Privacy Policy

This policy explains what personal data Buggie (buggie.fun) processes, why, and the rights you have. We collect as little as we can: you can play the whole Game as a guest without giving us any personal data.

1. Who is responsible for your data

The controller of your personal data (the "owner of the personal data bank" under Peruvian law) is Daniel Soto, an independent developer based in Peru. Contact: dasg.1993@gmail.com.

2. What we collect

When you play as a guest

• ▸Your progress, settings and language are stored only in your browser (local storage). We don't receive them.
• ▸Your progression as a guest (Amber, achievements, missions, streak, cosmetics and pass progress) is also stored only in your browser, together with a random guest id created on your device. If you sign in later, that progression is merged into your account and from then on handled as described below.
• ▸Like any website, our hosting provider processes your IP address and browser details to deliver the pages and protect the service. To stop abuse of sign-in, we keep a keyed hash of your IP address (not the address itself) for up to 2 days; and, for 30 days, keyed hashes of your email address and of the networks you signed in from, so we can warn you about a sign-in from a new network and keep sign-in available to you when someone floods your address with code requests.

When you create an account

• ▸Your email address, used to sign you in with one-time codes and to send you messages about your account.
• ▸Your player name, and your game data: cloud save, achievements, leaderboard entries and play time.
• ▸Session records: a description of your device (for example "Chrome on macOS"), when you last used it, and your language.
• ▸Security records: sign-in codes, stored only as keyed hashes; and a log of the account emails we sent you (type, address, delivery id — never their content).
• ▸Your account progression: Amber, upgrades and unlocks, achievements, daily and weekly missions, streak, cosmetics earned and equipped, season pass progress, and your results in events, the daily challenge, the community boss and the daily and weekly rankings, which are shown next to your public player name.
• ▸Your time zone (as your browser reports it) and when you were last active, to reset your missions at your local midnight, respect quiet hours and not notify you while you are playing.
• ▸Your notification settings (which notifications you turned on, on which channel and at what time) and, if you turn on push on a device, its Web Push subscription (your browser's push service address, its encryption keys and a description of the browser). We also keep a log of the notifications we sent you (type, channel, date, result and whether you opened it).

Analytics — only if you accept

If you accept analytics in the cookie banner, Google Analytics 4 and PostHog record how the Game is used: pages visited, game events (such as floors reached or battles won), device and browser type, approximate location derived from your IP address by those providers, and pseudonymous identifiers. If you are signed in, events are linked to your internal player id (never your email). If you reject analytics, or your browser sends a Global Privacy Control signal, none of this is collected.

When you use the Complaints Book

• ▸The data the law requires on a complaint sheet: your name, ID document type and number, address, email, optional phone, the name of a parent or guardian if you are a minor, and what you tell us about the complaint and your request.

When you buy something

• ▸Orders and payments: the PayPal order and payment ids, the item bought, the amount, the currency, the method (PayPal or card), the status and the dates, as well as refunds and chargebacks.
• ▸Buggie Club subscription: the PayPal subscription id, its status, the start and end of the paid period, the cancellation date and the monthly skins you claimed.
• ▸Nectar ledger: every movement of your Nectar balance (purchase, spend, refund, gift or adjustment), with its amount, reason, reference and resulting balance.
• ▸Purchased content: the skins, chromas, passes and other content you own, where it came from and, if applicable, the date it was revoked.
• ▸Purchase conditions: the date you confirmed being 18 or older or having your parent or guardian's permission, and any monthly spending limit you set.
• ▸We never receive your card or bank details: PayPal handles them.

We don't collect card or bank details, precise location, contacts, or sensitive data. We do not sell your personal data, do not share it for cross-context behavioural advertising, and show no ads.

3. Why we use it (and legal bases)

Account emails, purchase receipts and Buggie Club renewal reminders (3 days before each charge) are transactional: they are sent even if you haven't turned notifications on. Push notifications and the Game's notification and engagement emails (weekly digest, event start, "we miss you") are only sent if you turn them on (they are all off by default). You can withdraw your consent at any time in Settings › Notifications or with the one-click unsubscribe link in every email, without signing in.

4. Who processes your data for us

We use trusted providers that process data on our behalf, under their data processing terms:

• ▸Vercel Inc. — hosting and delivery of the website (United States).
• ▸Prisma Data, Inc. — database hosting (United States).
• ▸Resend, Inc. — sending account emails and, if you turn them on, notification emails (United States).
• ▸Google LLC — Google Analytics (only with consent), and Google Fonts for Japanese and Chinese text (the font servers see your IP address; no cookies).
• ▸PostHog, Inc. — product analytics (only with consent) and our server error logs (United States).
• ▸PayPal — processing payments and the Buggie Club subscription, only if you buy something. PayPal processes the data needed for your order on our behalf and is an independent controller of the payment data it collects directly (card, PayPal account, fraud prevention); see its own privacy notice. We never see your card numbers.
• ▸Browser push services — if you turn on push notifications, they are delivered through your browser vendor's push service (Google Firebase Cloud Messaging for Chrome and Edge/Android, Mozilla for Firefox, Apple for Safari), acting as an intermediary or processor. They only receive your subscription address and the encrypted notification.

