Privacy Policy — Cosmic Bash

Last updated: September 5, 2026 · Versión en español

This policy describes how information is handled in connection with the mobile application Cosmic Bash (package com.itpro.cosmicbash, the "App"). Cosmic Bash is a local-multiplayer party game directed to children and families. For that reason, this policy is addressed especially to the parents and legal guardians of players who are minors.

1. Data controller / operator (who we are)

Christian López, independent developer ("we", "us").
Address: Guayaquil, Ecuador.
Phone: +593 99 129 2969 · Email: itpro.devs@gmail.com
We are the operator of the App and your point of contact for any privacy matter.

2. Plain-language summary

• The App does not require registration or an account, and never asks for your real name, email, phone number, contacts, or location.
• We do not collect personal information. The App has a single server of our own, and it does exactly one thing: receive the suggestions you choose to write to us. If you never write one, nothing leaves your device and comes to us.
• The App can show reminders on your phone (the daily chest, an available gift, an unfinished tournament) and news notices. You can turn them all off in Settings → Reminders.
• Game progress (chips, achievements, cosmetics and skins, the player names you type, and preferences) is stored only on your device.
• The App shows ads through Google AdMob. Because the App is directed to children, ads are always non-personalized (no interest-based advertising, no profiling) and limited to content rated G (suitable for general audiences).
• Achievements can be connected to Google Play Games, but it is optional: without connecting, the game works the same.
• There are optional purchases: "No ads" (one-time) and four chip packs, the in-game currency. Google Play charges them; the App never sees payment data. Nothing needs to be bought to play the whole game.

3. What information is handled, why, and on what legal basis

a) Game data (local, never transmitted). Chips, progress, achievements, purchased cosmetics, player names, and preferences are stored only on the device. They never leave it and are deleted when you uninstall the App or clear its data in Android settings.

b) Technical data collected by the advertising provider (Google AdMob). To load and measure ads, Google LLC automatically collects, through its SDK inside the App:

• IP address (from which an approximate location may be derived);
• Technical device identifiers and diagnostic/performance data;
• Ad interactions (for example, whether an ad was shown or tapped).

The App requests Google's child-directed treatment (the COPPA "child-directed" tag). With that configuration, Google does not use the Advertising ID for this traffic and serves only contextual, non-personalized ads.

Specific uses of these technical identifiers (the only ones permitted): serving contextual ads, frequency capping, measuring ad performance, fraud prevention, protecting the security and integrity of the service, and legal compliance. They are never used for behavioral or profile-based advertising, or to contact any individual. These uses fall within COPPA's "support for internal operations" exception (16 CFR § 312.5(c)(7)).

Legal basis (Art. 7 of Ecuador's LOPDP): performance of the service you request by using the App, and our legitimate interest in keeping the App free through non-personalized advertising and in keeping it secure. We perform no processing of children's data that would require additional consent (no profiling, no personalized advertising). If any future processing required consent, it would be requested from the parent or legal guardian.

c) Suggestions you send us (optional, and only if you write one). Settings has a button to send us a suggestion. If you use it, the following is sent to a server of our own: the text you wrote and a technical footer with the App version, language, OS version and phone model. Nothing else.

• We do not ask for personal data, and the text box explicitly asks you not to write your name or any personal details. If someone writes them anyway, we delete them when we review the message.
• Your IP address is not stored: what we keep is a derived value (salted SHA-256 hash) that cannot be reversed, used only to limit how many messages can be sent per hour and to prevent abuse.
• The message travels encrypted (HTTPS) and is not shared with anyone: no third parties are involved here.
• Legal basis (Art. 7 LOPDP): your explicit request — the message is only sent when you tap "Send".

d) Reminders and notifications. The App can show notifications: reminders that your own phone schedules (the daily chest, an available gift, an unfinished tournament) and news notices that we send.

• Reminders are calculated and scheduled on your device: no data leaves it for that.
• For news notices, Google (Firebase Cloud Messaging) assigns the device a registration token. It identifies the device, not the person: it is used only to deliver the notice and is never combined with any other data, nor with the advertising identifier, which remains disabled.
• On Android 13 and later your explicit permission is required, and the App asks for it only when you turn reminders on. You can switch them off in Settings → Reminders, and separately from Android's own settings (channels "Reminders" and "News").
• They are never used for advertising and contain no ads.

e) Google Play Games Services (optional). The whole game can be played without signing in. If the player chooses to connect their Google Play Games profile, Google processes their player identifier, sign-in state and achievement progress.

• It is used to authenticate the player, store their achievements on Google's side and let them see those achievements in the Play Games app.
• The App never receives the password of the Google account, nor the email address, nor the contacts.
• Connecting is voluntary: without it the game works exactly the same and achievements stay on the device only.
• The profile can be disconnected at any time from the Google Play Games settings.

f) In-app purchases (optional). The App offers two kinds of purchase, and neither is required to play the whole game:

• "No ads" — a one-time payment that removes the ads between games. Reward videos, which are voluntary, remain available.
• Chip packs (Handful, Bag, Chest and Stellar Vault) — they credit chips, the in-game currency. Chips are only useful inside the App, to unlock cosmetics and arenas; they have no value outside the game, cannot be exchanged for money and cannot be transferred to anyone else. They can be bought again.

Payment is processed by Google Play, not by us: the App never sees or stores card or payment data. All that is kept on your device is whether "No ads" is active, your chip balance, and a technical record of the latest credited purchases, used to avoid crediting the same payment twice. None of that leaves the device.

