Privacy Policy

Application: Daubrush Loto (Android) · Effective date: 13 July 2026 · Version 1.0

Data Controller

StrongUnion Games
Contact for all privacy matters: support@daubrush.com

We are the “data controller” of your personal data — meaning we decide why and how it is processed.

This Privacy Policy explains what information the Daubrush Loto mobile game (the “App”) collects about you, why we collect it, who we share it with, how long we keep it, and what rights you have. It applies to all users of the App and to this website (daubrush.com).

By creating an account or using the App, you acknowledge that you have read and understood this Policy.

Contents

Information we collect
How we use your data
Legal bases (GDPR)
Advertising
Purchases & payments
Who we share data with
International transfers
How long we keep data
Security
Your rights
Deleting your account
Children
Automated decisions
Changes to this Policy
Contact & complaints

1. Information we collect

1.1 Information you provide to us

Account credentials — your email address and/or mobile phone number, and a password. Passwords are never stored in readable form; they are hashed using the bcrypt algorithm, which cannot be reversed.
Social sign-in data — if you choose to sign in with Google or Facebook, we receive from that provider your name, email address and a unique account identifier. We do not receive your social media password, and we do not post anything to your social accounts.
Profile information — the username you choose, an optional profile picture you upload, your country and your preferred language.
User-generated content — messages you send in game rooms and in private chats with friends, and any reports you submit about other players.

1.2 Information collected automatically

Gameplay data — games played, games won, score, experience points, level, coin balance, achievements unlocked, missions completed, tournament entries and results, friend list, rooms joined.
Device and technical data — IP address, device model, operating system and version, app version, language and time-zone settings, and crash/diagnostic reports if the App stops unexpectedly.
Advertising identifier — your Google Advertising ID (a resettable identifier controlled by you), used to serve and measure ads.
Push notification token — a device-specific identifier issued by Firebase Cloud Messaging so that we can deliver notifications to you.

1.3 Information we receive from third parties

Google Play — confirmation that a purchase was completed, the product purchased and a transaction identifier.
RevenueCat — the verified status of your purchases and entitlements (for example, whether VIP is active).
Google / Facebook — the profile fields described in section 1.1, only if you use social sign-in.

We do not collect: your precise location (GPS), your contacts, your photos or media library (other than a picture you deliberately upload), your microphone or camera, your SMS messages, or your payment card details.

2. How we use your data

Purpose	What this means in practice
Providing the service	Creating and authenticating your account, matching you into game rooms, running the draw, tracking coins, XP, levels, friends and tournaments.
Purchases	Verifying with Google Play and RevenueCat that a purchase is genuine, then crediting the coins or VIP status to your account.
Communications	Sending you a verification code by SMS or email, a password-reset code, and in-app push notifications (for example, when it is your turn or a tournament starts).
Advertising	Displaying ads that keep the game free, and granting rewards when you voluntarily watch a rewarded ad.
Safety & fraud prevention	Detecting cheating, bots, duplicate or fake accounts, abusive chat, and misuse of purchases or rewards; enforcing our Terms of Service.
Support	Responding to your questions, deletion requests and complaints.
Improving the App	Diagnosing crashes and errors, and understanding aggregate usage so we can fix problems and improve the game.
Legal compliance	Keeping accounting and tax records of purchases, and responding to lawful requests from authorities.

We do not use your personal data for any purpose that is incompatible with those listed above, and we do not sell your personal data to anyone.

3. Legal bases for processing (GDPR Article 6)

Our servers are located in the European Union, and we apply the standards of the EU General Data Protection Regulation (GDPR) to all users. We rely on the following legal bases:

Processing activity	Legal basis
Creating your account; operating the game; verifying and delivering purchases	Performance of a contract (Art. 6(1)(b)) — necessary to provide the service you asked for
Preventing fraud, cheating and abuse; securing our systems; enforcing our Terms	Legitimate interests (Art. 6(1)(f)) — protecting the integrity of the game and other players
Personalised advertising; optional push notifications	Consent (Art. 6(1)(a)) — which you may withdraw at any time
Keeping purchase, accounting and tax records	Legal obligation (Art. 6(1)(c))
Diagnosing crashes and improving the App	Legitimate interests (Art. 6(1)(f)) — keeping the App stable and usable

4. Advertising

The App is free to download and play, and is funded by advertising. Ads are served through Google AdMob.

AdMob and its advertising partners may collect and process your advertising identifier, IP address, device information and interactions with ads in order to select, deliver, measure and improve the ads you see.
Some ads are rewarded ads: you choose to watch them in exchange for in-game rewards. Watching them is always voluntary.
You can learn how Google uses this information here: policies.google.com/technologies/partner-sites.

How to limit ad personalisation: on your Android device open Settings → Google → Ads, where you can reset your advertising ID or opt out of ad personalisation. You will still see ads, but they will be less relevant to you.

5. Purchases and payments

The App offers optional in-app purchases (coin packs and VIP status).

All payments are processed entirely by Google Play. We never see, receive or store your credit/debit card number, bank details or billing address.
We receive only a transaction identifier, the product purchased, and confirmation that the payment succeeded. This is verified server-side through RevenueCat before any coins or VIP status are granted.
Virtual items (coins, VIP) have no monetary value outside the game and cannot be exchanged for cash. See our Terms of Service.
Refunds are handled by Google Play under Google's refund policy.

We share personal data only with the service providers below, only to the extent necessary for them to perform their function, and only under contracts that require them to protect your data. They act as our processors or as independent controllers, as indicated.

