Gooblies

Your data, and your child's

Privacy policy

This policy explains what data Gooblies collects when your child plays, why, who it is shared with, how long it is kept and how to exercise your rights. It describes how the service actually works.

Last updated :

1. Data controller

The controller of your personal data is:

Maurice Hurdebise, a self-employed entrepreneur (natural person), trading under the name “Jack & Mani”. Gooblies is one of his games — which is why our emails reach you from a @jackandmani.com address. Company number (BCE): 0805.203.037 (not VAT-registered). Address: Rue Chaumont 9, 4970 Stavelot, Belgium. Email: info@jackandmani.com.

This policy is governed by Belgian law and by the General Data Protection Regulation (GDPR). The competent supervisory authority is the Autorité de protection des données (APD), the Belgian data protection authority.

2. The principle

The game is for your child, the account is yours.

We do not know your child's surname, first name, age or face, and we have no intention of learning them. The game never asks for a nickname. The only identifying data we hold is your own email address — yours, the adult who created the account.

There is, however, one thing that deserves to be said plainly rather than buried in a table: in order to work, Gooblies records the outline of the garden where your child plays, and the places where creatures were hidden during games. These are real GPS coordinates, around your home. The next section explains exactly what is recorded, and section 8 for how long.

This document is addressed to you, the adult; the game itself is written for your child.

3. The data we process

Account data. Your email address and your password, if you create an account by email. The password is hashed by our authentication provider and is never stored in plain text on our side. If you sign in with Google, we receive the Google account identifier and the associated email address; we do not use the name or the picture from the Google profile. A technical identifier (UID) is assigned to each account.

Game data. The creatures owned and how well fed they are, the number of games, the discovery counters, how far you have progressed through the discovery of the game, and the cupcake ledger.

Location data. Two distinct things, and this is the most sensitive part of this document:

  • The garden. You draw, yourself, on a satellite map, the perimeter within which your child is allowed to play. That outline — from 3 to 60 GPS points, capped at 10,000 m² — is recorded on your device and, if you have an account, on our servers. In practice, it describes the surroundings of your home.
  • The games. At the end of a game, we record the positions of the hiding places used, six at most, all of them inside the garden you have drawn.

During a game, the position of the device is read continuously by the game in order to tell whether the child is getting closer to a creature. This continuous position is neither recorded nor transmitted: it is used for the calculation, on the device, and is then discarded.

Technical data. Your IP address and technical headers may be logged by our hosting provider. Mapbox receives your IP address when the map background loads.

Measurement data. If — and only if — you accepted measurement in the site banner, Google Analytics receives a randomly drawn identifier, your IP address, the pages viewed and counters of game gestures. The details are in the summary in section 4, and our cookie policy says where the question is put to you.

We do not collect: surname, first name, nickname, date of birth, age, photograph, postal address, telephone number or contacts.

4. Purposes and legal bases

We only process your data for specified purposes and on a precise legal basis (article 6 of the GDPR). The details are set out in the summary below.

Account and authentication

Data
Email address, password (hashed by our provider, never stored by us in plain text), email verification status, technical account identifier (UID), creation and sign-in dates. A trial game is possible without an account, with no data sent to our servers at all.
Purpose
Creating and managing the account, signing you in, carrying your child's progress from one device to another.
Legal basis
Performance of the contract (art. 6.1.b GDPR).
Recipients
Google / Firebase Authentication (processor).
Retention
For as long as the account exists. An account left inactive for 36 months is deleted.

Game progress

Data
Creatures owned and how well fed they are, number of games started and completed, discovery gauge and counter, the stages of discovering the game, preferences (sound, vibration, language).
Purpose
Saving progress and the state of the game.
Legal basis
Performance of the contract (art. 6.1.b GDPR).
Recipients
Storage on the device; for accounts, synchronisation to Cloud Firestore (Google, European Union).
Retention
For as long as the account exists.

The garden (location data)

Data
The GPS outline you draw yourself on a map: from 3 to 60 points (latitude, longitude), the centre, the bounding box and the area of the perimeter, capped at 10,000 m².
Purpose
Marking out the play area. This is the data that lets the game hide creatures in places that can be reached, and know when the child leaves the area.
Legal basis
Performance of the contract (art. 6.1.b GDPR).
Recipients
Cloud Firestore (Google, European Union). The map background shown while you draw comes from Mapbox, which receives your IP address and the area being viewed.
Retention
For as long as the account exists. You can redraw or erase the garden at any time.

Games played (location data)

Data
For each completed game: up to six GPS positions of hiding places inside the garden, the start and end timestamps, and the outcome of the game.
Purpose
Replaying how a game unfolded, avoiding hiding a creature in the same place twice, and displaying the history in the parents' area.
Legal basis
Performance of the contract (art. 6.1.b GDPR).
Recipients
Cloud Firestore (Google, European Union).
Retention
12 months after the end of the game, then deletion.

