Bad Duck Studio

Privacy Policy

The PDF available below was generated from this version.

Effective date: 22 May 2026

Last updated: 13 June 2026

1. Scope

This Privacy Policy explains how BAD DUCK STUDIO, LDA collects, uses, stores, shares and protects your personal data when you download, access or use WordWildWest.

WordWildWest is an advertising-supported mobile word game. It may use app store services, authentication, PlayFab, cloud saves, rankings, player statistics, purchase validation, advertising SDKs, analytics or diagnostics if active, local notifications, support channels, performance technologies and similar technologies.

This Privacy Policy should be read together with the Terms and Conditions, the Cookie and Similar Technologies Policy, the Regional Privacy Addendum and the Partners and SDKs Notice.

2. Controller

The controller of your personal data, under the General Data Protection Regulation (GDPR) and Law no. 58/2019, is:

Company: BAD DUCK STUDIO, LDA.

Registered office: Rua das Acacias, no. 40-A, 3090-380 Figueira da Foz, Portugal.

Company registration / VAT number: PT 518249891.

Email contact: contact@badduckstudio.com.

3. Protection of minors

WordWildWest is a word game aimed at the general public. However, in strict compliance with Article 16 of Law no. 58/2019, the age of digital consent in Portugal is set at 13 years.

If the user is under 13, advertising identifiers or tracking data will not be collected for personalised advertising purposes.

For users identified as under 13, the application will automatically activate high privacy settings, limit data collection to what is strictly necessary for the operation of the game (contractual basis) and disable personalised ads, showing only contextual advertising.

4. Personal data we collect

4.1 Data provided by the user

• User name, display name, profile icon or account identifiers.
• Email address, when voluntarily provided for technical support, account recovery or authentication.
• Support requests, correspondence, privacy requests and data submitted in forms.
• Information submitted in forms, settings, account screens or support channels, including the public Support Request page.
• Purchase information made available by Google Play, Apple App Store or other stores.

4.2 Data collected automatically

• Device type, model, manufacturer, operating system and version.
• Language, country, region and approximate location inferred by IP or settings.
• IP address, application version, installation source and technical identifiers.
• Device identifiers, guest account identifiers and advertising identifiers where permitted.
• Game activity, progress, scores, achievements, rankings, rewards and statistics.
• Virtual currency, inventory, purchase entitlements and restore data.
• Cloud saves and local synchronisation.
• Local preferences, cooldowns, notification settings and local notification scheduling information.
• Crash logs, diagnostics, performance and security events.
• Ad interactions, impressions, rewarded ad completion and measurement.
• Privacy preferences, consent and compliance records.

The main application does not intend to collect precise real-time GPS location, government identifiers, health data, biometric data, racial or ethnic origin, religious beliefs or similar sensitive categories.

5. PlayFab, cloud, rankings and authentication

The application may use PlayFab, a Microsoft service, for guest login, authentication, Google Play Games login/linking, Apple login/linking, cloud saves, profiles, rankings, statistics, purchase validation, fraud prevention and account deletion. Data may include PlayFab ID, guest/custom ID, authentication method, display name, avatar or profile icon URL, progress, weekly/monthly scores, leaderboard entries, cloud save, statistics, inventory, virtual currency, remove ads entitlement, purchase data and deletion requests. Guest/custom IDs should be generated and stored with data minimisation. If a device-derived identifier is used for guest login, it must be treated as a device identifier and declared in store privacy forms.

6. Purposes of processing

• Provide, operate, maintain and protect the application.
• Enable gameplay, accounts, logins, cloud, rankings, profiles and related features.
• Process, validate, restore and manage purchases.
• Respond to support and requests.
• Send administrative, security, service and local notification messages.
• Fix errors, measure performance and improve the application.
• Detect fraud, cheating, abuse, security incidents and invalid advertising traffic.
• Show ads, measure performance, limit frequency and provide rewarded ads.
• Personalise ads only with valid consent or another permitted legal basis.
• Comply with legal obligations, platform policies and exercise rights.

7. Legal bases

Depending on the region, we may process data based on contract performance, consent, legitimate interests, legal obligation, exercise of rights, protection of the user or third parties, and other bases permitted by law. Consent may be withdrawn at any time, without affecting processing carried out before withdrawal.

8. Advertising, analytics and similar technologies

The application may use Unity LevelPlay, Unity Ads and Google AdMob. These services may collect or receive device data, advertising identifiers, IP, usage data, ad interactions, approximate location, diagnostics and performance.

Unity Analytics, Unity Dashboard services, crash/diagnostic tools or other analytics services should only be considered active if they are enabled in the final build or project configuration. If they are disabled, they should be removed from final store declarations and the Partners and SDKs Notice. If active, collection must appear in Google Play Data Safety and Apple App Privacy Details.

Depending on jurisdiction, device, age, consent and configuration, advertising may be contextual, non-personalised or personalised. If you reject personalised advertising, you may continue to see contextual or non-personalised ads.

9. Data sharing

We may share strictly necessary data with service providers, PlayFab/Microsoft, advertising and analytics partners, Cloudflare Workers and Resend used to receive support form submissions and deliver support, account deletion or privacy emails, Google, Apple, app stores, professional advisers, competent authorities and successors in corporate transactions. We do not sell personal data for money, but certain advertising practices may be considered sharing, sale or targeted advertising under some laws.

10. International transfers

Some providers may process data outside the user's country of residence, including the EEA, United Kingdom, United States and other countries. Where required, we use legal mechanisms such as adequacy decisions, standard contractual clauses, contractual commitments or equivalent safeguards.

11. Data retention period

Data is kept only for the period strictly necessary for the purposes described, unless a longer period is required by law:

Account and cloud progress data: kept while the account is active and for a reasonable subsequent period.

Local preferences and notifications: stored locally on the device until cleared or uninstalled by the user.

Technical and diagnostic data: generally deleted or anonymised within a maximum period of 24 months.

Purchase and compliance data: kept for the mandatory tax and legal periods required by Portuguese law.

12. Account deletion and data management

If the application allows account creation, the user may request deletion through the Delete Account option in settings when that feature is active, by email to contact@badduckstudio.com, through the Account Deletion Request page or through the Support Request page. Store-published versions that support account creation must also provide an in-app way to start account deletion where required by platform rules. Deletion may remove progress, cloud, rankings, inventory, virtual currency and associated rights, subject to legal or store exceptions.

13. Privacy rights

Depending on the region, the user may have rights of access, rectification, deletion, restriction, objection, portability, withdrawal of consent, opt-out of sale/sharing/targeted advertising and complaint to the competent authority. To exercise rights, contact contact@badduckstudio.com.

14. Security

We use reasonable technical, organisational and administrative measures to protect personal data. No system is completely secure.

15. Changes

We may update this Policy. We will change the effective date and make the revised version available in the application, website or store. Material changes will be notified and, where required, will depend on consent.

16. Contact

BAD DUCK STUDIO, LDA.
Rua das Acacias, no. 40-A, 3090-380 Figueira da Foz, Portugal
Company registration / VAT number: PT 518249891
Email: contact@badduckstudio.com