Privacy Policy
1. Introduction
This Privacy Policy explains how BAD DUCK STUDIO, LDA ("Bad Duck Studio", "we", "us" or "our") collects, uses, stores, shares and protects personal data when you download, access or use WordWildWest (the "Application").
WordWildWest is an ad-supported mobile word game. It may use app-store services, authentication providers, PlayFab backend services, cloud saves, leaderboards, player statistics, in-app purchase validation, advertising SDKs, analytics or diagnostics if enabled, local notifications, support channels, performance technologies and similar technologies.
This Policy should be read together with our Terms and Conditions, Cookie and Similar Technologies Policy, Regional Privacy Addendum and Partners and SDKs Notice.
2. Data controller
For the purposes of applicable data protection laws, the controller responsible for the processing described in this Policy is BAD DUCK STUDIO, LDA, Rua das Acacias, 40A, 3090-380 Figueira da Foz, Portugal, company registration / VAT number PT 518249891.
You can contact us at contact@badduckstudio.com. If we appoint a data protection officer, representative, privacy officer or equivalent contact required by applicable law, we will publish the relevant details in this Policy or in the Regional Privacy Addendum.
3. Personal data we collect
The data we collect depends on your device, region, settings, consent choices and enabled features.
3.1 Information you provide
- display name, username, profile icon or account identifiers;
- email address, if you provide one for support, account recovery or authentication;
- support requests, correspondence and privacy requests;
- information submitted through forms, settings, account screens or support channels, including the public Support Request page;
- purchase-related information made available by Google Play, Apple App Store or other app stores.
3.2 Information collected automatically
- device type, model, manufacturer, operating system and version;
- language, country, region and approximate location inferred from IP address or device settings;
- IP address, app version, install source and technical identifiers;
- device identifiers, guest account identifiers and advertising identifiers where permitted;
- gameplay activity, level progress, scores, achievements, leaderboards, rewards and statistics;
- virtual currency, inventory, purchase entitlement and restore information;
- cloud save data and local save synchronisation information;
- local preferences, cooldowns, notification settings and local notification scheduling information;
- crash logs, diagnostics, performance data and security events;
- advertising interactions, ad impressions, reward completion, frequency capping and ad measurement events;
- privacy choices, consent status and related compliance records.
Because the Application may be used by children, we aim to avoid collecting more personal data than is necessary for gameplay, security, purchases, cloud saves, leaderboards, support, legal compliance and child-appropriate advertising or consent controls.
The core Application does not collect precise real-time GPS location, government identifiers, health information, biometric identifiers, racial or ethnic origin, religious beliefs or similar sensitive categories. If this changes, we will update this Policy and provide additional choices where required.
3.3 Information from third-party platforms and services
If you use Google Play, Apple App Store, Game Center, Google Play Games, Apple authentication, PlayFab or similar platforms, we may receive limited information from those platforms according to your settings and the platform's policies. This may include authentication tokens, user IDs, display names, platform account links, purchase validation data, device signals and entitlement information.
4. PlayFab, cloud saves, leaderboards and authentication
The Application may use PlayFab, a Microsoft service, to provide guest login, authentication, cloud saves, player profiles, leaderboards, player statistics, purchase validation, anti-fraud features and account deletion workflows.
Data processed through PlayFab may include PlayFab ID, guest/custom ID, Google Play Games login/link data, Apple login/link data, authentication method, display name, avatar or profile icon URL, gameplay progress, weekly and monthly scores, leaderboard entries, cloud save data, player statistics, inventory, virtual currency, remove-ads entitlement, purchase validation data, ban/fair-play records and account deletion requests. Guest/custom IDs should be generated and stored in a privacy-minimising way. If a device-derived identifier is used for guest login, it should be treated as a device identifier and disclosed in store privacy forms.
5. How we use personal data
- to provide, operate, maintain and secure the Application;
- to enable gameplay, accounts, guest login, Google login, Apple login, cloud saves, leaderboards, profiles and related features;
- to process, validate, restore and manage in-app purchases and entitlements;
- to provide customer support and respond to enquiries;
- to send service messages, security alerts, local notifications and administrative communications;
- to debug, test, analyse, measure and improve the Application;
- to detect, prevent and investigate fraud, cheating, misuse, security incidents and invalid ad traffic;
- to display ads, measure ad performance, limit ad frequency and provide rewarded ads;
- to personalise ads only where we have valid consent or another lawful basis permitted by applicable law;
- to comply with legal obligations, platform requirements and enforce our rights.
6. Legal bases for processing
Depending on your region, we rely on one or more of the following legal bases:
- Contract: to provide gameplay, accounts, cloud saves, purchases, leaderboards, support and requested features.
- Consent: for personalised advertising, non-essential analytics, marketing communications, cookies, SDKs or similar technologies where required.
- Legitimate interests: to maintain, secure, improve and protect the Application, prevent fraud and cheating, analyse performance, fix bugs and enforce fair play, provided your rights do not override those interests.
- Legal obligation: to comply with tax, accounting, consumer protection, data protection, regulatory, law enforcement or platform obligations.
- Vital interests / public interest: only where applicable law permits and the circumstances require it.
You may withdraw consent at any time where processing is based on consent. Withdrawal does not affect processing that took place before withdrawal.
