Privacy Policy | Panic Squad

1. Scope and controller

This Policy applies to Panic Squad, its online services, related pages on plixplox.com and user enquiries. The Android application identifier is com.plixplox.mergeraid.

The database owner and data controller is "PLIXPLOX" MAS'ULIYATI CHEKLANGAN JAMIYAT, a limited liability company registered in Uzbekistan (the Company). Registration No. 3345672 dated 9 September 2026; tax ID (STIR) 313319124. Address: Tashkent city, Yunusabad district, Uvaysiy MFY, 19th massif, building 45, Uzbekistan. Contact: [email protected].

The game, its online services, related pages and enquiries are referred to as the Service. This Policy does not govern independent processing by third-party services.

2. Personal data

Depending on the features used, the Company processes:

Account and access data: game and technical identifiers, authentication, account linking and recovery information, age group, document acceptance and privacy choices.
Game data: progress, inventory, virtual balances, rewards, actions, results and transaction history.
Technical and security data: IP address, approximate connection country, platform and app version, connections, errors, transaction checks and access restrictions.
Where detailed analytics is permitted: interface actions, interactions with offers, battle results, launches, sessions, app versions and event times. Observations are linked using pseudonymous identifiers and are not anonymous.
Enquiry data: reply address, correspondence and attachments, information required to verify authority and the outcome of the enquiry.
Where purchase or refund information is received: store, product, order and transaction identifiers, payment verification, amount, currency, status and time. The Company does not receive full payment card details.
Website data: language and theme preferences stored in the browser and network information required to deliver pages.

With permission for crash reporting, Google Firebase Crashlytics also processes error and crash details, stack traces, device model, operating system and game versions and installation identifiers. The Company does not attach game accounts, Google player IDs, advertising identifiers, correspondence or payment data to reports.

Data is provided by the user, their device and providers of features they use, or generated by the Company in providing and protecting the Service. A guest account does not require a name or email address.

When Google Play Games is connected, the Company receives a game-specific player identifier and proof of access. Google independently processes profile data and its SDK's service analytics and diagnostics. The Company does not request the user's Google password, email address, name, avatar or friends list from Google. Progress is stored in the Service, not Google Saved Games.

An age group is requested at first launch; an exact date of birth is not required. Country is estimated from the IP address and does not establish residence. Precise location, contacts, microphone and photo library access are not requested. Age group, Google data, correspondence, recovery codes and payment tokens are not sent to PostHog. The device's IP address is not forwarded to PostHog for geolocation.

In versions with advertising available, Google AdMob processes IP address and approximate location, app and ad interactions, diagnostics, and device or app identifiers. Data depends on the version, settings, device permissions and serving mode. The Android advertising ID may be used only in versions where its collection is permitted. The app does not request precise location.

Google User Messaging Platform (UMP) obtains and manages advertising privacy choices. UMP contacts Google to determine the applicable message and process the user's choice. The advertising SDK does not request ads before processing eligibility is checked. PostHog analytics and Crashlytics reporting are controlled separately.

To verify a reward, the Company creates a separate request identifier and a random verification code. Google receives these for server-side confirmation. They are not a password, authentication token, email address or Google Play Games identifier. The Company processes the verification result, advertising transaction identifier, time, ad unit, promised reward and grant record.

3. Purposes and legal bases

Providing the Service, creating accounts, saving progress, performing game actions, account linking and recovery: performance of the agreement or steps requested before entering into it.
Protecting the Service, preventing fraud, checking transactions, resolving faults and defending claims: the legitimate interests of the Company and users, to the extent permitted by applicable law.
Handling enquiries, complying with mandatory requirements and maintaining legally required records: performance of the agreement, legal obligations or the relevant legitimate interest.
Optional analytics and crash reports to assess gameplay, interfaces and stability, diagnose errors and improve Panic Squad: the user's voluntary consent, separate from acceptance of the agreement.

In versions supporting minimal internal service statistics, the Company counts new server-confirmed battle starts, battle settlements and hero or unit upgrades to assess whether these core game functions are used and working. A daily count records the internal game account identifier, UTC day, operation type and whether the operation succeeded. The Company also records days of server-observed game activity, new game-account cohorts, returns on the first and seventh calendar days after the cohort day (D1/D7), and six tutorial milestones: first tutorial battle, hero recruitment, town readiness, hero injury, healing and campaign unlock. These records contain the internal game account identifier, UTC dates and milestone flags, not exact times of tutorial steps. A new cohort includes only accounts created after collection starts and observed on their registration day; an existing account does not become a new cohort on return. Activity without a server request is not observed, so the report does not represent all installations or all game openings.

This minimal statistics stream does not contain screen history, advertising or installation identifiers, IP addresses, exact location, correspondence or payment details, and is not sent to PostHog, Firebase or advertising partners. It is not used for individual marketing or campaign attribution. Existing infrastructure providers process it only to operate the Company's infrastructure.

