WHAMMO — PRIVACY POLICY

Last updated: October 2026

Whammo ("the Game") is a free-to-play action game for Android and iOS. This policy explains what personal data the Game and its online services collect, why, the legal basis for doing so, who else receives it, how long we keep it, and the rights you have.

1. WHO WE ARE (DATA CONTROLLER)

The Game is operated by DigiLabs, a sole trader (eenmanszaak) established in Belgium. Our full registration and contact details are set out in section 12 at the end of this policy.

For the purposes of the EU General Data Protection Regulation (GDPR), DigiLabs is the data controller for personal data processed through the Game and its online services. We have not appointed a Data Protection Officer, as we are not required to do so.

2. INFORMATION WE COLLECT

Your game account

• A randomly generated player ID, and a random identifier the Game creates on your device so you can play without signing up (a "guest" account)
• Your display name — one is generated for you (for example "Player1234") until you choose your own
• Your game progress: realms cleared, heroes, pets, gear, skills, in-game currencies and items, quests, battle pass progress, chests, summon history and settings that are saved online
• Scores used for leaderboards, such as trophies, the highest realm you have cleared and your account level
• If you choose to link one: your email address and password, or the account identifier of the Google or Apple account you sign in with. We never receive your Google or Apple password

Online features

• Guilds: the guilds you found, join or apply to; your role; the guild name, motto and badge a guild leader sets; your donations, weekly goal points and guild boss damage; and the quick messages you send. Quick messages are chosen from a fixed list in the Game — there is no free-text chat
• Friends: the players you add as friends, and the players who add you
• Inbox: messages and rewards we send you in the Game, and whether you have read or collected them

Gameplay events

The Game reports events such as a run finishing (realm, waves, result, time), an item being bought, a chest being opened or a summon being made. Each event carries your player ID and a timestamp. They contain no device identifier, advertising ID or IP address.

Purchases

In-app purchases are processed entirely by Google Play or the Apple App Store. We never see or store your payment details. We receive a confirmation of what was bought (the product and a transaction reference), check it with Google or Apple, and deliver it to your account. Each purchase is tagged with a random identifier for your game account so that it can only be delivered to the account that bought it.

Your country

The Game uses your device's region setting and the approximate country our game platform derives from your connection when you sign in. We use this only to apply regional rules — for example, summons cannot be bought with gems in Belgium. We do not collect your precise location.

Advertising

The Game shows optional rewarded ads through Google AdMob. When an ad is requested, Google receives your device's advertising identifier, your IP address and information about your device and the ad interaction. In the European Economic Area, the United Kingdom and Switzerland we ask for your consent before Google may use this data to personalise ads; you can change your choice at any time under Settings → Privacy choices. Without consent, Google may still serve non-personalised ads and use limited data to prevent fraud and limit how often ads are shown.

On iPhone, the Game asks once, through Apple's App Tracking Transparency prompt, whether it may share your device's advertising identifier for personalised ads. If you choose "Ask App Not to Track", the identifier is not shared and you see non-personalised ads; the Game plays the same either way. You can change this at any time in your iPhone's Settings under Privacy & Security, Tracking.

Technical data

Our servers see the IP address of each connection. We use it only briefly, to protect the service against abuse (for example rate limiting); it is not stored with your game data.

3. HOW WE USE YOUR DATA AND ON WHAT LEGAL BASIS

• Creating your account, saving and restoring your progress, and running online features such as guilds, friends, leaderboards and the inbox — performance of our contract with you (GDPR Article 6(1)(b))
• Delivering purchases and keeping them on your account — performance of our contract with you (Article 6(1)(b))
• Applying regional rules to summons — legal obligation where the law of your country requires it (Article 6(1)(c)), and otherwise our legitimate interest in complying with consumer-protection rules (Article 6(1)(f))
• Preventing cheating, fraud and abuse, checking that scores are plausible before they reach a leaderboard, and securing our servers — our legitimate interests in operating a fair and secure game (Article 6(1)(f))
• Finding bugs and balancing the Game using gameplay events and aggregate statistics — our legitimate interest in improving the Game (Article 6(1)(f))
• Personalised advertising — your consent (Article 6(1)(a)). You can withdraw consent at any time under Settings → Privacy choices, without affecting processing carried out before withdrawal
• Helping you when you contact us — our legitimate interest in providing support (Article 6(1)(f))
• Retaining records where required by Belgian accounting or tax law — legal obligation (Article 6(1)(c))

We do not sell your personal data. We do not send marketing emails.

