WormGame
Privacy policy
In one paragraph. The game has no accounts, no advertising, no analytics, no third-party SDKs and no cookies. It never asks for your name, e-mail, phone number or location, and it does not read anything about you or your device. Play it, build levels, finish the campaign, and nothing about you is sent anywhere. Two things do involve a server: the game downloads level packs (an ordinary web request, which means the server sees an IP address), and — only if you choose to publish a level — it sends that level and the moves you played to finish it, under a random token that is not linked to you. Everything sent that way can be deleted from inside the game, at once and for good.
1. Who is responsible
The controller of the personal data described here, within the meaning of Article 4(7) GDPR, is:
- Roman Dzheriev, individual developer of WormGame, established in Portugal.
- Contact for anything in this policy, including all data protection requests: [email protected]
No data protection officer has been appointed: the processing here is neither large scale nor systematic monitoring, so Article 37 GDPR does not require one. Because the controller is established in the EU, no Article 27 representative is required either.
2. What stays on your device
Most of what the game remembers never leaves the device and is not processed by us at all. It lives in the application's own private storage, and uninstalling the game removes it:
- your progress — which levels are solved, your best move count on each, and the level you are currently on;
- the levels you build in the editor, including the winning line you recorded while test-playing them;
- your sound on/off preference and which levels or authors you chose to hide;
- cached copies of downloaded level packs, so that they work offline;
- your publishing token, if you have ever published a level (see 3.3).
None of this is transmitted anywhere, backed up to us, or readable by us. The game has
no other access to your device: it holds only the INTERNET and
ACCESS_NETWORK_STATE Android permissions, and no permission for contacts,
location, camera, microphone, photos, phone state or advertising identifiers.
3. What we process, and why
3.1 Downloading levels (happens for everyone)
When the game starts it requests the author's level pack from
worm.alikhanich.xyz, and it requests the community catalogue when you press
the download button. Visiting this website is the same kind of request. As with any request
to any web server, the server necessarily receives and logs technical connection data.
| Data | IP address, date and time, the file requested, HTTP status and size, browser or client user agent, referring page where a browser sends one. |
|---|---|
| Purpose | Delivering the requested file, keeping the service available, and detecting and defending against abuse (floods, scraping, attacks). |
| Legal basis | Article 6(1)(f) GDPR — our legitimate interest in operating and securing the service. There is no way to serve a file over the internet without receiving the requesting address. |
| Kept | In server access logs for at most 52 days, then deleted automatically by log rotation. |
Nothing in these logs is combined with anything else, used to build a profile, or used to recognise you across visits. No cookies, local storage or similar techniques are used on this website, so no consent banner is required under Article 5(3) of the ePrivacy Directive.
3.2 Publishing a level (only if you choose to)
Levels you build are private until you press publish. Before the first level ever leaves your device the game shows its sharing terms and waits for an answer; declining sends nothing and leaves the rest of the game working exactly as before.
| Data | The level's name as you typed it, its grid layout, and the sequence of moves you played to finish it. The server adds the time of submission, a review status, the move count its replay measured, and the identifier of the publishing token it arrived under. Nothing else — no device identifiers, no IP address stored with the level, no contact details. |
|---|---|
| Purpose | To check the level can actually be completed, to have a human review it, and — once approved — to publish it to other players. |
| Legal basis | Article 6(1)(b) GDPR — performing the sharing service you asked for, on the terms you accepted before publishing. |
| Published to others | An approved level appears in the public level packs with its name, layout, par and a short pseudonymous author code, so that players can hide levels by an author they do not want to see. Anything you type — the level's name — becomes publicly visible, so do not put personal information in it. |
The check the server runs is a replay: it re-runs your own recorded moves through the game's rules and sees whether they finish the level. It searches for nothing, and it makes no decision about you. Whether a level is published is decided by a human being.
3.3 Your publishing identity
The first time you publish, the server issues a random token, which the game stores on your device. The server keeps only a SHA-256 hash of it, together with a counter of how many levels were approved and whether the account was banned for abuse. This is what links your own submissions to each other so that quotas, review status and withdrawal work.
| What it is not | It is not an account: there is no name, no e-mail, no password, nothing to log in to and nothing to reset. It is not derived from your device, your phone number or any advertising identifier, and it cannot be matched to you by us or by anyone else. |
|---|---|
| Legal basis | Article 6(1)(f) GDPR — our legitimate interest in a moderation queue that cannot be flooded, and in being able to honour withdrawal and erasure requests for the right levels. |
| Note | Losing the device loses the identity. There is deliberately no recovery path, because a recovery path would require us to hold something identifying about you. |
3.4 Reports about a level
If you report a downloaded level, we receive the level reported, the reason chosen, an optional short note you may type, the time, and the pseudonymous code of the token that sent it (so that one person cannot report the same level a hundred times).
| Purpose | Reviewing content shared by players and removing what breaks the rules. |
|---|---|
| Legal basis | Article 6(1)(f) GDPR — our legitimate interest, and that of every other player, in a catalogue that is moderated; and Article 6(1)(c) where the Digital Services Act or the app store rules oblige us to act on reports. |
3.5 Moderation records
Each moderation action — approve, reject, remove, delete — is written to an internal audit log with the action, the internal identifier it concerned and the time. When someone erases everything they published, their audit entries record only that a deletion happened; they no longer point at a person or a level.
Legal basis: Article 6(1)(f) GDPR — being able to show what was decided and when, if a decision is ever disputed.
3.6 If you write to us
If you send an e-mail, we process what you send — your address, and whatever is in the message — to answer it. Legal basis: Article 6(1)(f) GDPR (handling enquiries addressed to us), or Article 6(1)(c) where the message is a data protection request we are obliged to answer. We keep correspondence only as long as the matter needs, and then delete it.
