Draft for a lawyer’s review before launch. Every value in [brackets] is the owner’s to settle.
Privacy policy
1. What we collect
Account: your email address and, if you sign in with Google, your Google account's name and id. If you open the game inside Telegram instead: your Telegram id and the name or handle Telegram gives us, and no email address.
Username: the name you pick before you sell on the market. Every player sees it beside what you sell, and nothing else of your account. You can change it at any time, and it is deleted with your account.
Photos: the pictures you upload of the person to be made into a fighter, and your answers about them (such as height and build).
The fighter: the pictures of the fighter's moves that we make from those photos.
Arenas: the picture of a place you upload, the name you give the arena and what you ask to change, and the arena's picture that we make from it.
Kept fights: the fights you choose to keep: what happened in them, the fighters in them as they looked, and the video file if you ask for one to be made.
Purchases: what you bought, when, the amount and country, and the receipt number. Not your card.
Technical: server logs with IP address and browser type, kept [30 days], to keep the service running and stop abuse.
2. Photos of a person
A fighter is a likeness of a real person. Before uploading you confirm that the person is you, or an adult who agreed. We record that confirmation with the date.
We do not use photos to identify anyone, and we do not build face templates. A check that runs in your own browser guesses whether to start from a man's or a woman's body; that check's result never leaves your device as anything but that one choice.
If a fighter was made of you without your agreement, tell us on the Report a fighter page. We answer within 3 working days, and a fighter made without agreement is removed.
3. Kept fights and their links
After a fight you can keep it, up to 5 at a time. No fight is kept unless you ask for it.
A kept fight has a link. Anyone who has the link can watch the fight, and its video if one was made, without an account. We list kept fights nowhere and a link cannot be guessed, but whoever you send it to can pass it on.
A fight you keep after fighting someone online has their fighter in it, as it looked in the fight. A fight they keep has yours.
Removing a kept fight deletes it and its video from our servers, and its link stops working. A video somebody already downloaded stays with them.
Deleting a fighter removes the fights you kept with it, and their videos. When a fighter's pictures are deleted from our servers, every kept fight that fighter is in is removed with them, whoever kept it.
If a fight someone else kept still shows your fighter and you want it gone, write to [PRIVACY EMAIL] and we remove it.
4. Who else handles the data
To make a fighter or an arena, your photos are sent to [IMAGE MODEL PROVIDER], who make the pictures on our behalf and under their own rules on likeness. Accounts are kept with [AUTH AND DATABASE PROVIDER]; files with [HOSTING PROVIDER]; payments with Ameriabank. The emails we send you go through [EMAIL PROVIDER]. If you play inside Telegram, Telegram takes the payment in Stars and carries the messages our bot sends you. The current list, with countries, is on Who we share data with.
5. How long we keep it
Uploaded photos: 7 days after the fighter is finished or the attempt fails.
Fighters: until you delete them or your account.
A picture of a place: 7 days after you sent it.
Arenas: until you remove them or delete your account. When you fight someone online in your arena, its picture is sent to their game for that fight.
Kept fights and their videos: until you remove them, delete a fighter that is in them or delete your account. A fight you kept with another player's fighter in it is also removed when that fighter's pictures are deleted.
Purchase records: [as long as tax law requires, typically 5 to 10 years].
Account: until you delete it; deleted accounts are erased within 30 days, backups included.
6. Your rights
You can see, download, correct and delete your data, and object to how it is used. Most of this is on your account page; for the rest write to [PRIVACY EMAIL] and we answer within 30 days. If you live in the EU or UK you may also complain to your data protection authority.
7. Age
Palooka is for people aged 18 and over. Photos of anyone under 18 are not allowed and are removed when found.
8. Cookies
The game uses only what it needs to keep you signed in, to keep its settings and the fighters you are working with, and to count a first visit once. This site keeps a random number in your browser, with a note of what it has already counted, so that a first visit is counted once; it is not an account and says nothing about your device. See Cookies.
9. Changes and contact
When this policy changes we put the new version here with its date, and tell you by email, or in Telegram, if the change is a real one. Questions: [PRIVACY EMAIL]. [COMPANY NAME], [REGISTERED ADDRESS].