Effective date: 25 October 2026
App: Crumbellion (Android, package com.ottranstudios.crumbellion)
Controller: Ottran Studios (Murali Dhara Sudhan Panneer Selvam), Avenue du Roi Albert 228, 1082 Brussels, Belgium
Contact and feedback: loopzerotech@gmail.com
Crumbellion is a party board game. We built it to collect as little as possible: there are no accounts, no logins, no player names, no chat and no server-side player database. This policy explains what is processed, why, on what legal basis, for how long, and what your rights are under the EU General Data Protection Regulation (GDPR).
The snack mascots you pick, your Snack Stars balance, unlocked worlds, power-ups, settings, a saved match, the purchase records needed to restore your items, and a local diagnostics log are stored only on your phone. We never receive them. Uninstalling the app or clearing its data deletes them. Android cloud backup of this data is switched off.
When you choose Play Online, the app connects to our relay server, which runs on Cloudflare Workers. The relay passes game messages between the phones in the same room: the 6-character room code, the seat number, the game version, the mascot each player picked, the power-ups brought into the match, and the moves of the game. Other players in your room see the snack mascot you pick; there are no user names, no chat and no free text. To deliver the connection, your IP address is processed by the relay and by Cloudflare.
The relay keeps this only in memory while the room is open and does not write it to storage. Rooms close when the match ends, when the host leaves or after 15 minutes of inactivity. Cloudflare, Inc. may keep short-lived technical and security logs under its own privacy policy.
The app shows ads served by Google AdMob (banner, interstitial and optional rewarded video ads). The Google Mobile Ads SDK collects and shares with Google: your device's advertising ID and app set ID, your IP address (used to estimate an approximate location), app interactions such as app launches, taps and video views, and diagnostic information such as launch time and hang rate. Google uses this to show and measure ads, for analytics, and to prevent fraud. All of it is encrypted in transit. Ads in the app are limited to content suitable for general audiences.
In the EEA, the UK and Switzerland, Google's consent message asks for your choice before personalised ads are shown or information on your device is accessed for ads. If you decline, Google may still show non-personalised or limited ads. You can change or withdraw your choice at any time under Settings > Privacy & ad choices in the game. You can also reset or delete your advertising ID in your Android settings. See how Google uses data in ads and the Google Privacy Policy.
The paid Remove Ads item switches off banner and interstitial ads. Optional rewarded videos stay available but only play if you tap them.
Purchases are processed by Google Play. We never see your payment details or your Google account. The app keeps the purchase token and product ID on your phone so it can deliver and restore your item; they are not sent to us. Google processes your purchase under the Google Privacy Policy.
Settings and the pause menu have a "Send feedback" button. It only opens a draft e-mail in your own mail app, addressed to loopzerotech@gmail.com and pre-filled with the app version, device model, Android version, graphics chip and quality setting, and the last 20 lines of the local diagnostics log. Nothing is sent unless you choose to send the e-mail, and you can edit or delete any part of it first. "Copy diagnostics" in Settings works the same way: the log is only copied to your clipboard.
If you write to us, we receive your e-mail address and what you send. We use it only to answer you and to fix problems, and we delete it once your question is closed, at the latest 12 months after our last exchange. Our e-mail is hosted by Google (Gmail).
| Processing | Purpose | Legal basis (GDPR) |
|---|---|---|
| Local game data on your phone | Run the game, keep your progress and purchases | Performance of the service you asked for (Art. 6(1)(b)) |
| Relay: IP address, room code, game messages | Connect you with your friends' phones for online play | Performance of the service you asked for (Art. 6(1)(b)); security and abuse prevention: legitimate interest (Art. 6(1)(f)) |
| Personalised ads, and reading or storing information on your device for ads | Show and measure personalised ads | Your consent (Art. 6(1)(a) and the ePrivacy rules), which you can withdraw at any time |
| Non-personalised / limited ads, ad measurement and fraud prevention | Fund the free game, keep ads safe | Legitimate interest (Art. 6(1)(f)), and consent where the law requires it |
| In-app purchases | Deliver and restore what you bought | Performance of a contract (Art. 6(1)(b)) |
| Feedback e-mails | Answer you and fix bugs | Legitimate interest in supporting players (Art. 6(1)(f)) |
Google Ireland Ltd / Google LLC (AdMob ads, Google Play purchases, Gmail for our e-mail) and Cloudflare, Inc. (relay hosting and security). Other players in your room receive the in-game messages described in section 2. We do not sell personal data and do not share it with anyone else.
Google LLC and Cloudflare, Inc. are based in the United States, so data may be processed there. These transfers rely on the EU-U.S. Data Privacy Framework, under which both companies are certified, and/or on the European Commission's Standard Contractual Clauses.
Under the GDPR you have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, to data portability, and to withdraw your consent at any time (Settings > Privacy & ad choices) without affecting processing done before. Because we hold no player data on our servers, most requests are covered by clearing the app's data on your phone; for anything else, or for data Google holds, write to loopzerotech@gmail.com and we will answer within one month.
You also have the right to lodge a complaint with a supervisory authority. In Belgium this is the Autorité de protection des données / Gegevensbeschermingsautoriteit (Data Protection Authority), Rue de la Presse 35 / Drukpersstraat 35, 1000 Brussels, autoriteprotectiondonnees.be / gegevensbeschermingsautoriteit.be. You may also contact the authority in the EU country where you live.
Crumbellion is intended for players aged 13 and over and is not directed at children under 13. We do not knowingly collect personal data from children. In the EEA the age at which a person can give consent for online services by themselves ranges from 13 to 16 depending on the country (13 in Belgium); where Google's consent message applies, younger players need a parent's consent. If you believe a child has sent us personal data, contact us and we will delete it.
Connections to the relay are encrypted (WSS/TLS). The game asks for no contacts, camera, microphone, location or storage permissions and uses no analytics SDK.
If this policy changes, we will update this page and its effective date. Significant changes will also be mentioned in the app's release notes.