Google Play shows the price in your country's currency. Purchases can be protected with a password or fingerprint from the Google Play app (Settings → Authentication), and refunds are handled by Google Play.

4. Children's privacy

Cosmic Bash is directed to children and families and complies with the Google Play Families Policy, the U.S. COPPA law (15 U.S.C. §§ 6501–6506 and 16 CFR Part 312), and Ecuador's Organic Law on Personal Data Protection (LOPDP):

• We treat all users of the App as children: there is no age screen, and the child-directed ad configuration always applies.
• We do not collect names, emails, phone numbers, location, photos, audio, or any other personal data from players; the only data that leaves the device are the technical identifiers described in section 3.b, covered by COPPA's "support for internal operations" exception (16 CFR § 312.5(c)(7)), which does not require parental consent because they are used only for contextual ads, measurement, security, and frequency capping.
• Ads are non-personalized and limited to content rating G (suitable for general audiences).
• The App has no chat, social features, or links to external content unsuitable for minors.
• The App does offer optional purchases (see section 3.f). They are meant to be decided by an adult: Google Play handles the charge, and we recommend turning on purchase authentication in the Google Play app so nothing can be paid for without your password or fingerprint. No game content is locked away from players who do not buy: chips are also earned by playing.
• In Ecuador, processing personal data of children under 15 requires authorization from their legal guardian (Art. 19 of the LOPDP Regulations). If your child uses the App, we understand you have allowed them to use it under this policy.

Parents' and legal guardians' rights (COPPA § 312.6 and Arts. 21 and 24 LOPDP): you may contact us at any time to (i) review what information is handled about your child, (ii) request its deletion, and (iii) refuse to permit its further collection or use. Since we do not store personal data ourselves, we will handle these requests by coordinating with Google where applicable, or by showing you how to delete local data and reset the device identifiers. Write to itpro.devs@gmail.com; we respond within 15 days.

5. Third parties that receive data (operators)

The suggestions server is not a third party: it is our own server, run by us, the controller named in section 1. Nobody else receives those messages.

More information: Google Privacy Policy · How Google uses information from apps that use its services. We do not sell personal information, nor do we "share" it for cross-context behavioral advertising (as defined by the California CCPA/CPRA) — neither adults' data nor that of consumers under 16.

6. International data transfer

The technical data described in section 3.b is processed on Google LLC servers in the United States. The United States does not currently hold an adequacy decision issued by Ecuador's Superintendency of Personal Data Protection, so the transfer relies on appropriate safeguards (Art. 57 LOPDP): the Google Ads Data Processing Terms, a binding contractual instrument requiring Google to protect the data, together with the technical measures described in this policy (child-directed treatment, no personalization). Purposes of the transfer: those in section 3.

The suggestions in section 3.c are processed on a server of our own hosted in Frankfurt, Germany (European Union). The European Union has a data protection regime (GDPR) whose safeguards are equivalent to those of the LOPDP, and the content of those suggestions contains no personal data: the text you write, the App version, the language, the OS and the phone model. Purpose of the transfer: to read and act on your message.

7. Data retention

• We retain no personal data. The only thing we keep on a server of our own are the suggestions you write to us, for at most 12 months, and only to read them and improve the game. You can ask us to delete yours by writing to us (section 11); if you give us any reference to the message, we remove it.
• Game data remains on your device until you uninstall the App or clear its data.
• Technical identifiers collected by Google are retained only as long as reasonably necessary for the purposes in section 3 — never indefinitely — according to Google's retention periods.
• If you connect Google Play Games, your player profile and achievements are retained by Google according to your account settings; you can manage or delete them from the Play Games app.

8. Security

All communication from the App is encrypted (HTTPS), both with Google services and with our own suggestions server, which additionally stores IP addresses only as a salted hash. The App uses the Internet permission and, on Android 13 or later and only if you turn reminders on, the notifications permission; it does not access contacts, camera, microphone, personal files, or GPS location. If a security breach affecting personal data ever occurred, we would notify the authority and affected users within the deadlines of Arts. 43 and 46 of the LOPDP.

9. Your rights

Under Ecuador's LOPDP (Arts. 8 and 13–20) you have the right, free of charge, to:

• Access your data and information about its processing;
• Rectification and updating of inaccurate data;
• Deletion of your data;
• Objection to processing — including, at any time, objection to direct marketing and profiling;
• Portability of your data;
• Suspension (restriction) of processing;
• Not to be subject to decisions based solely on automated processing, including profiling (the App performs none);
• Withdraw your consent at any time, without justification, through a procedure as simple as the one used to give it.

To exercise these rights, write to itpro.devs@gmail.com (we respond within 15 days). Children under 15 exercise them through their legal guardian; adolescents 15 and older may exercise them directly. If our response does not satisfy you, you may file a complaint with Ecuador's Superintendency of Personal Data Protection (spdp.gob.ec).

In practice: you can delete all local data by uninstalling the App or clearing its data in Android settings, and you can reset or delete the device's advertising identifier under Settings → Google → Ads (the App's ads are non-personalized anyway).

10. Changes to this policy

We may update this policy. The current version will always be published at this same URL with its update date; if a change were material with respect to children's data, we would highlight it inside the App.

11. Contact

Christian López — developer of Cosmic Bash
Email: itpro.devs@gmail.com
Address: Guayaquil, Ecuador · Phone: +593 99 129 2969
App: Cosmic Bash (com.itpro.cosmicbash)