Privacy Policy

We do not sell your personal information. We do not collect your contacts, photos, microphone, or precise location. Playing without an account (“local mode”) keeps your progress on your device only.

Glombies is a mobile creature-collecting game published by Lockdown Gaming Inc. (“Glombies”, “we”, “us”, “our”). We are the data controller for the information described in this policy.

This policy covers:

• the Glombies app for iOS and Android, including its servers and online features (the “App”); and
• the glombies.com website, including its support form (the “Website”).

Together we call these the “Services”. It explains what information we collect, why, who it is shared with, how long we keep it, and the choices and rights you have. Our Terms of Service govern your use of the Services.

Account information

You can play without an account. Progress then lives only on your device.

If you sign in, we use Supabase Auth. Depending on the method you choose, we receive:

• Sign in with Apple: a stable Apple user identifier and, if you allow it, your name and email address. If you choose Apple's “Hide My Email”, we receive a relay address instead of your real one.
• Sign in with Google: your Google account identifier, email address, name, and profile picture URL.
• Email and password: your email address and a hashed password. We never see the password itself.

We use your email address to identify your account, to send account-related messages such as password resets or email confirmation, and to respond to support requests.

Game data

To run the game we store, linked to your account:

• Your display name (default “New Trainer”) and chosen avatar.
• Level, experience, currencies (coins and gems), energy, inventory, trainer, skills, badges, and shop state.
• Your creatures (“Glombies”), eggs, team, breeding, evolution, and arena data.
• Stage progress and per-stage records, which feed the stage leaderboard and monthly ladders.
• Guild membership, guild join requests, raid contributions, and guild chat messages you send.
• Purchase records: the store transaction identifier, product, platform, and time of each purchase, so we can deliver what you bought, restore purchases, and handle disputes.
• A log of game actions you take (for example completing a stage or opening an egg), with a timestamp. The game is server-authoritative, and this log lets us verify results, resolve disputes, and detect cheating.

Information visible to other players

• Your display name, level, avatar, and power appear to other players on leaderboards, on your public profile card, and inside any guild you join.
• Guild chat messages you send are visible to every member of that guild, together with the display name you used when you sent them.
• Guild names, mottos, and crests are visible to anyone browsing guilds.

Please do not put personal information such as your real name, email, or location in your display name, guild name, or chat messages.

Keeping chat safe. We automatically mask offensive words in guild chat before a message is stored. You can block a player from their card, which hides their guild chat from you; we keep the list of players you've blocked until you unblock them or delete your account, and blocked players are not told. You can also report a player. A report records who reported whom, the reason, and a copy of the reported player's most recent guild chat messages, so we can review it; the reported player is not told who reported them. We use reports only to enforce our Terms of Service.

Device and diagnostic information

• Crash and error reports (Sentry): when the App crashes or hits an error, we receive a report containing the error, a stack trace, the app version, device model, operating system version, and a pseudonymous identifier. A sample of performance traces (about one in five sessions) is also collected. We do not attach your email or name to these reports.
• Device capability signals: to pick graphics settings automatically, the App reads your device's memory, processor count, graphics chip name, and model. This is stored on your device only and is not sent to us.
• Network state: the App checks whether you are online so it can hold off downloading assets and updates. This is not transmitted.

Notifications

• Push notifications are optional and use OneSignal. If you allow them, OneSignal receives your device's push token, device type, operating system, language, time zone, app version, and your Glombies player identifier so we can address notifications to your account. You can turn them off in the App's Settings or in your device settings at any time.
• Local reminders (for example “your energy is full”) are scheduled on your device and do not involve any server.

Advertising

Glombies shows rewarded video ads through Google AdMob. Watching an ad is always your choice; you tap to start one in exchange for an in-game reward. The Ad-Free Pass removes them.

