Privacy policy

Last updated: 2 November 2026

This policy explains what data the game Bolillas ("the game") uses, what for, and what you can do about it. The controller is Edison Jhon Moya Arias, in Ecuador. Write to soporte.bolillas@gmail.com with any question about your data.

The controller's contact details:

Name: Edison Jhon Moya Arias (Ecuador).
Postal address: Avenida Pajonal, Machala, El Oro, 070219, Ecuador
Phone: +593 958954909
Email: soporte.bolillas@gmail.com

1. The data we use

Your account

An account identifier created the first time you open the game (you play as a guest).
If you connect your Apple account in Profile, the identifier Apple gives us to recognise you and, if you choose to share it, the name on your Apple account (we never show it to anyone: in the game you appear with the name you choose). We don't ask for your email.
If you connect your Google account in Profile (on Android), the identifier Google gives us to recognise you, the name on your Google account and its email address, which Firebase stores with your game account. We never show them to anyone and we don't write to that address unless you write to us first.
If your iPhone is signed in to Game Center, the game connects your account to Game Center automatically when it opens (you can also connect it in Profile): the player identifier and nickname Game Center gives us. On Android, Google Play Games only receives your achievements (if you are signed in to it); we don't use it to recognise your account.
Your name in the game and your player code (for example, BOL-AB2CD).

Your game

Your tokens (bronze, silver and gold), tickets, marbles, effects, stars, levels and achievements.
Your match results (mode, difficulty, points and whether you won) and the tickets you trade in at Kiosk Marbles.
Your purchases: Apple's or Google Play's transaction identifier, the product and the date. We never see or keep your payment details; Apple or Google Play handles them.
Your custom marble: its name, its colour and your drawing.
The apps you share to from the game (only which app, to pay each app's share reward once) and, if you entered a friend's code, who invited you.

Online play

Your friends, requests, blocked players and recent players.
Your status (online, playing or offline, and when you were last seen). The game shows it to your friends, but any player who knows your account identifier (for example, someone who played with you online) could look it up.
Online matches: the room, the shots (the marbles' paths), emotes and the result.
Reports you make or receive (the reason and, if you write one, a note), and the records of shots the server rejects as possible cheating. So we can review each report in time, we also get an email about it in our support mailbox, with the reason, the note, the name and player code of the player reported (and, if the report is about their custom marble, that marble's name) and the report's identifier, which is made from the account identifiers of the player who reports and of the player reported.
An identifier of your phone to send you notifications (friend requests, invitations and gifts), if you allow them.

Your details for gifts (optional)

If you give them in Profile, your country and the day and month of your birthday. We never ask for the year, so we don't know your age.
We only use them to give you gifts: those the game gives to players in a country and your birthday gift. Nobody else sees them.
You can change or remove them at any time in Profile (your birthday can be changed once a year). If you set your birthday and allow notifications, your own phone reminds you on the day; that reminder is not sent by our server.

Your notifications

The messages you see in Notifications, for example that a friend gave you a ticket or accepted your request, with their name and player code.

Rewarded ads only appear when you choose to watch one. They are shown by Google AdMob.
Personalised ads, only with your permission. Just before the first ad you choose to watch, the game explains what it is for, and then your iPhone or iPad shows Apple's prompt asking whether you allow Bolillas to track your activity across other companies' apps and websites. If you allow it, Google may show you personalised ads based on your interests. On Android there is no such prompt: ads are personalised according to your phone's setting (Settings → Google → Ads, where you can turn personalisation off or delete your advertising ID) and, where the law requires it, according to what you choose in Google's form described below. If you don't, ads are non-personalised: they are chosen from the context (for example, that this is a game) and your approximate region, without using your interests. The reward is the same either way and the game works the same.
You can change your choice at any time in iPhone Settings → Privacy & Security → Tracking, where you can also deny tracking to every app; on Android, in Settings → Google → Ads.
What Google receives with each ad, to show and measure it and to prevent fraud:
- your device's advertising identifier (on iPhone, the IDFA, only if you allow tracking; on Android, Google's advertising ID, unless you deleted it or turned personalisation off in your phone's settings);
- device and usage data: the model, the system and your interaction with ads (which ones you see and whether you tap them);
- your IP address, from which Google estimates your approximate location (for example, your country or city).
If you allow tracking, Google may combine this data with what it has from other apps and websites to choose ads that interest you. More information: how Google uses information from apps that use its services.
To confirm that you watched the ad and give you the reward, we send Google your game account identifier and the type of reward with each ad (not your name). Google sends it back to us when the ad ends.
If you don't allow tracking (iPhone) or turn personalisation off (Android), your device's advertising identifier is not used to personalise and we don't track you across other companies' apps or websites.
In the European Economic Area, the United Kingdom and Switzerland, when you open the game we also ask for your consent with Google's form, which appears before Apple's prompt (on Android, before the first ad) and also decides whether ads can be personalised; you can change it in Settings → Ad privacy options.

