Spike Rush privacy policy

Who we are

Spike Rush is an arcade volleyball game by Box Game Studio, a Brazilian indie studio run by Luiz Felipe Teixeira. We are the controller of the data processed in the game. Reach us at [email protected].

This policy covers the Android app (com.boxgamestudio.spikerush), the web version at play.boxgamestudio.com and the game servers (jogo.boxgamestudio.com and api.boxgamestudio.com).

What we collect

• Guest account: created automatically on your first online match. It has a random identifier, a secret key generated on your device (the server only keeps a cryptographic hash of it), the player name you choose and the creation and last sign-in dates. We never ask for your email, phone number, real name or ID.
• Matches and progress: the result of each online match (score, team, character, win, match MVP), your totals (matches, wins, points, blocks, perfect touches), your ranked rating, which stays hidden, and abandon cooldowns. We also keep the parties you join (code, members and match searches).
• Technical data: your IP address and connection data, needed to connect your device to the match, limit abuse and keep the game secure. Server logs (which may include the player name and IP) are kept for a short time and rotated automatically.
• On your device: your name, last server, preferred character, room rules, settings and tutorial progress stay on the device and are not sent to us.
• Ads: see the "Ads" section below.

The web version only has offline modes: it creates no account and shows no ads. The page server logs visits (IP and browser) for security.

Ads

The Android app shows Google AdMob ads to keep the game free. To select, serve and measure ads and prevent fraud, AdMob may collect your Android advertising ID, IP address, device and app information and your interactions with ads. Google processes this data as an independent controller under its own terms.

Where the law requires it, such as in the European Economic Area and the United Kingdom, the app asks for your consent before showing personalized ads. You can change this choice at any time in the game settings. Without consent, ads still appear but are not personalized.

On Android, you can reset or delete your advertising ID under Settings > Google > Ads (the path may vary by device).

Learn more in How Google uses information from sites or apps that use its services and in the AdMob privacy information.

How we use it

• To run online matches, rooms and parties (providing the service you ask for when you play).
• To keep your stats and history, and to build balanced ranked matches.
• To prevent cheating, abuse and attacks, and keep the servers running (legitimate interest).
• To show ads, personalized only with your consent where the law requires it.
• To answer you when you contact us.

We do not sell your data and do not use it for anything else.

Who we share it with

• Other players: your player name is shown to people in the same match, room or party.
• Google: Google Play (app distribution) and Google AdMob (ads), as described above.
• Cloudflare: the network that protects and delivers the website, the web version and the game API. It sees connection data (such as your IP) to do so.
• Authorities, only when required by law.

The game servers and database run on our own infrastructure in Brazil.

How long we keep it

• Account, stats and parties: as long as the account exists. After a deletion request, we erase everything within 30 days.
• Match results: when you delete your account, your entry in other players' matches is anonymized.
• Server logs: for a short time, rotated automatically, only for diagnostics and security.

Your rights

Under Brazil’s General Data Protection Law (LGPD, Law 13,709/2018), you can ask us to confirm whether we process your data, access, correct, port or delete it, learn who we share it with and withdraw consent for personalized ads. You can change your player name in the game. For everything else, write to [email protected]: we reply within 15 days.

If you think we did not solve it, you can also complain to Brazil's National Data Protection Authority (ANPD).

Deleting your account

See how to ask on the Delete your Spike Rush account page.

Children

Spike Rush is not directed at children under 13 and does not knowingly collect their data. If you are the parent or guardian of a child who created an account, write to [email protected] and we will delete it.

Security

The game API only uses HTTPS. Your account key is stored on the server only as a cryptographic hash. The server decides match results, and database access is restricted.

Changes to this policy

When this policy changes, the new version is published on this page with an updated date. Important changes are also announced in the game.