• On iOS, the App asks for permission through Apple's App Tracking Transparency prompt before any advertising identifier is used. If you decline, ads are shown without cross-app tracking.
• On Android, the Google advertising ID may be used unless you have limited or reset it in your device settings.
• Where required (for example in the EEA and UK), we show a consent form from Google's User Messaging Platform before ads load. You can decline personalised ads and still play; you will see non-personalised ads instead.
• AdMob may collect device information, IP address, and ad interaction data. The App does not ask for your location for gameplay.

Google's own privacy policy applies to its processing of this data: policies.google.com/privacy.

Install attribution and revenue measurement

We use Singular to understand which advertising campaigns bring players to the game and to measure what those campaigns earn. Singular receives the advertising identifier (on iOS only after you have allowed tracking), your device type and operating system, IP address, app version, your account ID, and events such as installing and opening the App, creating an account, finishing the tutorial, clearing stages, purchases and ad revenue. Singular's privacy policy: singular.net/privacy-policy.

Over-the-air updates and game assets

• The App can download updated game code between store releases using Capgo. Capgo receives your app version, platform, a device identifier, and update status so the right bundle is delivered.
• Artwork, music, and sound are streamed from Cloudflare storage. Like any web request, this exposes your IP address to Cloudflare and to our servers, which may keep it in short-lived access logs.

You can browse glombies.com without creating an account or telling us who you are.

Analytics and advertising measurement

The Website uses the Google tag to run Google Analytics 4 (to understand how the site is used) and Google Ads conversion tracking and remarketing (to measure whether our advertising works and to show Glombies ads to people who have visited the site). Google receives the pages you view, the site that referred you, your approximate location derived from your IP address, browser and device information, and interactions such as tapping a store button. It sets cookies (for example _ga and _gcl_au) to recognise your browser across visits. We have not enabled the sale of this data and we do not upload customer lists to Google.

When you pre-register, we tell Google Ads and Google Analytics that a sign-up happened so we can measure which ads bring new Keepers. To do this we use Google's enhanced conversions: your browser converts your email address into a one-way SHA-256 hash before anything is sent, and Google uses that hash only to match the sign-up to an ad you interacted with. Google does not receive your email in readable form, and it does not receive your username.

The Website also uses the TikTok Pixel, so we can measure and improve our TikTok advertising and show Glombies ads on TikTok to people who have visited the site. TikTok receives the pages you view, your IP address, browser and device information, and events such as starting or completing a pre-registration or tapping a store button. When you pre-register, your browser sends TikTok a one-way SHA-256 hash of your email address (never the readable address, and never your username) so TikTok can match the sign-up to an ad you saw. Our server also reports the same sign-up to TikTok directly (TikTok's Events API), with that hashed email, your IP address, browser user agent, the page you signed up on, and TikTok's own ad-click and browser identifiers, so it is counted even if a browser extension blocks the pixel. TikTok sets a cookie (_ttp) and processes this data under its own privacy policy.

You can opt out with the Google Analytics opt-out browser add-on, adjust personalised advertising at adssettings.google.com and in your TikTok app's ad settings, or block cookies in your browser. The Website works fully without these cookies.

Pre-registration

If you pre-register for launch, we store the email address and username you enter, the time you signed up, and the launch reward you were promised, in the same database the App uses. We use them to reserve the name, to grant the reward when you first sign in to the App with that email, and to send you a single email when the game launches. We do not add you to a marketing list. You can withdraw a pre-registration at any time by emailing hello@lockdowngaming.io; if you never sign in to the App, we delete unclaimed pre-registrations within 12 months of launch.

Support form

When you use the support form, the name, email address, subject, and message you enter are emailed to our support inbox through Resend, an email delivery provider, so we can reply to you. If delivery fails, the form opens your own email app instead and nothing is sent through Resend. We keep support correspondence for as long as we need it to resolve your request and for a reasonable period afterwards in case you write again.

Server logs and hosting

The Website is hosted on Vercel, and its images and creature artwork are served from Cloudflare. Like any website, these providers record standard request logs (IP address, user agent, requested page, and time) for security and to keep the site running. These logs are not used to identify you and are kept for a short period.