Provider	What they receive	Why	Their policy
Google (Sign-In, Firebase, AdMob, Play Billing)	Account identifier, email (sign-in); push token; advertising ID and device data (ads); purchase tokens (billing)	Social sign-in, push notifications, advertising, payment processing	Policy
Meta (Facebook)	Facebook account identifier and basic profile — only if you use Facebook login	Social sign-in	Policy
RevenueCat	Your app user ID and purchase receipts	Server-side verification of purchases and entitlements	Policy
Amazon Web Services (S3, SES)	Profile pictures you upload; your email address when we send you a message	Image storage; sending verification and password-reset emails	Policy
SMS provider	Your phone number and a one-time code	Delivering login/verification codes by SMS	—
Hetzner Online GmbH (Germany)	Hosts our servers and database	Infrastructure / hosting	Policy

We may also disclose personal data where we are legally required to do so — for example, in response to a valid court order or a lawful request from a public authority — or where necessary to establish, exercise or defend legal claims.

We never sell your personal data, and we do not share it with data brokers.

7. International data transfers

Our servers and database are hosted in the European Union (Germany). However, some of the providers listed in section 6 — notably Google, Amazon Web Services and RevenueCat — are based in, or process data in, the United States.

Where personal data is transferred outside the European Economic Area, that transfer is protected by an appropriate safeguard recognised under GDPR — typically the European Commission's Standard Contractual Clauses, and/or the provider's certification under the EU–US Data Privacy Framework. You may request further information about these safeguards by contacting us.

8. How long we keep your data

Data	Retention period
Account data (email, phone, username, profile picture, password hash)	For as long as your account exists. Erased when you delete your account.
Gameplay data (coins, XP, level, achievements, tournament results)	For as long as your account exists. Erased when you delete your account.
Chat messages	For as long as your account exists, or until deleted. Erased when you delete your account.
Purchase and transaction records	Retained in anonymised form (no longer linked to you) for up to 7 years, to satisfy accounting and tax obligations.
Server logs (including IP address)	Up to 90 days, then automatically deleted.
Crash and diagnostic reports	Up to 90 days.
Records of moderation actions (bans, reports)	Up to 2 years, to prevent repeat abuse.
Encrypted database backups	Rolling 7-day window; deleted data disappears from backups within 7 days.

9. How we protect your data

Encryption in transit — all communication between the App and our servers uses HTTPS/TLS. Unencrypted (cleartext) traffic is disabled in the App.
Password hashing — passwords are hashed with bcrypt and are never stored or transmitted in readable form. We cannot see your password, and we will never ask you for it.
Access control — administrative access to production systems is restricted, key-based and audited. The database is not reachable from the public internet.
Network protection — a firewall permits only the ports strictly required, and automated protection blocks brute-force login attempts.
Server-side validation — game results, purchases and rewards are verified on our servers, so they cannot be forged by a modified client.
Backups — the database is backed up daily and retained for 7 days so that data can be restored after an incident.

No system can be guaranteed to be completely secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours and, where the risk is high, inform you directly.

10. Your rights

You have the following rights in relation to your personal data:

Right of access — obtain confirmation of whether we process your data and receive a copy of it.
Right to rectification — have inaccurate or incomplete data corrected.
Right to erasure (“right to be forgotten”) — have your personal data deleted. See section 11.
Right to restriction — ask us to temporarily stop processing your data while a dispute is resolved.
Right to data portability — receive your data in a structured, commonly used, machine-readable format.
Right to object — object to processing based on our legitimate interests.
Right to withdraw consent — where processing is based on consent (such as personalised ads or push notifications), you may withdraw it at any time, without affecting processing carried out before withdrawal.
Right to lodge a complaint — with a data protection supervisory authority (see section 15).

To exercise any of these rights, email support@daubrush.com. We will respond within 30 days. Exercising your rights is free of charge. We may ask you to confirm the email address or phone number registered to your account so that we can verify your identity.

11. Deleting your account

You can permanently delete your account and personal data at any time.

In the App: Profile → Settings → Delete account — takes effect immediately.
Without the App: follow the instructions at daubrush.com/delete-account, or email support@daubrush.com.

Deletion removes your email address, phone number, username, profile picture, social login links, chat messages, friendships and gameplay data. Purchase records are retained in anonymised form only, as explained in section 8. Deletion is permanent and cannot be undone; purchased coins and VIP status are forfeited and are not refunded.

12. Children

The App is not directed to children under 13 years of age (or the higher minimum age that may apply in your country), and we do not knowingly collect personal data from them. The App is not designed for children, contains ads, and offers in-app purchases.

If we become aware that we have collected data from a child below the applicable age without valid parental consent, we will delete that data promptly. If you are a parent or guardian and believe your child has provided us with personal data, please contact support@daubrush.com and we will remove it.

13. Automated decision-making

We use automated checks to detect cheating, bot activity, abusive behaviour and fraudulent purchases. These checks may lead to a temporary or permanent restriction of your account. We do not use automated processing that produces legal effects concerning you in the sense of GDPR Article 22, and you always have the right to contact us and have a human review any restriction applied to your account by writing to support@daubrush.com.

14. Changes to this Policy

We may update this Policy from time to time — for example, if we add a new feature or change a service provider. The “Effective date” at the top of this page always shows the current version. If a change materially affects your rights, we will notify you in the App and/or by email before it takes effect. Continuing to use the App after a change means you accept the updated Policy.

15. Contact and complaints

For any question, request or complaint about privacy, contact:

StrongUnion Games
Email: support@daubrush.com

If you are in the European Economic Area and you believe we have not handled your personal data lawfully, you also have the right to lodge a complaint with your national data protection supervisory authority. A list of EEA authorities is available at edpb.europa.eu. We would, however, appreciate the opportunity to address your concerns first.