1Introduction
This Policy explains how personal data related to MESCLA, an app for iOS and Android developed by Onrizon Social Games (“Onrizon”, “we” or “us”), is processed. Onrizon is responsible for decisions about the processing of data under its control.
For privacy questions, complaints, and requests, including from parents or guardians, please write to team@gartic.com.
2Information we use
Gameplay
The devices are synced through a connection between the participants, with the device that sets up the room, called the host, acting as the central point of the match. To run the game, the app uses the room code, information about participation in the session, the assigned colors, the chosen mode, and gameplay commands and results.
This information is used to sync actions between the devices. We do not produce statistics on matches or on players' performance. This is separate from the general app usage statistics described below.
MESCLA's hosting infrastructure is provided by Vultr. Network connections may involve processing IP addresses and technical session identifiers needed to establish and maintain communication and to protect the infrastructure. Joining a room does not give access to other apps or to private files on another device.
Usage statistics
We use Google Analytics for Firebase to understand how MESCLA is used and to improve its features. Depending on the configuration adopted, the service may process usage events, sessions, screens viewed, interactions, and technical information about the app and the device, such as app version, operating system, and language.
The service may also use app installation or instance identifiers. These identifiers make it possible to distinguish between installations or sessions. The data actually collected must match the features and settings adopted in MESCLA.
Crash reports
We use Firebase Crashlytics to identify and fix crashes. Reports may include information about the error, the app's state and version, the device's technical characteristics, and installation identifiers. You do not need a MESCLA account for these reports to contain data about how a device is used.
Purchasing the Full version
The one-time purchase of the Full version is handled directly through the App Store or Google Play and is tied to the associated Apple or Google account. Your store account is independent of MESCLA: you do not need an in-game account to make a purchase or join matches.
The store handles authentication and payment data. MESCLA does not ask for your Apple or Google password or full card details to complete the transaction. To unlock or restore the Full version, the app uses the purchase confirmation and product access information provided by the store.
Records kept by Apple and Google are subject to their respective privacy policies. Purchase information under Onrizon's control is used to verify access to the Full version, provide support, prevent fraud, and comply with legal obligations related to the purchase.
Contact and requests
If you contact us, we receive your email address, message, and any attachments you choose to send. We use this information to respond, provide support, and handle requests or obligations related to your message. Please avoid sending sensitive data, passwords, or unnecessary third-party information.
3Purposes and legal bases
We process information to enable participation in matches, recognize access to the Full version, provide support, understand how the app is used, fix crashes, protect the service, and comply with legal obligations and requests to exercise rights.
Processing must be limited to what is necessary for each purpose and rest on a legal basis compatible with applicable law. Depending on the operation, this may be the performance of the service you requested, compliance with a legal obligation, the exercise of rights, consent, or legitimate interest, where permitted and after assessing its necessity, proportionality, and impact on data subjects.
Relying on legitimate interest does not replace the consent required for certain technologies or operations. The processing of personal data of children and teenagers is subject to the principle of their best interests and applicable legal requirements.
4Choices and consent
Accepting the Terms of Use, purchasing the Full version, or continuing to use the app does not, by itself, constitute consent to any collection that depends on a specific choice.
We use Firebase Analytics and Crashlytics to understand how the app is used and to identify crashes. Where the law requires consent for a particular collection, we ask for your permission before it begins. You may refuse or withdraw that consent, and request information about the processing, by emailing team@gartic.com.
Withdrawing consent stops future processing that depends on it, without affecting the lawfulness of processing carried out previously. Deletion requests are handled in accordance with applicable law, subject to cases in which the law requires data to be kept.
Diagnostic information may remain temporarily stored on the device. Storing it locally does not, by itself, mean that it has been sent to Onrizon or Google. Sending it must also respect your privacy choices and applicable legal requirements.
5Service providers and sharing
Google provides the Google Analytics for Firebase and Crashlytics services used in MESCLA. This processing is subject to the terms applicable to each service and to the controls contracted or configured by Onrizon.
Apple and Google also process information in connection with their respective stores, accounts, and payments, under their own policies. Information under Onrizon's control may be shared when necessary to comply with a legal obligation, respond to a valid order from a competent authority, or exercise rights, subject to applicable legal requirements.
Vultr provides the hosting infrastructure used by MESCLA and may process technical information needed to provide that service. Providers' access to data under Onrizon's control must be limited to contracted purposes, subject to applicable data protection and security obligations.
See also:
6Retention and deletion
We keep information for as long as necessary for the purpose that justified its processing. To determine this period, we consider the length of the session, the need for support or crash investigation, the settings of the services used, and legal retention obligations.
- Matches and connection: information needed for syncing is used during the session. We do not keep a database meant to produce match statistics. Any technical connection and security logs are handled separately and kept for as long as necessary for operations, incident investigation, and compliance with legal obligations.
- Analytics: usage data follows the project's retention settings and applicable limits of the service. Its retention must be limited to analyzing and improving the app. Truly anonymized statistics may be kept for historical comparison.
- Crashlytics: according to the provider's documentation, reports and their associated identifiers are kept for 90 days before being removed from active and backup systems. This period does not guarantee complete deletion on the 90th day.
- Purchases: information under Onrizon's control is kept for as long as necessary to verify the access you purchased, restore purchases, resolve requests, and comply with legal obligations. Store records follow the stores' own policies and do not depend on the existence of a MESCLA account.
- Contact and requests: information is kept for as long as necessary to reply to and resolve the matter, demonstrate that it was handled, comply with obligations, and exercise rights, and never indefinitely without a legal basis.
Once the purpose has ended and there is no basis for keeping the data, it must be deleted or anonymized. Uninstalling the app does not automatically delete information already sent to providers or legitimately kept by the stores.
7International processing and security
Using Vultr, Google's services, and the app stores may involve processing data in other countries, depending on each provider's infrastructure. Syncing between devices does not change the processing carried out separately by the hosting, diagnostics, usage statistics, and payment services.
When data under Onrizon's control is transferred internationally, the mechanisms and safeguards required by applicable law must be observed, including relevant contractual protections. Onrizon adopts technical and administrative measures proportionate to the risks, limits access to personnel and providers who need it, and responds to incidents as required by law. No system eliminates every risk; this does not remove our data protection responsibilities.
8Updates and contact
This Policy may be updated to reflect changes in the app, providers, or applicable law. The current version will show the date it was last updated. Material changes will be communicated appropriately, and new consent will be requested when required.
Privacy and support contact: team@gartic.com.