Cookies

We do not set any cookies of our own, and we do not use cookies that are strictly necessary for the site to work, so nothing is stored if you block them. We honour the Global Privacy Control signal where the law requires it; we do not respond to browser “Do Not Track” signals, which have no agreed meaning.

If you are in the European Economic Area, the United Kingdom, or Switzerland, we must have a legal basis for each way we use your information. These are:

We do not use your information for automated decisions that have legal or similarly significant effects on you, and we do not use it to train artificial-intelligence models.

We share information only with providers that process it on our behalf, and only what each one needs. We do not sell personal information, we do not share it with data brokers, and we do not give third parties access to it for their own marketing.

We may also disclose information:

• To other players, as described under “Information visible to other players” above.
• To comply with the law: in response to a valid legal request such as a court order or subpoena, or where we reasonably believe disclosure is required by law.
• To protect people and the Services: to enforce our Terms, investigate fraud, cheating, or abuse, or protect the safety, rights, or property of players, the public, or us.
• In a business transfer: if we are involved in a merger, acquisition, financing, reorganisation, or sale of assets, your information may be transferred as part of that deal. This policy will continue to apply to it, and we will tell you if a different policy takes over.
• With your direction, when you ask us to.

Lockdown Gaming Inc. is based in Austin, Texas, United States, and our providers are mainly in the United States. If you live elsewhere, your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country.

If you are in the EEA, UK, or Switzerland, transfers rely on the European Commission's standard contractual clauses (and the UK Addendum or International Data Transfer Agreement, as applicable), an adequacy decision such as the EU-US Data Privacy Framework where the provider is certified, or another lawful transfer mechanism. You can ask us for more information about the safeguards that apply to a particular provider.

• Account and game data: for as long as your account exists. When you delete your account, it is removed as described in the next section.
• Game action logs: up to 12 months, then deleted or anonymised.
• Purchase and transaction records: up to 7 years after the purchase, to meet tax, accounting, and legal obligations, even if you delete your account.
• Fraud, security, and enforcement records (for example a note that an account was banned for cheating): up to 12 months after the account is closed, to stop abuse from resuming.
• Crash reports: 90 days by default at Sentry.
• Push tokens: until you disable notifications, uninstall the App, or delete your account.
• Server and website access logs: up to 30 days.
• Player reports: while we review them and for up to 12 months after, then deleted. A report is deleted straight away if the reported player deletes their account.
• Pre-registrations: until the reward is claimed in the App (the record then becomes part of your account data), or 12 months after launch if it never is.
• Support correspondence: up to 2 years after the last message, unless it relates to a dispute or legal matter.
• Website analytics data: up to 14 months at Google Analytics; advertising cookies last up to 90 days.
• Advertising and attribution data: held by Google and Singular under their own retention rules.

Encrypted backups are purged on a rolling cycle, so residual copies of deleted data are gone within 90 days. Anonymised or aggregated data that can no longer identify you (for example overall gameplay statistics) may be kept indefinitely. Local-mode progress stays on your device until you clear the App's data or uninstall it.

Delete your account

Open Settings → Delete account inside the App, or follow the steps on our account deletion page. This removes your profile, creatures, items, progress, guild membership, leaderboard entries, and push registration from our systems, and signs you out on all devices. Guild chat messages you sent are unlinked from your account; the text and the display name shown at the time may remain visible to that guild. Contact us if you want those removed too. Purchase records are kept as described above.

Other controls

• Reset progress without deleting your account, from Settings.
• Push notifications: toggle in Settings, or in your device's notification settings.
• Personalised ads and tracking: decline in the consent form where it is shown, or use your device settings (iOS: Settings → Privacy & Security → Tracking; Android: Settings → Google → Ads → Delete or reset advertising ID). The Ad-Free Pass removes ads entirely.
• Play offline: local mode never sends game data to our servers.
• Website cookies: see the Website section above.
• Marketing email: we do not currently send marketing email. If we ever do, every message will include an unsubscribe link.

