Privacy Policy, Shoot Bubble! Legend / Bubble Shooter: Pop & Puzzle

Effective date: November 5, 2026

1. Who we are

This Privacy Policy explains how Chicken Go Studio ("we", "us", "our") collects, uses, shares and protects information when you play our bubble-shooter game published as "Shoot Bubble! Legend" on the Apple App Store and "Bubble Shooter: Pop & Puzzle" on Google Play (developer account "Jewel & Candy - Match 3 Puzzle Game Studio"), package / bundle ID com.cgs.bubblepop1 (the "Game").

We are the controller of the personal data described here. Our address is 368 Ly Thai To Street, Quang Tri Province, Vietnam. If you have any question or request about your privacy, contact us at support@chickengostudio.com.

2. Summary

• The Game creates a game account automatically the first time it goes online. You do not need to give us your name, e-mail or phone number to play.
• We store your game progress, an optional nickname, purchase records, crash reports and gameplay / ad statistics on our own server so that you can restore your progress, appear on leaderboards and so that we can keep the Game working.
• The Game shows ads and uses analytics and crash-reporting services from third parties (Google, Unity, Liftoff, Yandex, GameAnalytics). They may collect device identifiers and usage data, as described below.
• You can delete your account and data at any time from Settings → Delete account in the Game, or by request at https://bubble.chickengostudio.com/delete-account.html.

3. Information we collect

3.1 Information you choose to give us

• Nickname and avatar. You can choose a nickname (3–16 characters) and an avatar picture. Before you choose one, a default name such as "Player" plus part of your player code is used. Nicknames are filtered for offensive words.
• Messages to support. If you e-mail us (for example with the "Email" button in Settings, which opens your own mail app), we receive your e-mail address, your message, and the technical details pre-filled in the message (game level, number of times you opened the Game, device model, app version, screen resolution, language). You can edit or delete these details before sending.
• Account-deletion requests. If you use our deletion request page, we receive the player code or nickname you enter, your contact e-mail address and your optional note.

3.2 Information collected by our game server

When the Game is online, it communicates with our server at bubble.chickengostudio.com over HTTPS. Our server receives:

• Identifiers:
  • a random installation ID generated by the Game (not a hardware or advertising ID);
  • a session ID;
  • our own player ID and an 8-character player code that we assign to your account;
  • a secret login token. We only store a one-way hash of it.
• Game data:
  • your highest level and app version / platform;
  • leaderboard scores and event participation;
  • a cloud save of your progress (coins, boosters, levels, stars, purchased benefits, event progress);
  • records of in-game gifts you claimed.
• Purchase data: when you make an in-app purchase, the Game sends us the information provided by Google Play or the App Store:
  • product, price and currency;
  • order / transaction ID;
  • the store's purchase token or signed receipt;
  • time, and where in the Game you opened the shop.
  The store also tells us the country of your store account when we verify the purchase. Our server never receives your card details, your name or the e-mail of your store account. (The payment SDK described in Section 3.3 may process some of this information transiently on its own.)
• Crash and diagnostic reports: error messages, stack traces and a short log of recent screens, after we remove personal information. They come with your device model, operating system version, memory size and graphics chip.
• Ad statistics: which ad formats were shown or failed, the ad network, estimated revenue and your consent status. We do not receive your advertising ID.
• IP address: our server necessarily sees your IP address.
  • Our database does not store it. We only keep a keyed one-way hash of it for one day, to limit abuse (for example too many account creations).
  • Our hosting provider's web-server logs may contain IP addresses for a limited time.

3.3 Information collected by third-party services in the Game

The services listed in Section 7 run inside the Game and collect information directly. Depending on the service, this includes:

• device identifiers: the Android Advertising ID, App Set ID, Firebase installation ID, iOS Identifier for Vendor, and (only if you allow tracking on iOS) the IDFA;
• your IP address and approximate location derived from it;
• device and app information (model, OS version, language, time zone, app version);
• how you interact with the Game and with ads;
• purchase events;
• crash and performance data;
• on Android, signals from the Android Privacy Sandbox (Topics and Attribution APIs) and the Google Play install referrer, used by ad and analytics services to measure ads and where installs come from.

Our payment SDK (Unity In-App Purchasing) states that it may process your e-mail address transiently, only to complete a purchase; it is not sent to our server.

We set your player code as the user ID in Firebase Crashlytics, so crash reports are linked to your game account.

The Game also shows a list of our other games. To display it, the Game downloads the list from our server server-game.chickengostudio.com and the game icons from Google's image hosting (Blogger); these requests only carry your IP address and standard device / browser information.