This separate, limited purpose relies on the Company's legitimate interest in evaluating and improving its core game functions, only where a documented necessity and balancing assessment and applicable law permit it. It is not treated as necessary for the game contract. Processing starts only after the relevant notice is presented and eligibility is checked; older operational records are not retrospectively converted into this statistics stream. Unknown or restricted age or country is excluded. Inclusion of teenagers aged 13 and over requires a separate assessment of their interests and appropriate safeguards; children below 13 are excluded.

Minimal internal statistics is separate from the optional “Help improve the game” choice. Declining that choice does not enable detailed analytics, crash reporting or advertising tracking on another basis. To object to minimal internal statistics, email [email protected]. Once account control is proportionately verified, the Company excludes the account from subsequent counts and removes its associated statistics without degrading ordinary gameplay. An objection does not change the separate optional analytics or advertising choices.

Optional analytics is not a condition of playing, connecting Google or recovering access. Accepting the agreement and stating an age do not replace separate permission. Permission does not extend to advertising tracking, advertising attribution or cross-service profiling. Withdrawal does not affect the lawfulness of earlier processing or processing on an independent legal basis.

Reference to optional processing in an agreement or policy does not make that processing necessary to provide the Service.

Analytics and crash reports are offered under one choice, “Help improve the game”. This choice is optional and can be withdrawn in the Privacy section of Settings. Withdrawal stops subsequent reporting; reports already sent are processed only within the applicable legal basis and retention period.

Advertising data supports ad delivery and measurement, delivery of the reward chosen by the user, invalid-traffic detection and abuse prevention. Ad personalization and other operations requiring consent occur only after consent is obtained. Legitimate interests apply only to legally eligible purposes, subject to the right to object, and do not replace mandatory consent. The advertising form does not give permission for product analytics or campaign attribution.

4. Recipients

Authorised staff and contractors have access within their duties. Providers process data needed to deliver their services under contractual arrangements:

DigitalOcean: game server and database hosting in Germany; processing terms.
Cloudflare: traffic protection and delivery, connection country estimation, backups and request fulfilment records. Western Europe is selected for R2; this regional setting is not an exclusive storage jurisdiction commitment. Processing terms.
PostHog Inc.: optional product analytics on the Company's behalf, using PostHog Cloud EU with primary hosting in Frankfurt; processing terms.
Google Firebase Crashlytics: optional crash diagnostics on the Company's behalf; processing terms and data and retention information. Exclusive EU storage of reports is not guaranteed.
Google: Play Games and its SDK. Google is an independent controller for its own services under its Privacy Policy and processing terms.
Email and technical service providers: handling enquiries and operating the Service.

The Company may disclose necessary data to comply with a lawful authority request, protect rights or transfer the relevant business to a successor, subject to law. Data may be disclosed to advertising partners for the purposes described in this Policy where the necessary legal basis exists. Analytics data is not provided for PostHog advertising profiles.

Advertising uses Google AdMob and Google UMP. Google and advertising partners may independently determine processing purposes under applicable terms and legal bases. Current partners, purposes and links to their policies are shown in the advertising privacy form. Google's processing is explained in its Privacy Policy and partner-app information. Processing may take place outside the EEA; exclusive storage of advertising data in Germany or the EU is not promised. Section 5 on international processing continues to apply.

5. International processing

The Company operates in Uzbekistan. Primary server storage is in Germany. Access by authorised persons and services of providers and subprocessors may involve processing in other countries. EU hosting does not mean all access is restricted to the EU.

International transfers are subject to applicable requirements, including an adequacy decision, standard contractual clauses or another legally recognised basis where required. Information on recipients, countries and applicable safeguards is available on request to the extent required by law.

6. Retention

Minimal internal statistics is kept for at most 30 days from the start of the relevant UTC day or, for a cohort and its milestone flags, its cohort day. Updating a record does not extend this period. Tutorial milestones are recorded only during the cohort's first eight UTC calendar days. Account deletion and a verified objection remove the associated statistics earlier. The restriction needed to honour an objection is retained while the account exists; the independent restriction journal follows the 60-day request-record period and the backup safeguards below. Staff reports suppress groups below ten accounts and do not expose individual histories. Such safeguards do not make the underlying account-linked records anonymous.

Firebase Crashlytics retains crash traces, extracted crash data and associated installation identifiers for 90 days before beginning removal from live and backup systems. Withdrawal stops future reporting; it does not instantly remove reports already received by Google. Requests concerning those reports may be submitted through support.

Account data, progress and associated settings are retained while the Service is provided. Afterwards, only information necessary for legal obligations, outstanding transactions and claims is retained.

Raw optional analytics on the Company's server is retained for 30 days. Scheduled full deletion of the PostHog analytics profile is initiated after 335 days of the relevant authorised processing period. This period applies to the whole profile, including newer events, rather than to each event separately. Withdrawal and account deletion are grounds for earlier deletion.

Minimal records of completed deletion requests and withdrawn permissions are retained for 60 days. Unfinished requests and records of choices are retained to the extent and for the period necessary to fulfil requests and comply with law. Backups rotate on a 30-day schedule, have restricted access and are not used to reinstate deleted accounts or withdrawn processing.