4. WHAT OTHER PLAYERS CAN SEE

Other players can see your display name and your scores on leaderboards and friend lists, and — if you are in a guild — your role, contributions, guild boss damage and the quick messages you send there. Guild names and mottos are visible to everyone who browses guilds. Choose a display name that does not reveal who you are if you would rather stay anonymous.

5. THIRD-PARTY SERVICES (SUBPROCESSORS AND PARTNERS)

• Microsoft PlayFab — game accounts, sign-in, saved progress, leaderboards and friends. Microsoft processes this data on our behalf
• A virtual server we rent from Hetzner Online GmbH — hosting for our own servers, which hold your saved progress and run guilds, the inbox and gameplay events. We operate the backend software (Convex) ourselves on that server; your data is not sent to Convex's own hosted cloud service
• Google AdMob — rewarded ads and the consent message. For ads, Google acts as an independent controller under its own privacy policy: policies.google.com/privacy and how Google uses information from sites or apps that use its services
• Google Play and Apple App Store — app distribution and payments, under their own terms and privacy policies
• Unity Technologies — the game engine and the in-app purchase module, which exchanges purchase information with the stores

Our support staff can look up your game account to help you or to act on a report. Every change they make to an account is recorded in an audit log.

6. INTERNATIONAL TRANSFERS

Our own servers — saved progress, guilds, the inbox and gameplay events — run on a virtual server we rent from Hetzner Online GmbH in a data centre inside the European Union, so that data stays in the EU. Hetzner processes it on our instructions under a data processing agreement concluded under Article 28 GDPR.

Microsoft, Google, Apple and Unity are established in, or may process data in, the United States and other countries outside the European Economic Area. Where personal data is transferred to them, that transfer is made on the basis of the EU-US Data Privacy Framework where the provider is certified, or otherwise under the European Commission's Standard Contractual Clauses.

7. DATA RETENTION

• Your game account, progress, friends and leaderboard entries are kept for as long as your account exists, and deleted when you ask us to delete it
• Individual gameplay events are deleted after 90 days. We keep daily totals (for example "how many runs finished on realm 3"), which do not identify anyone
• Each guild's activity feed keeps only its most recent 120 entries; guild applications expire after 3 days; reward messages in your inbox expire after 30 days
• Records we must keep under Belgian accounting or tax law are retained for the period that law requires

8. DELETING YOUR ACCOUNT

You can delete your game account and the data linked to it at any time, yourself in the Game (Settings, then Delete account, which takes effect immediately) or by asking us by email (we complete those requests within 30 days). What is removed and what is kept is explained on our account deletion page.

9. YOUR RIGHTS

Under the GDPR you have the right to access the personal data we hold about you, to have inaccurate data corrected, to have your data erased, to restrict or object to processing (including processing based on our legitimate interests), and to receive your data in a portable format. Where processing is based on consent, you may withdraw that consent at any time.

To exercise any of these rights, contact us at the address in section 12. Please include your display name so we can find your account. We will respond within one month.

You also have the right to lodge a complaint with a supervisory authority. The Belgian supervisory authority is:

Gegevensbeschermingsautoriteit / Autorité de protection des données
Drukpersstraat 35, 1000 Brussels, Belgium
contact@apd-gba.be — www.gegevensbeschermingsautoriteit.be

You may also complain to the supervisory authority in the EU country where you live or work.

10. CHILDREN

Whammo is not directed at children under 13, and we do not knowingly collect personal data from children under 13. If you are under the age at which your country lets you consent to online services yourself (between 13 and 16 in the EU), ask a parent or guardian before playing, making purchases or agreeing to personalised ads. If you believe a child under 13 has created an account, contact us and we will delete it.

11. SECURITY

Traffic between the Game and our servers is encrypted. The Game proves who you are to our servers with a session token issued at sign-in, which our servers check with PlayFab before acting. Access to the operator tools we use for support is a separate credential from any game account. No service can promise perfect security; if a breach ever affects your rights, we will notify the supervisory authority within 72 hours and tell you directly where the law requires it.

12. CONTACT AND CHANGES

• Trading name: DigiLabs
• Enterprise number (KBO/BCE): BE 1003.912.980
• VAT number: BE 1003.912.980
• Address: De Laar 67, 3581 Beverlo, Belgium
• Email: dlabseu@gmail.com
• Phone: +32 456 65 40 44

For privacy enquiries, use the email address above.

We may update this policy. The "Last updated" date reflects the latest revision, and material changes will be announced in the Game.

See also our Terms of Service and Support page.