DRAFT for legal review (2026-10-02). Fill in every [bracket] before publishing. Spanish, French and Italian versions are required too.
Mala Costa - Privacy Policy
Version 1 · Effective [date]
Who we are
The controller of your personal data is [legal name], [address], [tax id]. Contact for privacy matters: [privacy contact e-mail].
The short version
- Mala Costa is an online game for adults (18+). You play with a nickname; we never ask for your real name, e-mail or a password.
- We keep what the game needs to run: your account, nickname, game progress, friends and the times you accepted our terms.
- If you sign in with Apple or Google we keep only their anonymous account identifier. We delete the e-mail address, name and picture they send us right away.
- No advertising tracking. No analytics unless you switch them on.
- You can download a copy of your data and delete your account from inside the game, at any time.
What we collect, why, and for how long
| Data | Why | Legal basis (GDPR) | Kept |
|---|---|---|---|
| Account id, a random installation id created by the app, sign-in tokens | To sign you in and keep you signed in | Contract (Art. 6(1)(b)) | Until you delete the account; tokens expire |
| Nickname | Your identity in the game | Contract | Until deletion |
| Apple or Google account identifier; an Apple token used only to revoke access when you delete your account | Signing in on other devices | Contract | Until deletion or unlinking |
| "Confirmed 18+" and the date you confirmed it (never your date of birth) | The game is restricted to adults | Legal obligation and legitimate interest (Art. 6(1)(c), (f)) | Until deletion |
| The versions of these documents you accepted, and when | Proof of acceptance | Legal obligation | Until deletion |
| Game profile: progress, in-game money and items, character look, position in the game world | Running the game | Contract | Until deletion |
| Friends, friend requests, blocks and who may see you | The friends feature | Contract | Until you remove them or delete the account |
| Which game server you are on while you play | Showing your status to the friends you allow, joining friends, server capacity | Contract | Replaced every 30 seconds; gone within 90 seconds of leaving |
| IP address in server logs | Security and preventing abuse | Legitimate interest (Art. 6(1)(f)) | 30 days |
| Purchases and in-game currency (when available) | Delivering what you buy, preventing fraud | Contract; legal obligation for tax records | As required by tax law |
| Anonymous gameplay statistics (only if you switch them on) | Improving the game | Consent (Art. 6(1)(a)); you can withdraw it any time | [period] |
Who else sees it
Other players see your nickname only where the game shows names (for example results screens and your friends list). Friends see your status only if you allow it. Our hosting provider [name, country] processes data on our behalf under a data processing agreement. Apple and Google handle their own sign-in under their own privacy policies. We do not sell your data.
[If servers or providers are outside the EEA: the transfer safeguards used, e.g. EU Standard Contractual Clauses.]
Your rights
You can access, correct, export and delete your data, object to processing based on legitimate interest, and withdraw consent. In the game: My Account → My data (a copy of your data) and My Account → Delete account. Or write to [privacy contact e-mail]. You may also complain to your data protection authority (in Spain, the AEPD, www.aepd.es).
Children
Mala Costa contains realistic violence and is not allowed for anyone under 18. The app asks for your date of birth, does not let minors in and does not store the date. If we learn that a minor has an account, we delete it.
Security
Connections are encrypted (TLS). Game data is stored on servers with restricted access, and only the game's own servers can change your profile.
Changes
If we change this policy we will show it in the game before you continue playing.