Minimal confirmed purchase and refund records are retained for five full years after the relevant reporting year; unfinished verification records for up to 90 days after creation or the latest check. Following account deletion, these records are separated from the account; original provider data and account secrets are not retained in them. Longer retention requires an independent legal basis.

Correspondence is retained until the enquiry is resolved and thereafter for applicable obligation or claim periods. Only necessary information relevant to a specific dispute or investigation is retained. Data is deleted or irreversibly anonymised once its purpose, retention period or legal basis ends. Deletion from provider systems and backups may require additional time; this does not authorise continued processing after withdrawal.

Server permission to request an advertising reward lasts at most 15 minutes and may end earlier. This is not a promise to delete all records after 15 minutes. The latest eligibility record, requests, confirmations and minimal reward-grant journal are retained while the account is serviced to prevent duplicate grants and resolve enquiries; account deletion covers these records. The full advertising consent string, Google's signature and the complete server-callback URL are not stored in the reward journal. Exceptions for independent legal obligations are described in this section.

UMP choices may be stored on the device. Retention by Google and other independent partners follows their policies. Deleting a game account does not automatically erase data held by independent controllers. Their policies explain how to contact them.

7. Rights and requests

Where provided by applicable law, users may obtain processing information and access, request correction, erasure, restriction or portability, object to legitimate-interest processing and withdraw consent. Requests must be sent to [email protected]. The Company's director is responsible for handling them.

Permission for detailed analytics may be withdrawn in Settings, under Privacy, or through support without deleting the account. Withdrawal stops further optional collection and is grounds for erasure of the relevant data. Without a connection, fulfilment on the server and other devices requires subsequent connection or expiry of the existing permission.

The Company may request proportionate information to verify the applicant's authority. A player identifier alone does not establish authority over an account. A representative must establish their authority.

Requests are handled without undue delay, normally within 30 calendar days, subject to any shorter mandatory period. A lawful extension and its reason are communicated within the original period. Restrictions, refusal or charges apply only as permitted by law, with reasons communicated to the applicant. Users may complain to a competent data protection authority or court.

In supported versions, advertising choices can be changed and consent withdrawn under Settings > Privacy > Advertising privacy. Choices are checked before a new ad request; refusal does not block ordinary gameplay. Depending on allowed purposes, non-personalized or limited ads may be available, or ads may be unavailable. Availability is not guaranteed.

8. Account deletion

A request may be submitted through Delete account in the Account section of Settings or by email. Access to the app or creation of a new account is not required. The procedure and consequences are set out on the Account and Data Deletion page.

Once authority is verified, account data is deleted or irreversibly anonymised and access is revoked, except where an independent legal basis requires retention. Uninstalling the app or disconnecting Google Play Games does not delete the Panic Squad account. Deleting the game account does not delete a Google account or data independently retained by Google. A prior request to Google is not required. Google's own data controls are available through the Google Account and Play Games profile.

9. Children and teenagers

Optional Firebase Crashlytics reporting is also unavailable for declared age groups below 18.

The Service is intended for teenagers aged 13 and over and adults. A higher minimum age and legal representative involvement apply where required by law. Optional detailed analytics is unavailable for declared age groups below 18. Stating an age of 18 or over does not enable analytics: separate permission and applicable eligibility conditions are required.

A younger age declaration is taken into account across the account. Support reviews incorrect information after verification; correction does not automatically resume analytics. The Company may restrict processing and access to comply with age requirements. Support and data deletion requests remain available regardless of such restrictions.

Processing requiring a legal representative's consent is permitted only after that consent has been properly obtained. If a necessary legal basis is missing, the Company stops or restricts processing and takes measures required by law.

The initial rewarded-ad pilot is available only to users whose declared age group, as reconciled by the server, is 18 or older and who meet admission requirements. This restriction on advertising does not change the game's intended age audience. An age declaration alone does not give consent to advertising processing.

10. Advertising and payments

Real-money purchases of virtual goods are available through Google Play Billing. Google and its payment partners process payment details; the Company does not receive full bank card details. To verify purchases, deliver goods and process refunds, the Company receives and retains purchase information, including product, order and transaction identifiers, status, time and purchase tokens. Data categories, purposes and retention periods are described in Sections 2, 3 and 6 of this Policy.

Rewarded viewing is voluntary. The reward and applicable limits are shown before viewing. Receiving a reward does not require consent to personalization, but does require an eligible ad interaction and verification of its conditions. Server verification can take time; retrying a check does not duplicate a reward.

11. Security

The Company applies legal, organisational and technical safeguards proportionate to the data and risks, including access restrictions and protection of connections and credentials. Absolute security of information systems is not guaranteed.

Automated checks execute game operations and protect the Service. Decisions producing legal or similarly significant effects outside the game are not made under this version. Incorrect account restrictions may be challenged through support.

12. Changes

The Company may amend this Policy as the Service or legal requirements change. The current version is published here. Material changes are communicated appropriately where required by law, before processing that requires additional user action begins. A text change does not replace mandatory consent.

Related documents: Terms of Use and Licence, Panic Squad Support.

Previous Privacy Policy.