Tintalú privacy policy
1. Who we are
Tintalú is a game for Android phones developed by Parallext, LLC (parallext.com), a United States company organized in Wyoming, with its declared mailing address at 7345 W Sand Lake Rd, Ste 210, Office 2812, Orlando, FL 32819, United States (“we”). We are the controller of your personal data. We manage the game from Colombia.
Publication of Tintalú on Google Play is planned through AUTOMATION AI S.A.S, whose address is Calle 10 B 88 A 17, Interior 8, Unidad 102, Bogotá D.C., Colombia. [[ABOGADO: delimitar los tratamientos propios de la editora, los datos a los que accede y su relación con Parallext, LLC antes de publicar la política definitiva]]
- General contact: support@tintalu.com.
- Privacy contact: privacy@tintalu.com.
- Person or role in charge of data protection (in Brazil, the LGPD “encarregado”): Nir Levin Bermúdez Perea, privacy@tintalu.com.
- Representative: none in the European Union, because the game is not directed to it; in Brazil, the encarregado (below) is the contact. [[ABOGADO: revisar si hace falta representante]].
Tintalú is an independent game inspired by the Amazon basin; it is not affiliated with Amazon.com, Inc.
2. Summary
- You play without signing up: we don’t ask for your name, email or phone number. The game creates an anonymous identifier.
- When you start, we ask for your age range (not your date of birth) and, depending on your age and country, your consent for analytics and personalized ads. Saying no is as easy as saying yes, and you can change it in Settings › “Privacy and data”.
- If you say you are under 13, the game is locked and stops collecting usage data (section 6).
- The game shows ads with AppLovin MAX, only after you state your age and make your consent choice. If you don’t accept personalized ads, ads are non-personalized; from 13 to 17 too [[ABOGADO: confirmar que se mantiene la regla de no personalizar a menores de 18 (biz_under18_no_personalization)]], and in the European Economic Area, the United Kingdom and Switzerland there are no ads; if you are under 13, there are no ads.
- You can delete your account and your data in the game or on our website.
3. What data we process, who collects it and why
| Data | Collected by | Purpose | Legal basis |
|---|---|---|---|
| An anonymous player identifier (UID) | Firebase Authentication (Google), in anonymous mode | Recognize your game without sign-up, link your purchases and allow account deletion | [[ABOGADO: base legal (ejecución del servicio)]] |
| Verification that the app and device are genuine | Firebase App Check with Google Play Integrity | Protect purchases and account deletion against abuse | [[ABOGADO: base legal (interés legítimo)]] |
| An installation identifier and the game configuration | Firebase Remote Config, from the moment you open the game, also before the age screen, except in the under-13 band (see Age and minors) | Adjust game values without releasing a new version | [[ABOGADO: base legal]] |
| How you use the game (levels, wins, booster use, performance), an instance identifier, country, phone model and install source. Without the advertising ID | Google Analytics for Firebase | Improve the game and balance its difficulty | Your consent: analytics stays off until you accept it |
| Crash reports and device state (model, Android version, memory), without your UID | Firebase Crashlytics, on from the moment you open the game, also before the age screen, except in the under-13 band (see Age and minors) | Find and fix bugs | [[ABOGADO: base legal (hoy, interés legítimo; siempre activo)]] |
| For ads: device and app identifiers, IP address, phone model and Android version, language, how you interact with ads and SDK diagnostics. For rewarded ads, a single-use code to check the reward and your anonymous UID: the game gives it to AppLovin at the first rewarded ad and, from then on, AppLovin may associate it with all its ad requests, not only with the reward check [[ABOGADO: revisar; MaxSdk.SetUserId es global, sin verificar qué envía AppLovin con cada petición]]. On Android 13 or later the game does not declare the advertising ID permission, so AppLovin does not receive it; on earlier Android versions, Google Play Services may provide it [[DATO DEL DUEÑO: decisión sobre el permiso AD_ID (D-042)]] | AppLovin MAX (AppLovin Corp.), only after you state your age and make your consent choice; never if you are under 13. In the European Economic Area, the United Kingdom and Switzerland, AppLovin first shows Google’s consent message (UMP) | Show ads (rewarded and between levels), measure them and prevent fraud; check on our server that a reward matches an ad you watched | Personalized ads: your consent (on our screen or in Google’s message). Non-personalized ads and reward checks: [[ABOGADO: base legal]] |
