Privacy Policy

1. Controller and contact

TopGoblin is responsible for the personal data described in this policy. For privacy questions, access requests, or deletion requests, contact us at donidhernandez@gmail.com.

2. Data we process

• Guest and gameplay data: a temporary account identifier, public username, game attempts, card choices, game statistics, score, achievements, leaderboard position, and credit balance.
• Email account data: email address, public username, account timestamps, and a cryptographic password hash. We do not store your plaintext password.
• Google sign-in data: if you choose Continue with Google, Google provides the basic profile information needed to create or access your account, such as name, email, profile image, and provider identifier. We do not receive your Google password and do not request Gmail, Drive, Calendar, or other Google-service data.
• Purchase data: selected product, granted credits, Stripe Checkout Session and payment reference, amount, currency, refund or dispute status, and purchase timestamps. Stripe processes payment-card and billing details; TopGoblin does not store full card numbers.
• Technical and security data: IP address, user agent, request time, referring page, cookies, and error or security signals processed by our hosting and authentication systems.
• Consent choices: cookie and measurement choices stored in your browser.

3. Why we use data

4. Google sign-in

Google sign-in is optional. It is used only to authenticate you; it does not give TopGoblin permission to publish to your Google account or read unrelated Google data. Google independently processes its sign-in service under its own terms and privacy policy. You can revoke TopGoblin's access in your Google Account settings. Revocation does not automatically delete TopGoblin records that we must retain.

5. Public leaderboard data

Your public username, verified score, ending, badges, and leaderboard position are public by design. Do not choose a username or submit gameplay information that you do not want displayed publicly. We do not publish your email address or payment references on the leaderboard.

6. Providers and transfers

We use Google for optional sign-in, Stripe for payments, Neon for the application database, and Vercel for hosting and, where enabled, analytics. These providers process data under their own terms and privacy notices. Where data is transferred outside the EEA, the relevant provider may use an applicable transfer mechanism, such as an adequacy decision or standard contractual clauses.

7. Retention and deletion

We retain account and gameplay data while your account remains active or while reasonably needed to run the service, resolve disputes, prevent fraud, or comply with law. Public leaderboard records may be retained in de-identified or historical form where necessary to preserve ranking integrity. Payment and accounting records are kept for applicable statutory periods. To request account deletion, email donidhernandez@gmail.com. Deletion is subject to records we must retain by law and reasonable identity verification.

8. Your rights

Depending on applicable law, you may request access, correction, erasure, restriction, portability, or object to processing. You may withdraw consent at any time without affecting earlier lawful processing. We may ask you to verify your identity before acting on a request. Where the GDPR applies, valid requests are normally answered within one month. You may also complain to the Spanish Data Protection Agency (AEPD) or your local supervisory authority.

9. Cookies and changes

TopGoblin uses essential cookies to maintain sessions and may use optional measurement technologies based on your choices. Read the Cookie Policy for details and settings. We may update this policy when the service or legal requirements change; the current version and date are published on this page.