Access and portability: Settings → Data & privacy → Export my data. Shows the data stored on your device, on the online leaderboard (player record, results, exclusions, reports you made under your account, number of reports received, time-trial results) and in your account's cloud save (in machine-readable JSON) and lets you copy it.
- Rectification: change your nickname in the game. To change the account e-mail, create a new account.
- Erasure: Settings → Data & privacy → Delete my data (Leaderboard only or Everything), Settings → Account → Delete account, or the Account and data deletion page. This also deletes the age confirmation record linked to your installation ID or account.
- Objection and withdrawing consent: to the online leaderboard with the switch Settings → Don't show me on the leaderboard (or Leaderboard only); to statistics in Settings → Data & privacy.
14.3 Limits: reports you made about other players are stored under a keyed hash (of your account ID, or for guests of your IP address), so we cannot identify you from them; they therefore cannot be listed or deleted on request and expire after 90 days. A deletion marker for statistics (35 days) and an exclusion record (24 months) may remain after deletion (sections 7.3 and 6.6). Anonymous aggregates cannot be tied to you.
14.4 You can also write to us at any time at [email protected]. Without an account we can only identify you by the installation ID (section 3.2); with an account, by its e-mail address. To protect your data we may ask you to verify your identity. We reply without undue delay and at the latest within one month. In complex cases we may extend this by two more months and will let you know.
14.5 You have the right to lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz, or with the supervisory authority in the country where you live or work.
15. Automated decision-making
There is no automated decision-making with legal or similarly significant effects on you, except that the age check automatically makes online features available only to a person who has stated they are an adult. Other automatic steps are filtering nicknames, hiding nicknames after repeated reports and rejecting implausible scores (section 6.5). If you disagree with such a step, write to us and a person will review it.
16. Security
All communication between the game or website and our servers is encrypted (HTTPS/TLS). Passwords are handled only by Google Firebase. Only its owner can read a cloud record. We do not store raw IP addresses for the leaderboard, only keyed hashes. The age check does not store dates of birth. We collect only the data the game needs. No security is perfect, though. If a breach occurs that could seriously affect you, we will inform you as required by law.
17. Changes to this policy
We update this policy when the game, the services we use or legal requirements change. The current version is always on this page, with its version number and effective date. We will inform you in advance of material changes in the game or on the website. We will send you earlier versions on request. This policy is published in Czech and English and, for convenience, in other languages offered on our website. Translations are provided for convenience only; if they differ, the Czech version prevails, within the limits of the mandatory data protection and consumer law of your country of residence.
18. Contact
Samir Jahjefendič, a natural person carrying on business, registered in the Czech Trade Register (živnostenský rejstřík; competent trade licensing office: Městský úřad Šlapanice), company ID (IČO) 03187951, place of business Nová ulice 716/51, 664 47 Střelice, Czech Republic · e-mail [email protected] · phone +420 725 839 164 · web https://micinkagames.party