7. Advertising, analytics and similar technologies
The Application may use advertising and mediation services, including Unity LevelPlay, Unity Ads and Google AdMob. These services may collect or receive device information, advertising identifiers, IP address, app usage data, ad interaction data, approximate location, diagnostics and performance data.
Unity Analytics, Unity dashboard services, crash/diagnostic tools or other analytics services may be used only if enabled in the final build or project configuration. If they are disabled, they should be removed from the final store disclosures and SDK notice. If enabled, their data collection should be reflected in Google Play Data Safety and Apple App Privacy Details.
Depending on your jurisdiction, device settings, age status, consent choices and partner configuration, advertising may be contextual, non-personalised or personalised. If you reject personalised advertising, the Application may still show contextual or non-personalised ads.
More information is available in the Cookie and Similar Technologies Policy, Partners and SDKs Notice and Privacy Choices and Consent Controls.
8. Sharing of personal data
We may share personal data with:
- service providers that help operate, host, secure, analyse or improve the Application;
- PlayFab and backend service providers used for accounts, cloud saves, purchase validation and leaderboards;
- advertising, mediation and analytics partners, subject to consent choices where required;
- Cloudflare Workers and Resend, used to receive support form submissions and deliver support, account deletion or privacy request emails to us;
- Google, Apple and app-store or platform providers;
- professional advisers, auditors, insurers or legal representatives;
- competent authorities, courts, regulators or law enforcement where required by law or necessary to protect rights, safety, security or prevent fraud;
- successors or potential successors in a merger, acquisition, restructuring, sale of assets or similar transaction.
We do not sell personal data for money. However, some advertising or analytics practices may be considered "sharing", "sale", "targeted advertising" or similar under certain privacy laws. Where required, we provide applicable opt-out mechanisms.
9. International transfers
Some service providers and advertising partners may process personal data outside your country of residence, including in the European Economic Area, United Kingdom, United States and other countries where our providers operate. Where required by law, we rely on appropriate safeguards such as adequacy decisions, standard contractual clauses, contractual commitments or other lawful transfer mechanisms.
10. Data retention
We keep personal data only for as long as reasonably necessary for the purposes described in this Policy, unless a longer period is required or permitted by law.
- account data is retained while your account remains active and for a reasonable period afterwards;
- gameplay, cloud save, inventory, score and leaderboard data is retained while needed to provide the relevant features;
- automatically collected technical, diagnostic and usage data is generally retained for up to 24 months and may then be aggregated or anonymised;
- support communications are retained as needed to respond to your request and maintain records;
- local notification settings and local preferences are retained on your device until changed, reset or deleted;
- purchase and entitlement records are retained as required for accounting, tax, fraud prevention, app-store requirements and legal compliance;
- consent records are retained as necessary to demonstrate compliance, respect your choices and prevent repeated prompts;
- security, anti-cheat and fraud records may be retained as needed to protect the Application and enforce these Terms.
When personal data is no longer needed, we delete, anonymise or aggregate it unless retention is required by law.
11. Account deletion and data management
If the Application allows account creation, you can request deletion of your account and associated data through the Delete Account option in the Application settings when that feature is enabled, or by contacting us at contact@badduckstudio.com. A web request path is also available at Account Deletion Request (https://badduckstudio.com/account-deletion.html), and support requests can be submitted through Support Request (https://badduckstudio.com/support.html). App-store releases that support account creation should also provide an in-app way to initiate account deletion where required by platform rules.
Deleting an account may result in loss of progress, cloud saves, leaderboard entries, virtual goods, virtual currency, remove-ads entitlements or other account-based features, except where applicable law requires otherwise. Some records may be retained for legal compliance, fraud prevention, dispute resolution, enforcement, tax, accounting or app-store transaction requirements.
12. Your privacy rights
Depending on your country or region, you may have the right to:
- request access to your personal data;
- request correction of inaccurate or incomplete data;
- request deletion of your personal data;
- request restriction of processing;
- object to processing based on legitimate interests or direct marketing;
- withdraw consent at any time;
- request data portability;
- opt out of sale, sharing or targeted advertising where applicable;
- lodge a complaint with a competent data protection, privacy or consumer authority.
To exercise your rights, contact us at contact@badduckstudio.com. We may need to verify your identity before responding. We will respond within the timeframe required by applicable law.
13. Children and teenagers
The Application is a general-audience word game that may be suitable for children, teenagers and adults. We do not knowingly use personal data from children for personalised advertising where this is prohibited or requires parental consent that has not been obtained. If you are a parent or guardian and have questions about a child's data, please contact us.
Where child or teenager privacy rules apply, we may apply age-appropriate privacy settings, disable personalised advertising, limit data collection, rely on platform age signals, request parental consent, use child-directed ad settings or restrict features as required. Additional information is provided in the Regional Privacy Addendum.
14. Security
We use reasonable technical, organisational and administrative safeguards designed to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. No system, network or method of transmission is completely secure, and we cannot guarantee absolute security.
15. Changes to this Privacy Policy
We may update this Policy from time to time. When we do, we will update the effective date and make the revised version available through the Application, website or app-store listing. For material changes, we will take reasonable steps to notify you and, where required by law, obtain consent before the change takes effect.
16. Contact us
BAD DUCK STUDIO, LDA
Rua das Acacias, 40A, 3090-380 Figueira da Foz, Portugal
Company registration / VAT number: PT 518249891
Email: contact@badduckstudio.com