| Your purchases: product, status, date and purchase receipt. Google Play receives your anonymous UID as an obfuscated account identifier | Google Play Billing, which processes the payment; our server verifies the purchase | Deliver what you buy, prevent fraud and meet tax obligations | [[ABOGADO: base legal (contrato y obligación legal)]] |
| Diagnostic logs of the purchase library | The Google Play Billing library sends them to Google on its own | Operation of Google Play Billing | [[ABOGADO: revisar el contenido y la base legal (Q-BILL-2)]] |
| On our server: your UID, your purchase ledger (with the receipt stored only as a cryptographic fingerprint, a “hash”), the integrity check result, the deletion code (only its hash) and the IP address in the access logs, including those of visits to this website | Our backend on Amazon Web Services, São Paulo region (Brazil) | Verify purchases, restore them if you change phones, prevent fraud and handle the deletion of your account | [[ABOGADO: base legal]] |
| Your saved game (progress, seeds, boosters and settings), your age range and your consent choices (date, text version, country and choice) | The game, on your phone (a copy of your saved game can go to Google Play Games: see the next row). Your age range and consent stay only on your phone. Exception: if you accept analytics, your age range and your consent choices (with the text version and your country’s legal profile) are also sent to Google Analytics for Firebase | Let you continue where you left off and apply the treatment that fits your age and country; with analytics accepted, measure how the consent screen is used | [[ABOGADO: base legal]] |
| A copy of your saved game (progress, seeds, boosters and settings; without your age range, your consent or your deletion code) and your Google Play Games player ID, which Google manages: the game neither stores it nor sends it to our server | Google Play Games (saved games), with your Google account, only if you stated you are 13 or older; the game signs in without asking if you already use Play Games on the phone | Recover your game if you change phones or reinstall the game | [[ABOGADO: base legal (ejecución del servicio)]] |
When you open the game: before you are asked your age, Firebase Remote Config (downloads the game configuration) and Firebase Crashlytics (crash reports, without your UID) are already running. If you stated you are under 13, the configuration is not downloaded and Crashlytics is not turned on the next times you open the game (see Age and minors). Analytics doesn’t start until you accept it, and ads (AppLovin MAX) don’t start until you state your age and make your consent choice.
This website: it uses no cookies or trackers. Its access logs keep the IP address of each visit for 30 days, for security and to detect abuse.
Notifications: the game’s reminders (for example, “The River Challenge is ready”) are local: your phone schedules them and no data is sent for them. They are only requested if you tap the reminder option or turn them on in Settings, and you can turn them off in Settings or in Android.
Country: to know which privacy rules apply, we use the country of your SIM card or, if there is none, your phone’s region, without sending it to any server. If it can’t be determined, we apply the strictest treatment.
River League
If you are 13 or older and take part in the League, our server receives your anonymous account identifier, wins and their dates, campaign progress and phone region. It calculates weekly points and assigns an automatic pseudonym, with no free text. Other players can see that pseudonym, country flag and weekly points in the Global and Country leaderboards; they cannot see your account identifier. The country may come from the connection or, as a fallback, your phone region; the initial implementation uses the phone region. It is fixed by the first accepted win each week. We do not request precise location. There is no League for children under 13 and these data are not sent for them. [[ABOGADO: revisar]]
4. What we don’t do
- We don’t ask for or store your name, email, phone number, address, photos, contacts, messages or precise location.