Cupcake ledger

Data
One line per movement: date, amount, reason (start of a game, account bonus, daily gift, discovery, purchase, feeding a creature), and the balance after the operation.
Purpose
Keeping count of the cupcakes and letting you answer, line by line, the question “where did my cupcakes go?”.
Legal basis
Performance of the contract (art. 6.1.b GDPR).
Recipients
Cloud Firestore (Google, European Union).
Retention
For as long as the account exists. The ledger cannot be altered.

Parental code

Data
The fingerprint of the four-digit code (computed with the scrypt function using a random salt — the code itself is never recorded), an attempt counter and the date of the last verification.
Purpose
Protecting the parents' area and, above all, preventing a purchase from being triggered by a child.
Legal basis
Legitimate interest (art. 6.1.f GDPR).
Recipients
Cloud Firestore (Google, European Union), in a document that only the server can read — it is not accessible from the application.
Retention
For as long as the code is in place; deleted together with the account.

Purchases

Data
Amount, currency, transaction identifier and payment event identifier, and the tier purchased. No bank card data is received or kept by us.
Purpose
Crediting the cupcakes purchased and keeping the accounts.
Legal basis
Performance of the contract (art. 6.1.b) and accounting legal obligation (art. 6.1.c GDPR).
Recipients
Stripe (United States) for processing the payment; a record of the purchase kept with Google (Firestore, European Union).
Retention
The Belgian statutory accounting period, i.e. approximately 7 years.

Usage measurement

Data
A randomly drawn identifier, your IP address, the site pages viewed, and counters of game gestures: a game started, a game finished or abandoned, a creature found, a meal given, the shop opened, a purchase completed. No location, no garden outline and no account identifier are transmitted.
Purpose
Knowing whether the home page convinces and what actually gets used in the game, in order to improve it.
Legal basis
Your consent (art. 6.1.a GDPR), given in the site banner and revocable at any time.
Recipients
Google Analytics (Google Ireland Limited).
Retention
14 months, after which the reports keep totals only.

A word about location data, because it is the first question a parent asks. It rests on the performance of the contract and not on your consent, for a simple reason: without a garden, there is no game. A creature cannot be hidden in a garden without knowing where the garden is. This takes nothing away from you — your browser will ask for permission to access your location in any case, and you can refuse it or withdraw it at any time in your device settings; the game will then stop working, but nothing will be recorded.

5. What we do not do

This section is short because it is categorical.

We have no advertising network and we display no advertising. We carry out no profiling and no automated decision-making. We do no session recording — nothing films your child's screen — and no A/B testing. We do not sell your data and we do not share it with anyone other than the technical providers listed in section 6. We send no newsletter and no marketing email. The game contains no artificial intelligence, no chat, no social feature, no leaderboard and no push notifications.

One single exception, and it depends on you: the usage measurement described in section 6, which only takes place if you accepted it. It counts gestures — a game started, a meal given — without ever seeking to know who made them.

The only emails you will receive are: the verification of your address and the reset of your password, sent by our authentication provider; and the receipt for your purchases, sent by our payment provider.

6. Recipients and processors

Your data is disclosed only to the technical providers strictly necessary for the operation of the service, acting on our instructions.

Google / Firebase (Google Ireland Limited and Google LLC): authentication (Firebase Authentication), sign-in with Google, game database (Cloud Firestore, europe-west1 region, Belgium), server functions (Cloud Functions, same region) and hosting of the site (Firebase App Hosting). Your email address stays confined to the authentication service and is never copied into the game database.

Stripe (Stripe, Inc., United States): payment processing. Your bank card details are entered and processed directly by Stripe and are never received or stored by us. Stripe receives your email address in order to send you the receipt. If you pay with Apple Pay or Google Pay, Apple or Google are also involved, under their own terms.

Mapbox (Mapbox, Inc., United States): the satellite map background shown when you draw or view the garden. Mapbox receives your IP address and the coordinates of the area being viewed. The map data also comes from OpenStreetMap.

Sentry (Functional Software, Inc., United States): technical monitoring. When a page stops working, Sentry receives the error message, the browser version and the place in the code concerned, so that we can repair it. We have turned off the sending of personal data by default: neither IP address nor session identifier is attached to the reports, and no screen recording is made.

Google Analytics (Google Ireland Limited): audience measurement on the site and usage measurement in the game, only if you have accepted it in the banner provided for that purpose. Google then receives your IP address, the pages viewed, a randomly drawn identifier and counters of game gestures — a game started, a creature found, a meal given, a purchase completed. No location, no garden outline and no account identifier are transmitted to it: the measurement does not make it possible to know who is playing. Nothing is measured before your agreement, nor if you decline it, nor if the question has never been put to you.

7. Transfers outside the European Union

The game database and the server functions are hosted in the European Union (europe-west1, Belgium). Transfers outside the European Union nevertheless take place:

  • Google / Firebase: Firestore and the Cloud Functions are in the European Union, but Firebase Authentication is a global Google service: your sign-in credentials may be processed outside the EU, and Google, as a US company, may in addition access the data remotely;
  • Stripe (United States): transfer of the data required for the payment;
  • Mapbox (United States): transfer of your IP address and of the map area being viewed;
  • Sentry (United States): transfer of the technical error report;
  • Google Analytics (United States): if you accepted measurement, the measurement data may be processed by Google LLC outside the European Union.