We may also disclose data if the law requires it, or to protect the rights and safety of our players.

5. International transfers

Our providers store and process data in the United States. By using the Game you understand that your data is transferred outside your country; we rely on our providers' contractual safeguards to protect it. For Peruvian users, this is our notice of cross-border data flow under Law 29733.

6. How long we keep it

• ▸Account data: until you delete your account.
• ▸Sessions: they expire after 90 days, or when you sign out.
• ▸Sign-in codes and rate-limit records: deleted after 2 days. Networks you signed in from (keyed hashes): 30 days after your last sign-in from them.
• ▸Email log: deleted with your account. The address is removed from entries older than 90 days, and entries not linked to an account (for example codes requested for an address that never signed up) are deleted after 30 days.
• ▸Complaint sheets: kept for at least 2 years, as Peruvian consumer law requires.
• ▸Purchase records and the Nectar ledger: kept for the period required by tax and accounting law (at least 5 years), even if you delete your account; they are then detached from your account (without your player name or email).
• ▸Purchased content, Buggie Club subscription, claimed Club skins, purchase confirmation and spending limit: until you delete your account. When you delete it, we cancel any active Buggie Club subscription at PayPal so you are not charged again.
• ▸Account progression, event and ranking results: until you delete your account (the public daily and weekly rankings close at the end of their period, but their results stay linked to your account until you delete it).
• ▸Notification settings, time zone and last activity: until you delete your account.
• ▸Push subscriptions: until you turn off push on that device, the subscription expires or is rejected by the push service, or you delete your account.
• ▸Notification log: 90 days.
• ▸Guest progression: in your browser (local storage), until you clear it or sign in and it is merged into your account.
• ▸Guest progress merge record: when guest progression is merged into an account, we keep a keyed hash (HMAC) of the normalized sign-in email address — never the address itself — and the date, not linked to any account. It is kept even after you delete your account, solely so that the same mailbox can't merge guest progression into a new account again.
• ▸Server logs and analytics: kept by the providers for their standard periods (analytics up to 14 months).

7. Your rights

Depending on where you live, you have the right to:

• ▸access your data and know how we use it;
• ▸correct it;
• ▸delete it (cancellation);
• ▸object to its use or limit it;
• ▸take it with you (portability);
• ▸withdraw consent at any time, without affecting earlier processing;
• ▸not be discriminated against for using your rights (California).

These include the ARCO rights under the laws of Peru, Mexico, Colombia, Argentina and Chile, your rights under Brazil's LGPD, and your rights under the California Consumer Privacy Act (as amended by the CPRA) and other US state privacy laws.

How to use them: your account page lets you download all your data, rename your player and delete your account. For anything else, write to dasg.1993@gmail.com. We may need to confirm that the request comes from the account's email address. We answer without undue delay and within the legal deadlines (for example, 20 business days in Peru and 45 days under the CCPA). You may also use an authorised agent where the law allows.

Your data download includes your account progression, event and ranking results, notification settings, push subscriptions, notification log, purchases, Nectar ledger and balance, purchased content, Buggie Club subscription, purchase confirmation and spending limit. Deleting your account erases all of them, except the purchase and Nectar ledger records the law requires us to keep, which are detached from your account.

If you are not satisfied with our answer, you can complain to your data protection authority — in Peru, the Autoridad Nacional de Protección de Datos Personales of the Ministry of Justice and Human Rights.

8. Children

The Game is not directed at children under 14, and accounts require being at least 14. We don't knowingly collect personal data from children under 14 (or under 13 in the United States, under COPPA). If you believe a child has created an account, write to us and we will delete it.

9. Security

Sign-in codes and session tokens are stored only as keyed hashes, all traffic uses HTTPS, session cookies can't be read by scripts, and we keep the data we hold to a minimum. No system is perfectly secure, but we work to protect your data and will notify you and the authorities of a breach when the law requires it.

10. Cookies

See our Cookie Policy. You can change your analytics choice at any time with "Cookie settings" at the bottom of every page.

11. Changes

If we change this policy we will update the date below and, for important changes, tell you in the Game or by email.

Last updated: September 27, 2026. This document is also available in other languages; if they differ, the Spanish version prevails.