Privacy policy
Last updated: October 12, 2026
This English version is a translation provided for convenience. In case of any discrepancy, the French version prevails.
This policy explains what data the PANIK TOWN mobile game (iPhone / iOS and Android, distributed on the App Store and Google Play) and this website process, why, and how to exercise your rights (GDPR). Data controller: 2 FRESH STUDIO, 20 rue Paul Valéry, 93420 Villepinte, France — team@paniktown.com.
In short
- No mandatory sign-up: a guest account is created automatically, with no email address or phone number. If you wish, you can save your progress with Apple, Google or your email address to get it back on another phone.
- Rewarded ads, which you choose to watch (revive bonus, doubled rewards…), and sometimes a full-screen (interstitial) ad when you go back to the menu after a finished run (never during a run, never after your first run, by default at most once every 3 runs, never with “Remove Ads”). No banners, no selling of data, no location. Personalized ad tracking is only used if you accept it.
- Optional in-app purchases (“No ads”, world packs, coin packs): payment is processed by Apple or Google; we never see your card.
- Data is used only to run the game: progress, friends, chat, multiplayer games.
- Optional push notifications (backup requests, messages, friend requests): only if you allow them, never showing the content of your messages, and can be turned off at any time.
- Audience measurement and crash reports (Firebase, Google) to improve the game: no advertising purpose, subject to your consent in the European Union, the United Kingdom and Switzerland, and can be turned off at any time in the settings.
Data processed
| Data | Why | Legal basis |
|---|---|---|
| Random guest identifier (stored on the device) | Find your officer and your progress | Performance of the service |
| Sign-in account (optional, “SAVE YOUR PROGRESS”): chosen service (Apple, Google or email), account identifier provided by Apple or Google, email address (for Apple, possibly a masked relay address from “Hide My Email”), sign-in dates; for email, one-time codes (stored hashed, valid for 10 minutes) | Save your progress and get it back on another device or after reinstalling | Performance of the service (at your request) |
| Nickname, player code, skin, rank | Profile visible to your friends | Performance of the service |
| Game progress and statistics (levels, worlds, kills, play time, equipment, coins) | Saving, profile, leaderboards | Performance of the service |
| Friends list, requests, blocks | Social features | Performance of the service |
| Chat messages (one-to-one and in-game quick chat) | Talk with your friends | Performance of the service |
| Presence (online, in game) and multiplayer game data (positions, in-game actions) | Let your friends join you | Performance of the service |
| Device push notification token (Expo token, one per device) and system type (iOS or Android) — only if you allow notifications | Let you know when a friend calls you for backup, writes to you or sends you a friend request | Consent (system permission + NOTIFICATIONS setting) |
| Technical logs (errors, timestamps) | Security, anti-cheat, bug fixing | Legitimate interest |
| Internal game statistics (day of activity, game summaries: world, wave reached, duration, result, powers and evolutions chosen) | Game balancing, aggregated internal statistics | Legitimate interest |
| Firebase Analytics audience measurement: game events (app open, game start and end, level up, power chosen, boss defeated, purchases, rewarded ad watched), app instance identifier, random guest identifier, device model, operating system, app version, approximate country | Understand how the game is played and improve it | Consent (EU, United Kingdom, Switzerland); legitimate interest elsewhere |
| Firebase Crashlytics crash reports: error trace, device model, operating system, app version, Crashlytics installation identifier, random guest identifier, last game events before the crash | Detect and fix crashes | Legitimate interest (can be turned off) |
| Google AdMob ads (rewarded, and full-screen when going back to the menu after a run): device advertising identifier (only if you allow it), IP address, device model, operating system, consent choices, interactions with the ad | Show the ad (the one you chose to watch, or the one shown after a run), measure and prevent fraud; personalization only with your consent | Consent (EU, United Kingdom, Switzerland, through the form shown by the game); legitimate interest for non-personalized ads |
| In-app purchases: transaction identifier, product purchased, date, store country, random guest identifier | Unlock and restore your purchases on all your devices | Performance of the contract |
| Bug reports sent from the game: your text, your nickname and, if you leave the box checked, technical information (app version and build, device model, operating system, world and last game, latest technical errors of the app) | Handle your report and fix the bug | Performance of the service (at your request) |
Sign in with Apple, Google or email
Signing in is optional: it links your existing officer to an account so you can get it back on another phone or after reinstalling. The game never receives your password, your name or your photo.
- Sign in with Apple: we receive an app-specific account identifier and an email address. If you choose “Hide My Email”, it is an Apple relay address (…@privaterelay.appleid.com) and we do not know your real address.
