Privacy Policy

Last updated: 2025-12-17

Privacy Policy Content

1. General information

This Privacy Policy describes the rules for processing user data of the mobile game XO FiFo for Android devices (hereinafter referred to as the “Game”).

The data controller is xoFiFo – an independent game developer (hereinafter referred to as the “Controller”). The Controller is a natural person conducting creative activity in the field of mobile game development. Contact details regarding personal data matters are provided in the Contact section.

FiFo is an online game — an Internet connection is required for real-time gameplay.
The Game is intended for users aged 13 years or older. The Controller does not knowingly collect data from users under the age of 13.

2. Categories of data processed

The Game processes data necessary for the operation of the online game, account maintenance and security:

  • Account identification data: a unique account identifier (Google ID) and (if provided) email address and profile name.
  • Gameplay data: statistics (matches played / won / lost / abandoned), energy status, game modes, selected symbols/skins, system message identifiers (MOTD).
  • Technical / network data: information required for real-time network communication (e.g. IP address and connection session identifiers).
  • Diagnostic data: basic information regarding errors and stability (e.g. crash information, application version, device/system type), if recorded server-side or by service providers.
We do not request passwords and do not have access to them. Authentication is performed via Google mechanisms.

3. Google Sign-In

The Game uses Google Sign-In for user authentication and to associate gameplay progress with a user account. As part of the sign-in process, the Controller may receive a Google ID and (optionally) an email address and profile name.

The provider of the sign-in service is Google. Details regarding Google’s data processing practices are available in their documentation: Google Privacy Policy.

4. Advertising, payments and advertising identifiers

The Game may display advertisements via Google services (Google AdMob). For this purpose, the Android Advertising ID is used.

Advertising ID:

  • is not used for direct user identification,
  • may be reset or limited by the user at any time in Android system settings,
  • is processed in accordance with Google’s rules.

As part of advertising services, Google may use device information and advertising event data in accordance with its own policies (e.g. for security, abuse prevention and ad effectiveness measurement).

Advertisements displayed to underage users are not personalized.

If the user purchases premium features or paid items:

  • payments are handled exclusively by Google Play (Google Play Billing),
  • the Controller does not receive or store payment card details or payment data,
  • the Controller may receive information about the purchase status (e.g. premium entitlement) and a purchase token for server-side verification.

More information: How Google advertising works.

5. Data recipients and external services

User data may be processed by the following third parties, exclusively to the extent necessary for the operation of the Game:

  • Game server (Controller): user account handling, real-time online gameplay, statistics, energy management, account settings and abuse prevention.
  • Google LLC:
    • Google Sign-In – user authentication (Google ID, optionally email and profile name),
    • Google Play Billing – payment processing and premium status verification (without access to payment data by the Controller),
    • Google AdMob – advertisement display and effectiveness measurement.

As part of Google AdMob services, the Android Advertising ID may be transferred to Google for advertisement display and measurement purposes.

The Controller does not receive payment details or detailed advertising profiling data from Google.

The Controller does not sell personal data and does not combine advertising data with other data beyond what is necessary for the operation of the Game.

6. Purposes and legal basis of processing

User data is used solely for:

  • enabling online gameplay and Game functionality,
  • saving and synchronizing progress and statistics,
  • handling premium features (verification and synchronization of purchase status),
  • ensuring security and stability of the Game (e.g. abuse prevention and error diagnostics).

The legal basis for processing is primarily the performance of the service (operation of the Game) and the legitimate interest of the Controller in ensuring the security and stability of the Game.

7. Data retention and account deletion

User data is stored exclusively for the period necessary to ensure the operation of the Game, in particular for:

  • maintaining the player’s account and in-game progress,
  • providing real-time online gameplay functionality,
  • handling premium features,
  • ensuring system security and stability.

Account and gameplay data (statistics, energy, settings) is stored until the user deletes their account or until the Game service is permanently discontinued.

Account and data deletion

The user may request deletion of their account and all associated personal data at any time by sending an email to: contact@xofifo.pl

The request must specify the Google account used in the Game. After confirmation of the request, the account and all associated data will be permanently deleted and cannot be restored.

The request will be processed no later than within 30 days from receipt of a complete request.

8. User rights

The user has the right to:

  • access their data,
  • rectify data,
  • request deletion of data,
  • restrict processing (within the limits of applicable law),
  • object to processing based on legitimate interest (within the limits of applicable law).

The user also has the right to lodge a complaint with the competent supervisory authority (in Poland: the President of the Personal Data Protection Office) if they believe that data processing violates applicable regulations.

Advertising settings (e.g. limiting personalization) can be managed in Google account settings and device settings.

9. Security

The Controller applies technical and organizational measures to protect data against unauthorized access, loss or modification.

Data transmitted between the application and the server is secured in transit (e.g. TLS/HTTPS), and access to data is limited to authorized systems and persons.

Legal content and rankings in the application are displayed in a WebView with security restrictions in place (including blocking mixed content and limiting loaded domains).

10. Policy changes

This Privacy Policy may be updated. The current version is published on the website and within the application.

11. Contact

For matters related to personal data, you may contact:
Email: contact@xofifo.pl