- We don’t sell your personal data. [[ABOGADO: redacción de «no vender ni compartir» según las leyes estatales de EE. UU.]]
- There is no chat or free text from other players; the League displays the limited data described in section 3.
- There are no random purchases: you see what you buy or win beforehand.
5. What isn’t in the game yet
Before these features arrive, we will update this policy and, where the law requires it, ask for your consent:
- More ad networks through AppLovin MAX (Google AdMob, Unity Ads, Meta Audience Network and Mintegral). Today ads only come from AppLovin.
6. Age and minors
- Tintalú is for people aged 13 and over and is not part of the Google Play Families program.
- The first time you open the game we ask your age on a neutral screen, in three ranges: under 13, 13 to 17, and 18 or older. The answer is stored on your phone (if you accept analytics, it is also sent to Google Analytics for Firebase, as section 3 explains) and you can correct it once in Settings.
- Under 13: the game is locked and asks you to have an adult install it. Crashlytics crash reports are turned off when you state your age. From then on, each time you open the game Crashlytics is not turned on and the Firebase Remote Config configuration is not downloaded (the game uses the one it already has); analytics is never turned on; neither the anonymous account, Google Play Games nor our server is used, purchases are not possible and ads never start.
- 13 to 17: ads are non-personalized [[ABOGADO: confirmar que se mantiene la regla de no personalizar a menores de 18 (biz_under18_no_personalization)]], and in the European Economic Area, the United Kingdom and Switzerland there are no ads. For all ages we ask the networks for ads suitable for all audiences (G), as far as each network’s settings allow [[DATO DEL DUEÑO: contenido máximo G configurado en cada red de anuncios]]. Purchases require a double confirmation in the game and Google Play authentication. [[ABOGADO: tratamiento de adolescentes por país (LGPD art. 14 y ECA Digital en Brasil)]]
- If you think a child under 13 used the game, write to privacy@tintalu.com and we will delete their data.
7. Who we share data with
- Providers working for us (processors): Google (Firebase, Google Play Billing, Google Play Integrity and Google Play Games) and Amazon Web Services (our server). They process the data to provide their service to us.
- AppLovin (ads) receives the data in section 3 to show and measure ads and prevent fraud, under its own privacy policy. [[ABOGADO: rol de AppLovin (tercero o encargado) y redacción de «compartir» con fines publicitarios]]
- Google Play processes your payments under its own terms and privacy policy.
- Authorities: only when the law requires us to.
- Other League players: can see the automatic pseudonym, country represented by its flag and weekly points in public leaderboard rows. [[ABOGADO: revisar]]
Links to those providers’ policies: [[DATO DEL DUEÑO: enlaces a las políticas de Google, Firebase y AWS que se citarán]].
8. International transfers
Parallext, LLC is based in the United States. Our server is in the São Paulo (Brazil) region of Amazon Web Services, and Google processes data in the United States and other countries. Your data may therefore leave your country, even if you live in Colombia, Peru, Mexico or Brazil. [[ABOGADO: garantías y mecanismos de transferencia por ley (LGPD cap. V, Ley 1581 de Colombia, Ley 29733 de Perú, LFPDPPP de México)]]
9. How long we keep data
| Data | Period |
|---|---|
| Anonymous account and data on our server | While you use the game or until you delete the account |
| Purchase ledger | After the account is deleted it is kept without your identifier for [[ABOGADO: plazo fiscal]] |
| Integrity check result | 24 hours |
| Access logs of our server and of this website, including your visits (with the IP address) | 30 days |
| Deleted-account mark (with your identifier only as a hash) | 2 hours after the deletion |
| Deletion code (only its hash) | Until the game requests a new one or you delete the account; the web deletion confirmation expires after 5 minutes |
| Crash reports | 90 days |
| Analytics | [[DATO DEL DUEÑO: retención configurada en Google Analytics para Firebase]] |
| Saved game, age range and consent | On your phone, until you delete the account or uninstall the game |
| Copy of the saved game in Google Play Games | Until you delete the account from the game (see Deleting your account and data) or delete the game’s data in the Play Games app |
| League: wins, points, weekly country and leaderboards | Scheduled to expire about three weeks after the week starts; technical deletion may finish later. Deleted when you delete your account. The pseudonym is retained while the account exists. [[ABOGADO: revisar]] |
10. Your rights
You can request access to, correction, deletion and portability of your data and information about how it is used, object to processing, and withdraw your consent at any time, without affecting processing already carried out.