These transfers are framed by the safeguards provided for by the GDPR: standard contractual clauses of the European Commission and, where applicable, certification under the EU–US Data Privacy Framework.

8. Retention periods

Account, garden, progress and ledger: kept for as long as the account exists. An account left inactive for 36 months is deleted.

Positions from games played: kept for 12 months after the end of the game, then deleted.

Continuous position during a game: never kept. It exists only in memory, on the device, for the time of the calculation.

Parental code: kept for as long as the code is in place; deleted together with the account.

Record of payments: kept for the statutory accounting period applicable in Belgium, i.e. approximately 7 years.

Data stored on your device (progress, preferences, game in progress): kept until you erase it. The parents' area offers a button that erases all local data.

Trial game without an account: no game data is sent to our servers. Everything stays on the device.

Usage measurement: the measurement cookie expires after 13 months; the detailed reports are kept for 14 months by Google, after which only totals remain. If you did not accept measurement, there is nothing to keep.

9. Your rights

Under the GDPR, you have the following rights:

  • Right of access: to obtain confirmation that data concerning you is being processed, and to receive a copy of it;
  • Right to rectification: to have inaccurate data corrected;
  • Right to erasure: to request the deletion of your data;
  • Right to restriction of processing;
  • Right to object, in particular to processing based on our legitimate interest;
  • Right to portability: to receive your data in a structured format;
  • Right to withdraw your consent at any time, for the processing that depends on it.

Exercising these rights is free of charge. To do so, write to us at info@jackandmani.com. As a rule, we reply within one month.

Deleting the account. The service does not yet offer a self-service deletion button. To have your account and all associated data deleted — including the garden and the games — send us your request by email to info@jackandmani.com; we act on it within a maximum of 30 days. In the meantime, the parents' area already lets you erase all of the data present on the device.

You also have the right to lodge a complaint with the Autorité de protection des données (APD), the Belgian data protection authority: Rue de la Presse 35, 1000 Bruxelles (www.autoriteprotectiondonnees.be).

10. Children

Gooblies is a game designed for children, from the age of 6. That deserves to be explained precisely rather than dispatched in a line.

The account belongs to an adult. You are the one who creates it, who accepts the terms, who sets the parental code and who pays, where applicable. The contract is concluded with you. The child uses the game; the child is not a party to it.

We collect no identifying data about the child: no name, no nickname, no date of birth, no photograph. What concerns the child is the outline of the garden, the positions of the hiding places from their games, their creatures and their cupcake balance — all attached to your account.

None of our processing relies on the child's consent. It relies on the performance of the contract you have concluded, on our legitimate interest, on a legal obligation — and, for usage measurement alone, on your adult consent, given on the site before the game is even opened. The game never asks the child for anything: not their agreement, not a purchase, not a piece of data about them. In Belgium, the age from which a minor may consent alone to the processing of their data in the context of information society services is set at 13; that question does not arise here, since we base no processing on a child's consent.

No purchase is ever advertised to the child. The game interface never mentions a purchase, shows no price and features no character that begs. The shop sits behind a four-digit parental code, verified by our server and not by the application.

If you believe that a child has sent us data without the required permission, contact us at info@jackandmani.com: we will carry out the checks and, where appropriate, the deletion.

11. Cookies and storage on your device

The service sets two cookies that are either strictly necessary or a matter of preference, a third one for usage measurement — that one only if you accepted it —, and uses the browser's local storage so that the game can work offline. Measurement is the only tracker requiring consent: it is the only thing the site banner asks you about, and it asks only once.

The details are set out in our cookie policy.

12. Security

We implement appropriate technical and organisational measures: encryption of communications (HTTPS), password management by a specialised authentication service, authentication of requests by tokens, and database rules that prevent one account from accessing another account's data.

Three protections are worth pointing out because they are unusual: the parental code is stored in a document that the application cannot read at all, only the server has access to it; the cupcake ledger is immutable, no line can be modified or deleted; and the lines corresponding to a purchase can be created by the server only, never by the application.

Since no measure can guarantee absolute security, we encourage you to choose a strong password and not to reuse it elsewhere.

13. Data from the previous application

Gooblies succeeds an earlier application from the same publisher. If you had an account there, the game may offer to carry your progress over: it then reads, read-only, the game data of that former application associated with your account, in order to convert it to the new format. No data is written to the former application, and the operation only takes place at your request.

14. Changes to this policy

We may develop this policy further, in particular to reflect new features or legal developments. Any change is published on this page with an updated revision date. In the event of a substantial change, we will endeavour to inform you by an appropriate means.

15. Contact

For any question relating to this policy or to the exercise of your rights:

Maurice Hurdebise (Jack & Mani) — Gooblies service Rue Chaumont 9, 4970 Stavelot, Belgium Email: info@jackandmani.com

You may also lodge a complaint with the Autorité de protection des données (APD), the Belgian data protection authority: www.autoriteprotectiondonnees.be.