Privacy Policy

1. What data we collect

If you play anonymously (without signing in), we process:

• A random identifier generated by your device to recognize you across sessions (stored in the browser's local storage, a technical cookie, and session storage).
• Your game results: what you played, whether you won or lost, score, time, and difficulty.
• The country you choose to display (optional) and the public name you choose.
• Your IP address, used to prevent the use of multiple accounts from the same source (ranking anti-cheat).

If you sign in with Google, we additionally process:

• Your name, email address, profile picture, and Google identifier, provided by Google when you authenticate.

If you use the friends and duels features, we store the relationships you create yourself (who you add as a friend or challenge).

We neither request nor store your password: authentication is performed by Google. We also do not process special categories of sensitive data.

2. How we use the data and legal basis

• To make the game work and preserve your progress across sessions and devices (performance of the service you request).
• To calculate and display rankings and to prevent cheating and abusive use of multiple accounts (legitimate interest in maintaining a fair ranking; the IP is used solely for this purpose).
• To link your progress to your account if you sign in with Google (based on your consent when choosing to sign in).

We do not use your data for advertising or to make automated decisions with legal effects on you.

3. Cookies and local storage

The Service uses only technical and necessary storage in your browser: to remember your identity, your language, and your progress. We use a technical identity cookie (bdb_uid) and the browser's local and session storage.

We currently do NOT use advertising cookies or third-party tracking technologies. That is why the Service does not display a cookie consent banner. If advertising or third-party analytics is introduced in the future, your consent will be requested where the law requires it.

4. Who we share data with

We do not sell your personal data. We share data only with infrastructure providers that process it on our behalf to operate the Service:

• Google (authentication via Google OAuth), if you choose to sign in.
• Railway (server and database hosting).
• Vercel (website hosting).

Some of these providers may process data on servers located outside Argentina or the European Economic Area. In such cases, the transfer relies on the safeguards and legal mechanisms offered by those providers.

5. How long we keep the data

We keep your data for as long as your identity or account remains active and it is necessary to provide the Service. You may request the deletion of your data at any time by writing to us.

6. Your rights

Under applicable law (Argentina's Personal Data Protection Act No. 25.326 and, if you are located in the European Union, the General Data Protection Regulation), you have the right to:

• Access the personal data we process about you.
• Rectify inaccurate or incomplete data.
• Request the erasure (deletion) of your data.
• Request the portability of your data.
• Object to or restrict certain processing.

To exercise these rights, write to us at:

boxdailybox@gmail.com

You may also lodge a complaint with the competent supervisory authority. In Argentina, the Agency for Access to Public Information (AAIP). In the European Union, the data protection authority of your country.

7. Children

The Service is not directed to children under 13 and we do not knowingly collect data from children under that age. If you believe a child under 13 has provided us with personal data, contact us so we can delete it.

8. Security

We apply reasonable technical measures to protect data, including server-side verification and cryptographic signing of game sessions. No system is completely secure, but we work to protect your information.

9. Changes to this Policy

We may update this Policy to reflect changes in the Service or in the law. In particular, if advertising, third-party analytics, or paid features are introduced in the future, this Policy will be updated to describe that processing, and your consent will be requested where applicable. The current version will always be on this page, with its last-updated date.

10. Language

The Spanish version of this document is the binding version. Translations into other languages are provided for convenience only and, in case of any discrepancy, the Spanish version prevails.