What we don't use

We don't use your phone's precise location (only the approximate region Google estimates from the IP address, as explained above, and the country you give us if you want to), your age, your phone's contacts, photos, microphone or camera. The game has no free-text chat.

2. What we use it for

To run the game and keep your progress on our server, so you don't lose it when you change phones.
To deliver your purchases and let you restore them.
Online play: friends, rooms, matches, prizes and notifications.
To give you gifts: those for your country and your birthday gift, only if you gave us those details.
To keep the game fair: detecting cheating, handling reports and applying the community rules.
To show the ads you ask for and pay their reward and, only if you allow it, to personalise them.

We use your data because it is needed to provide the service you ask for when you play, because of our legitimate interest in a fair and safe game, and, for personalised ads and your details for gifts, with your permission (and with your consent where the law requires it).

3. Who else sees or processes your data

Other players see your name, your player code, your custom marble (unless they hide them in their settings), your emotes and your play in online matches. They never see your country or your birthday. Your friends also see your status (and, as explained above, anyone who knows your account identifier can look it up).
Google (Firebase, for the server, accounts, notifications and checking that you use the genuine game; Gmail, where we receive support emails and report notices; AdMob and its consent form, for ads; on Android, also Google Play and its purchases, Sign in with Google and Google Play Games, which keeps your achievements if you are signed in to it).
Apple (on iPhone and iPad: App Store and purchases, Sign in with Apple, Game Center, which also keeps your achievements if you are signed in to it, and notifications).

We don't sell your data. Google and Apple process it to provide those services to us, under their own policies (Google, Apple), and give it the same or equal protection as this policy describes. Our server runs on Firebase in the United States, so your data is processed there with Google's safeguards.

4. How long we keep it

For as long as your account exists, except as explained below.
You can delete your account at any time from the game (Settings → Delete my account). Your profile, name, player code, country and birthday, notifications, tokens, tickets and collection, achievements, match results, custom marble (including its copies in online rooms), friends, requests, blocked and recent players, status, notification identifier, the record of the tickets you traded in at Kiosk Marbles and of the rewarded ads you watched, and your sign-in are deleted. We also remove you from other players' friend, recent and blocked lists. Tokens you bought with money (including those in the Starter Pack) are lost. Marbles and effects bought with real money, including those in the Starter Pack, stay with Apple or Google Play and come back on a new account with Restore Purchases. Achievements already sent to Game Center or Google Play Games stay on that account, which belongs to Apple or Google. You can also request deletion without the app: write to soporte.bolillas@gmail.com with your player code (BOL-XXXXX) from the email of the Google or Apple account you connected, or with details that let us recognise you; we delete the same as from the game within 15 days and keep only the record of purchases with money to handle refunds (see Support).
The record of your real-money purchases is kept after you delete your account, to handle refunds and meet legal obligations.
The messages in your notifications are deleted after 30 days.
Online match rooms, with their shots, emotes and result, are deleted 30 days after the room was last used.
Reports (including the email notice we get) and records of rejected shots are kept for up to 12 months so fair play can be reviewed, even if you delete your account sooner, and are then deleted. The copy of the notice left on our server is deleted sooner, 30 days after it is sent.

5. Your rights

You can ask us for a copy of your data, correct it (change your name, country and birthday in Profile, where you can also remove your country and birthday), delete it (in Settings; section 4 explains what is deleted and what is kept), object to a use, or withdraw your consent for ads (in Settings) and your permission to track (in iPhone Settings → Privacy & Security → Tracking; on Android, in Settings → Google → Ads). Write to soporte.bolillas@gmail.com. You have these rights under Ecuador's Organic Law on Personal Data Protection and, if you live in Europe or the UK, under the GDPR. You can also complain to your country's data protection authority.

6. Children

Bolillas is not directed at children under 13. If you are a parent or guardian and believe a child under 13 gave us data, write to us and we will delete it.

7. Security

Only our server can change your progress, connections are encrypted, and each player can only read their own private data. So that only the genuine game can use our server functions (the ones that change your progress, tokens, friends and online matches), we use Firebase App Check: on iPhone and iPad with Apple's App Attest, and on Android with Google's Play Integrity. Your device creates a proof that the app has not been modified and comes from the official store, which Apple or Google check. That proof does not include your name or your game data.

8. Changes

If we change this policy, we will update the date above and, if the change is important, let you know in the game.