Your legal rights

Depending on where you live, you may have the right to:

• access the personal information we hold about you and receive a copy;
• correct information that is inaccurate or incomplete;
• delete your personal information;
• export your information in a portable, machine-readable format;
• object to or restrict certain processing, including processing based on legitimate interests;
• withdraw consent at any time, without affecting processing that happened before;
• complain to a data protection authority. In the EEA this is the authority in your country; in the UK it is the Information Commissioner's Office. We would appreciate the chance to address your concern first.

To make a request, email hello@lockdowngaming.io from the address linked to your account. We will verify that the request comes from the account holder before acting on it, and we will respond within the time the law allows (generally 30 days, or 45 days for residents of US states with privacy laws). You may use an authorised agent to make a request on your behalf if you give them written permission and we can verify your identity. We will never discriminate against you for exercising your rights.

California and other US states

If you live in California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, or another US state with a comprehensive privacy law, this section supplements the rest of the policy. In the past 12 months we have collected the following categories of personal information, for the purposes described above:

You can opt out of “sharing” for cross-context behavioural advertising through the ad consent and tracking controls described above, by blocking cookies on the Website, or by emailing us. We do not knowingly sell or share the personal information of anyone under 16. We do not use or disclose sensitive personal information for purposes that would give you a right to limit its use.

European Economic Area, United Kingdom, and Switzerland

The legal bases for our processing are listed in the “Why we use your information” section. Where we rely on legitimate interests we have balanced them against your rights; you can object at any time. We are not required to appoint a data protection officer or an EU/UK representative at our current size; you can reach us about any data protection matter at hello@lockdowngaming.io.

Canada

We collect, use, and disclose personal information with your consent or as permitted or required by law. Your information may be stored and processed in the United States and be subject to lawful access by authorities there. You may withdraw consent, subject to legal and contractual restrictions, and you may complain to the Office of the Privacy Commissioner of Canada.

Australia

We handle personal information in accordance with the Australian Privacy Principles. You can complain to us first, and then to the Office of the Australian Information Commissioner if you are unhappy with our response.

Glombies is made to be gentle and welcoming, but the App and Website are not directed at children under 13 (or the higher age your country sets for consenting to data processing, such as 16 in parts of the EEA). We do not knowingly collect personal information from children below that age, and the App asks players to be at least 13 in our Terms of Service.

Parents and guardians: players between 13 and 18 need your permission to play. If you believe a child under 13 has created an account or that we have collected a child's information without appropriate consent, email hello@lockdowngaming.io and we will delete the account and its data promptly. Remember that you can turn off ads and purchases through your device's parental controls (Screen Time on iOS, Family Link on Android), and that local mode lets a child play with nothing leaving the device.

Connections to our servers use TLS. Passwords are hashed, never stored in plain text. Database rows are protected so that only your own account can read your data, and the game server checks every action it receives. Access to production systems is limited to the people who need it. No system is perfectly secure, so please use a strong, unique password (or Sign in with Apple or Google), keep your device updated, and contact us right away at hello@lockdowngaming.io if you think your account has been compromised. If a breach affecting your personal information ever occurs, we will notify you and the relevant authorities as the law requires.

The Services link to third-party sites and services, including the App Store, Google Play, and the ad networks that serve rewarded videos. We do not control those services and this policy does not cover them. Please read their privacy policies. Ads shown in the App are provided by Google and its partners under their own policies, and we do not see what you do after tapping an ad.

When we make material changes we will update the date at the top and, where the change affects how we use data you have already given us, tell you in the App or by email before it takes effect. Earlier versions are available on request. Continuing to use the Services after a change takes effect means you accept the updated policy, to the extent the law allows acceptance in that way.

If you have any questions about this policy or want to exercise your rights, contact us:

Lockdown Gaming Inc.
Austin, Texas, United States
Email: hello@lockdowngaming.io
Support form: glombies.com/#support