4. What we never do
- No advertising of any kind, and no advertising or attribution SDKs.
- No analytics, telemetry, crash reporting or usage statistics.
- No cookies, no local-storage tracking, no fingerprinting, no advertising identifier.
- No profiling and no automated decision-making producing legal or similarly significant effects within the meaning of Article 22 GDPR.
- No selling, renting or sharing of personal data with anyone for their own purposes.
- No accounts, no sign-up, no e-mail address, no password, no social login.
- No payment data. The game is free to download and sells one thing, the rest of the campaign, through the App Store or Google Play — see section 5. We never see a card number, a name or a billing address.
5. Who else sees it
We use two processors, each acting only on our instructions under a contract meeting Article 28 GDPR, and no one else receives your data:
- Our hosting provider, which operates the virtual server in Amsterdam, the Netherlands, on which the game's server and this website run.
- Cloudflare, Inc., which sits in front of the server as a content delivery network, terminates TLS and filters attacks. It processes the connection data described in 3.1.
If you installed the game from Google Play, Google acts as a distributor under its own privacy policy, which covers the download and any diagnostics Android itself collects. That is Google's processing, not ours, and we receive no personal data from it — only anonymous, aggregated install and rating statistics from the Play Console.
If you buy the full campaign, the purchase is made with Apple (App Store) or Google (Google Play), under Apple's privacy policy or Google's. Payment, receipts, refunds and restoring a purchase on another device are theirs to handle. The game asks the store on your device whether your account owns the campaign and remembers the answer on the device; nothing about the purchase is sent to our server, and we receive only the aggregated sales figures and payouts the store reports to every developer.
We would disclose data to a public authority only where law obliges us to. There has been no such request.
6. Where it is stored
The server, its database and this website are located in the Netherlands, inside the European Economic Area. Personal data described in 3.2 to 3.5 does not leave the EEA.
Connection data (3.1) passes through Cloudflare, a company established in the United States, which may process it outside the EEA. Those transfers are covered by the European Commission's standard contractual clauses and, where applicable, by Cloudflare's certification under the EU–US Data Privacy Framework.
7. How long we keep it
| Server access logs | Rotated daily and deleted after at most 52 days. |
|---|---|
| A level waiting for review | Deleted automatically if it is still unreviewed after 14 days. |
| A published or approved level | Until you withdraw it or erase everything you published. Withdrawal is immediate and permanent. |
| A rejected or removed level | Kept so that the game can show you why it was rejected and so that the same layout is not resubmitted; deleted when you erase everything you published. |
| Your publishing identity | Until you erase it from inside the game. |
| Reports you filed | Deleted with the level they concern, or when you erase everything you published. |
| Moderation audit entries | Kept as a record of decisions; after an erasure they contain no reference to a person or a level. |
| E-mail correspondence | As long as the matter requires, then deleted. |
8. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and receive a copy (Article 15);
- rectification of data that is inaccurate (Article 16);
- erasure — the right to be forgotten (Article 17);
- restriction of processing (Article 18);
- data portability in a machine-readable format (Article 20);
- object at any time to processing based on our legitimate interests, including the processing described in 3.1, 3.3, 3.4 and 3.5 (Article 21);
- lodge a complaint with a supervisory authority (Article 77).
Exercising any of these is free and needs no particular form: write to [email protected]. We answer within one month, as Article 12(3) requires.
One honest limitation. We hold nothing that identifies you — no name, no e-mail, no device identifier. That means we usually cannot tell which data is yours. If you ask us for access, correction or erasure by e-mail, you will need to give us something that points at it: your publishing token, or the names of the levels you published. If you cannot, we are unable to identify you within the meaning of Article 11(2) GDPR and cannot act on the request — which is why the game gives you the buttons in section 9, and they need no identification at all.
Our supervisory authority is the Portuguese Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134 — 1.º, 1200-651 Lisboa, Portugal, www.cnpd.pt. You may equally complain to the supervisory authority of the EU or EEA country where you live or work.
9. Exercising them in one step
Everything below is built into the game and takes effect immediately — no e-mail, no waiting, no identification:
- Withdraw one level. Delete it in My levels and it is deleted from the server too, published or not. "Delete" means the same thing in both places.
- Erase everything (Article 17 in one button). ERASE ALL in My levels deletes your publishing identity and every level ever sent under it, published or still in review. It cannot be undone. Your levels stay on your device.
- Send nothing at all. Decline the sharing terms, or simply never publish. The campaign, the editor and downloads all work regardless.
- Stop the downloads. The startup request for the level pack is the only thing the game does on its own. Denying the app network access, or playing offline, stops it; the levels already on the device keep working.
- Remove everything local. Uninstalling the game deletes all of section 2.
10. Children
The game is suitable for all ages. It collects no personal data from anyone, children included: there is no registration, no advertising, no tracking and no profiling, so the question of consent under Article 8 GDPR does not arise. Levels shared by other players are reviewed by a human before publication, and every downloaded level can be reported or its author hidden. The publishing terms shown before a first upload ask that nothing hateful, sexual or aimed at a person is submitted.
11. Security
All traffic between the game, this website and the server is encrypted with TLS. Publishing tokens are stored on the server only as SHA-256 hashes, never in the clear. The moderation interface is password-protected and the database is not reachable from the internet. These are appropriate measures under Article 32 GDPR for the very small amount of non-sensitive data involved; no method of transmission or storage is ever perfectly secure.
Given what is processed, a data breach here could not expose an identity, a contact detail or a credential. Should one nevertheless occur and present a risk, we will notify the CNPD and affected users as Articles 33 and 34 require.
12. Changes
If this policy changes, the new version is published on this page with a new version number and date, and the previous wording is superseded from that date. Changes that affect what leaves your device will also be shown in the game before they take effect.