3.4 Information stored only on your device

The Game stores your progress, settings, account token and installation ID on your device. On iOS this storage may be included in your iCloud device backup, and on Android in the automatic backup to your Google account (if enabled on your device). It also keeps a short queue of reports that have not been sent yet (for up to 30 days).

What we do not collect. We do not collect your precise location, contacts, photos, microphone or camera data, or files. The Game does not have social-network login.

Do you have to give us this information? You can play without giving us any information yourself. The game account, identifiers and game data in Section 3.2 are needed to provide online features (cloud save, device transfer, leaderboards, purchases); without an internet connection the Game still works, but these features do not. Advertising choices are explained in Section 6.

4. How we use information and our legal bases

We do not use your data for automated decisions that have legal or similarly significant effects on you.

5. Leaderboards: information visible to other players

When you take part in leaderboards and events, other players in your group can see your nickname, avatar, score and player code. Do not use your real name or personal information as your nickname.

6. Advertising and your choices

The Game is free and supported by ads served through Google AdMob, with mediation partners Unity Ads, Liftoff Monetize (Vungle) and Yandex Mobile Ads.

• EEA, UK and Switzerland: we use Google's consent tool (a Google-certified CMP using the IAB TCF) to ask for your consent before personalised ads are shown, and we pass your choice on to our mediation partners. You can change or withdraw your choice at any time with Settings → Privacy options in the Game.
• US residents: you can opt out of the "sale" or "sharing" of personal information for targeted advertising with Settings → Privacy options where it is shown in the Game, or at any time by e-mailing support@chickengostudio.com.
• Android: you can delete or reset your advertising ID, or opt out of personalised ads, in your device's Ads settings.
• iOS: the Game will only access the IDFA if you allow tracking in the system prompt. You can change this at any time in Settings → Privacy & Security → Tracking.
• If you opt out, you will still see ads, but they will be less relevant to you.

Google explains how it uses data from apps that use its services at https://policies.google.com/technologies/partner-sites.

7. Third-party services

These providers process data under their own privacy policies, or as our processors under their data-processing terms. We only work with providers that are contractually required to protect personal data with at least the same level of protection as described in this Privacy Policy and as required by applicable law, and we require our processors to use the data only to provide their services to us.

8. How we share information

We do not sell your personal information for money. We share information only:

• with the service providers in Section 7 that process it on our behalf (hosting, analytics, crash reporting, payment verification);
• with advertising partners (Section 6). Under some US state laws, letting ad partners collect identifiers for targeted advertising may count as a "sale" or "sharing"; you can opt out as described in Section 6;
• with other players, only for the leaderboard information in Section 5;
• when required by law, to protect our rights or users' safety, or as part of a merger or sale of our business (in that case we will tell you before your information becomes subject to a different policy).

9. How long we keep information

10. Deleting your account and data

You can delete your account and the personal data linked to it at any time:

1. If the Game is still installed: open the map, tap Settings → Delete account and confirm twice. You need an internet connection. Your account is erased from our server immediately, and the Game data on your device is erased too.
2. If you have uninstalled the Game, or cannot use it: you do not need to reinstall it. Go to https://bubble.chickengostudio.com/delete-account.html, or e-mail support@chickengostudio.com with the subject "Delete my account". Tell us your player code (shown as "ID" in Settings) if you have it, or otherwise your nickname and, if you can, your device model, your approximate level and when you last played. Because player codes and nicknames are visible to other players, we check that the request really comes from you:
   • if you can give us one proof of ownership, we delete the account right away: a transfer code you created in the Game (Settings → Transfer data, valid for 24 hours), or a full Google Play order number (GPA.…) from a purchase receipt e-mailed to you;
   • otherwise we mark the account for deletion and delete it after 30 days, unless the account is used again during that time (in that case we cancel the request and let the requester know by e-mail, so that nobody else can delete an account that is still being played). If the account has purchases, we may ask the requester for more information by e-mail before deleting it.
   We answer every request within 30 days.
   Important: if the Game is still on any of your devices, uninstall it or clear its data before opening it again. Versions of the Game released after November 2, 2026 erase the data on the device themselves when they find that the account was deleted (within 90 days of the deletion); older versions may create a new account and upload the progress still stored on that device to it.

When your account is deleted we erase:

• your profile and nickname;
• your cloud save;
• your sessions (except the one-way hash of each login token described below), leaderboard entries, ad and crash records;
• your gift claims;
• the record of the device that currently holds your account.