- In the game: Settings › “Privacy and data” to change your choices and Settings › “Delete account and data” to delete your account.
- By email: privacy@tintalu.com. We will reply within [[ABOGADO: plazo de respuesta por ley]].
- Brazil (LGPD, art. 18): you can also contact the Autoridade Nacional de Proteção de Dados (ANPD).
- Colombia (Law 1581 of 2012): you can also contact the Superintendencia de Industria y Comercio.
- Peru (Law 29733): you can also contact the Autoridad Nacional de Protección de Datos Personales.
- Mexico (LFPDPPP): you have ARCO rights (access, rectification, cancellation and opposition). [[ABOGADO: autoridad vigente en México y vía para acudir a ella]]
- United States: [[ABOGADO: derechos según las leyes estatales de privacidad aplicables y COPPA (juego no dirigido a menores de 13)]]
11. Deleting your account and data
There are two ways, with the same result:
- In the game: Settings › “Delete account and data”, with two confirmations. It also deletes the game data on your phone and asks for the copy of your saved game in Google Play Games to be deleted.
- On the web: on the account deletion page, with the code shown in Settings.
Your anonymous account, your data on our server and your Firebase Authentication user are deleted. The purchase ledger is kept, without your identifier, for tax purposes (section 9). For 2 hours we also keep a deleted-account mark, with your identifier only as a hash, so that nothing is written again in the name of the deleted account. Purchases are not refunded.
The copy in Google Play Games: the game asks for it to be deleted when you delete the account, and checks that it was deleted (deleting it again if needed) the next time you open the game with Play Games, if you are 13 or older. If you don’t open the game again, or you delete the account from the web (which cannot reach your Google account), delete it yourself from the Play Games app (Settings › delete this game’s data). [[ABOGADO: revisar]]
Deleting your account also removes your pseudonym and League data, including leaderboard rows we still retain. Score histograms do not identify players. [[ABOGADO: revisar]]
12. Security
Data travels encrypted (HTTPS) and is stored encrypted on our server. Features that grant value (purchases and in-app deletion) require the integrity check. The game doesn’t keep secret keys on the phone, and our logs don’t store your UID in clear text or your purchase receipts.
13. Changes to this policy
If we change it in a significant way, we will let you know in the game and, where the law requires it, ask for your consent again. We keep previous versions.
14. Contact
Contact: Parallext, LLC · 7345 W Sand Lake Rd, Ste 210, Office 2812, Orlando, FL 32819, United States · privacy@tintalu.com.
Annex A · Simplified privacy notice (Mexico)
Parallext, LLC is responsible for processing your personal data. We use it so you can play Tintalú, to deliver your purchases, prevent fraud, handle the deletion of your account and, if you accept, for analytics. You can refuse the purposes that need your consent in Settings › “Privacy and data”. We share it with the providers that work for us, as explained in this policy, which is the full notice. To exercise your ARCO rights, write to privacy@tintalu.com. [[ABOGADO: revisar el aviso simplificado]]
Annex B · Brazil (LGPD)
- Encarregado (LGPD data protection officer): Nir Levin Bermúdez Perea, privacy@tintalu.com.
- Channel for data subjects (LGPD): privacy@tintalu.com.
- [[ABOGADO: bases legales por finalidad (art. 7), datos de adolescentes (art. 14; ECA Digital) y transferencias (cap. V)]]