Privacy Policy

1. What data we collect

If you play anonymously (without signing in), we process:

• A random identifier generated by your device to recognize you across sessions (stored in the browser's local storage, a technical cookie, and session storage).
• Your game results: what you played, whether you won or lost, score, time, and difficulty.
• The country you choose to display (optional) and the public name you choose.
• Your IP address, used to prevent the use of multiple accounts from the same source (ranking anti-cheat).

If you sign in with Google, we additionally process:

• Your name, email address, profile picture, and Google identifier, provided by Google when you authenticate.

If you use the friends and duels features, we store the relationships you create yourself (who you add as a friend or challenge). If you have friends added, we also store the last time you had the Service open, so we can show you and your friends who is online at that moment. That information is shown only as "online" or "offline": the exact time and a connection history are never shown.

To understand how the site is used and improve it, we use web analytics tools (see section 3). Through them we process: the pages you visit, game events (which game you start, complete, or abandon, at what difficulty and with what result), your device and browser type, and an approximate geographic location derived from your IP address: country or region in the case of Vercel Web Analytics, and down to city level in the case of Google Analytics. In no case is this your exact location or GPS data. Vercel Web Analytics works in aggregate and without cookies, without identifying you as an individual. Google Analytics uses cookies and is only activated if you have given your consent.

We neither request nor store your password: authentication is performed by Google. We also do not process special categories of sensitive data.

2. How we use the data and legal basis

• To make the game work and preserve your progress across sessions and devices (performance of the service you request).
• To calculate and display rankings and to prevent cheating and abusive use of multiple accounts (legitimate interest in maintaining a fair ranking; the IP is used solely for this purpose).
• To link your progress to your account if you sign in with Google (based on your consent when choosing to sign in).
• To show you and your friends who has the Service open right now (performance of the friends feature you activate).
• To analyze in aggregate how the site is used and improve it. Vercel's cookieless analytics relies on our legitimate interest in maintaining and improving the Service, without identifying you. Google Analytics, which does use cookies, relies solely on your consent and is not activated until you grant it.

We do not use your data for advertising or to make automated decisions with legal effects on you.

3. Cookies and local storage

The Service uses technical and necessary storage in your browser to remember your identity, your language, and your progress. We use two technical cookies: bdb_uid (your player identifier) and bdb_tok (the signed credential proving that identity is yours, so nobody else can play or change data on your behalf), plus the browser's local and session storage. This storage is essential for the game to work and for its security, so it does not require your consent.

In addition, we use two web analytics tools to understand how the site is used:

• Vercel Web Analytics: measures in aggregate and anonymously (visits, country, device). It does not use cookies or identify you as an individual, so it runs at all times, without requiring your consent.
• Google Analytics: measures usage in more detail and DOES use cookies. That is why it is only activated if you accept cookies in the banner shown the first time you visit. If you reject or ignore it, Google Analytics is neither loaded nor stores any cookie.

You can change your choice at any time from the "Manage cookies" link in the footer. We do NOT use advertising cookies. If advertising is introduced in the future, your consent will be requested where the law requires it.

4. Who we share data with

We do not sell your personal data. We share data only with infrastructure providers that process it on our behalf to operate the Service:

• Google (authentication via Google OAuth), if you choose to sign in.
• Google (Google Analytics, to analyze site usage), only if you accept the analytics cookies.
• Railway (server and database hosting).
• Vercel (website hosting and its cookieless web analytics).

Some of these providers may process data on servers located outside Argentina or the European Economic Area. In such cases, the transfer relies on the safeguards and legal mechanisms offered by those providers.

If you click the voluntary support button, you leave the Service for Cafecito or Ko-fi, whichever you choose. They are independent controllers of the data they process on their own site; the operator does not send them any of your data — it is simply a link to their page.

5. How long we keep the data

We keep your data for as long as your identity or account remains active and it is necessary to provide the Service (match history, scores, achievements and streak, which are the basis of the game and the rankings).

Your IP address is kept alongside each attempt for a maximum of 12 months, after which it is deleted or anonymised. It is used solely to prevent abusive use of multiple accounts.

You can delete your account and all your data yourself, at any time, from "Your profile" in the app. Deletion is immediate and permanent: your match history, achievements, badges, friendships and duels are removed. You may also ask us by email if you prefer.

6. Your rights

Under applicable law (Argentina's Personal Data Protection Act No. 25.326 and, if you are located in the European Union, the General Data Protection Regulation), you have the right to:

• Access the personal data we process about you.
• Rectify inaccurate or incomplete data.
• Request the erasure (deletion) of your data.
• Request the portability of your data.
• Object to or restrict certain processing.

You can exercise the right to erasure yourself, without waiting for anyone: go to "Your profile" in the app and use "Delete my account". For the other rights, or if you would rather we handled it, write to us at:

boxdailybox@gmail.com

You may also lodge a complaint with the competent supervisory authority. In Argentina, the Agency for Access to Public Information (AAIP). In the European Union, the data protection authority of your country.

7. Children

The Service is not directed to children under 13 and we do not knowingly collect data from children under that age. If you believe a child under 13 has provided us with personal data, contact us so we can delete it.

8. Security

We apply reasonable technical measures to protect data, including server-side verification and cryptographic signing of game sessions. No system is completely secure, but we work to protect your information.

9. Changes to this Policy

We may update this Policy to reflect changes in the Service or in the law. In particular, if advertising or paid features are introduced in the future, this Policy will be updated to describe that processing, and your consent will be requested where applicable. The current version will always be on this page, with its last-updated date.

10. Language

The Spanish version of this document is the binding version. Translations into other languages are provided for convenience only and, in case of any discrepancy, the Spanish version prevails.