We keep only:

• completed purchase records without any link to you (order ID, product, price, currency, store country, time, where in the Game the purchase was made, game level and app version, refund status), for 10 years for accounting, tax and refund handling; records of failed or cancelled purchases expire after 180 days;
• records of other devices that used your account (a random installation ID, level, app version and last activity), which are not linked to you and expire after 90 days without activity;
• daily-activity records containing only a random installation ID, until they expire after 90 days;
• a one-way hash of each login token of the account, not linked to you, for 90 days, so that a device still holding one can recognise that the account was deleted and erase the Game data stored on it;
• if your account was banned, a one-way hash of your device's installation ID for 180 days, to prevent abuse;
• administrator logs that keep your player code as a reference for actions taken on your account (for example a ban, a leaderboard moderation or the deletion itself, with basic account facts such as platform, creation date and highest level), for up to 3 years. Nicknames and notes in these logs are removed;
• if you sent a deletion request through our website, the request itself (your contact e-mail and note), for 90 days after it is closed, so that we can answer you;
• our hosting provider's web-server logs (IP address, time and the address requested, which may include the Game's random installation ID), for a limited period set by our hosting provider.

Copies of deleted data may remain in our server backups until they are overwritten, within at most 7 weeks.

Analytics and crash data held by third parties:

• Firebase Crashlytics data expires after 90 days.
• Firebase Analytics and GameAnalytics data is not linked to your game account; it expires as described in Section 9. When you delete your account, the Game also resets its analytics identifier on your device.
• Data held by ad partners is subject to their own deletion tools (Section 7).

You can also ask us to delete some of your data without deleting your account (for example your nickname) by e-mailing support@chickengostudio.com.

11. Your rights

Depending on where you live, you may have the right to:

• access the data we hold about you, and receive it in a portable format;
• correct it (you can change your nickname in the Game);
• delete it (Section 10);
• object to or restrict processing based on legitimate interests;
• withdraw consent at any time (Settings → Privacy options), without affecting earlier processing;
• opt out of the sale / sharing of personal information and of targeted advertising (US state laws such as the CCPA / CPRA), with Settings → Privacy options where it is shown, or by e-mail;
• not be discriminated against for using these rights;
• complain to your local data-protection authority.

To use these rights, e-mail support@chickengostudio.com with your player code. We may ask for proof of ownership (Section 10), and will answer within the time required by law (normally 30 days, or 45 days under US state laws). An authorised agent may make a request on your behalf with written permission.

Users in Vietnam. We process your personal data in accordance with Vietnam's Law on Personal Data Protection and its implementing regulations. Your rights listed above apply to you, and you can contact us at support@chickengostudio.com to use them.

12. Security

• All communication between the Game and our server uses HTTPS (TLS), and our server enforces HTTPS with HSTS.
• Login tokens and transfer codes are stored only as one-way hashes, and IP addresses only as keyed hashes.
• Administrator access requires Google sign-in from an allow-list of staff accounts, with role-based permissions, and changes made by administrators are logged.
• No system is perfectly secure, but we work to protect your information and will notify you and the authorities of a breach where the law requires.

13. Children

The Game is a general-audience casual game and is not directed to children under 13 (or the minimum age in your country, such as 16 in some EEA countries). We do not knowingly collect personal information from children under that age. If you believe a child has provided us personal information, contact support@chickengostudio.com and we will delete it.

14. International transfers

We are based in Vietnam. Our game server is hosted by Hostinger in the United States. Our service providers process data in the United States, the European Union and other countries, and Yandex may process data in the Russian Federation. When we transfer personal data from the EEA, UK or Switzerland, we rely on the safeguards offered by the provider, such as the European Commission's Standard Contractual Clauses or an adequacy decision.

15. Changes to this policy

We may update this policy. We will change the "Effective date" above. If the changes are material, we will tell you in the Game before they apply.

16. Contact

Chicken Go Studio, 368 Ly Thai To Street, Quang Tri Province, Vietnam. E-mail: support@chickengostudio.com. Policy URL: https://bubble.chickengostudio.com/privacy.html. Account deletion: https://bubble.chickengostudio.com/delete-account.html.

17. Notice for US residents

This section applies if US state privacy laws (such as the CCPA / CPRA) apply to us.

In the past 12 months we have collected the categories above for the purposes in Section 4. We do not collect sensitive personal information as defined by the CCPA, and we do not knowingly sell or share personal information of consumers under 16. You can opt out of sale / sharing as described in Section 6, including by e-mailing support@chickengostudio.com.