- Google: we receive a Google account identifier and your Google email address.
- Email: we send you a 6-digit code (valid for 10 minutes) to check that the address is yours. It is sent through Resend (Resend, Inc.).
- Privacy: your email address is never shown to other players or sent to Firebase; it is only used to sign you in (no newsletter, no advertising).
- Sign-out and deletion: SIGN OUT (Settings › ACCOUNT) signs the device out; your progress stays on your account. Deleting your account also erases your linked sign-in accounts and email codes.
Audience measurement and crash reports
The game uses Firebase Analytics and Firebase Crashlytics (Google). None of this data is used for advertising: ad storage and ad personalization remain disabled in Firebase (Google Consent Mode v2). We never send your nickname, your messages or your friends’ identities to Firebase; the identifier used is the game’s random guest identifier.
- Consent: in the European Union, the United Kingdom and Switzerland, audience measurement only records data if you accepted it in the consent form shown by the game (or by turning it on in the settings). Elsewhere, it is active by default.
- Turning it off: Settings → ANALYTICS & CRASH REPORTS turns off audience measurement and crash reports on this device. You can also change your consent choice through AD PRIVACY CHOICES.
- Retention: 2 months for detailed Google Analytics data (anonymous aggregated reports may be kept longer), 90 days for Crashlytics crash reports. Internal game statistics and bug reports are kept as long as your account exists and are erased with your account.
Push notifications
The game only asks for permission to send notifications after offering it to you (when opening the FRIENDS or CHAT screens), never on first launch. If you accept, your device’s notification token is stored on our server (Convex) and linked to your guest account.
- Content: plain text showing your friend’s nickname and the action (“BACKUP REQUESTED — Blaze needs you in Downtown”, “Blaze sent you a message”, friend request received or accepted). The content of your messages is never sent in a notification, so that it does not appear on the lock screen. Messages are grouped (at most one notification per conversation every 2 minutes) and no notification is sent for the chat you have open.
- Delivery: notifications go through the Expo notification service (650 Industries, Inc.), then through Apple Push Notification service (iOS) or Google’s Firebase Cloud Messaging (Android). These services receive the token and the notification text only to deliver it.
- Retention: the token is kept as long as notifications are enabled on the device. It is deleted as soon as you turn them off in the game, automatically when Apple or Google report that the app is no longer installed, and with your account.
- Turning them off: game Settings → NOTIFICATIONS (OFF), or your phone’s settings → Notifications → PANIK TOWN.
Who sees what?
Your friends see your nickname, your code, your rank, your skin, your profile statistics, your status (online / in game) and the game you are playing if they can join it. Other players only see your profile if they search for you or play with you. Messages can only be read by the two participants. A blocked player can no longer see you, write to you or join your games.
Processors and hosting
- Convex, Inc. (game database and server) — hosted in the United States; transfer governed by the European Commission’s standard contractual clauses.
- Apple (app distribution on the App Store and TestFlight, push notifications on iOS) — under Apple’s privacy policy.
- Google (app distribution on Google Play, Google Play payments on Android) — under Google’s privacy policy.
- Expo / 650 Industries, Inc. (push notification delivery) — United States; transfers governed by standard contractual clauses. Firebase Cloud Messaging (Google) then delivers them on Android.
- Google Ireland Ltd / Google LLC (Firebase Analytics and Crashlytics: audience measurement and crash reports) — transfers to the United States governed by the EU–US Data Privacy Framework and standard contractual clauses.
- Google AdMob (rewarded ads and full-screen ads after a run) — under Google’s advertising policies; transfers governed by the Data Privacy Framework and standard contractual clauses.
- RevenueCat, Inc. (in-app purchase management) — hosted in the United States; transfers governed by standard contractual clauses. Payments themselves are processed by Apple (App Store) and Google (Google Play).
- Apple and Google (optional “Sign in with Apple” and “Sign in with Google”) — under their privacy policies.
- Resend, Inc. (sending email sign-in codes) — United States; transfers governed by standard contractual clauses.
- Hostinger (hosting of this website, server in France).
Retention periods
Game data is kept as long as your account exists. An account with no activity for 24 months may be deleted. Game invitations expire after 10 minutes. When the account is deleted, the data is erased within 30 days (backups included).
Minors
PANIK TOWN is intended for players aged 13 and over (rated 13+ on the App Store and Google Play); it is not directed at children under 13 and we do not knowingly collect their data. If you are under 15, ask a parent before accepting analytics or personalized ads in the consent form, and before signing in with an account. A parent can write to us at any time to have a minor’s data deleted. Chat is limited to accepted friends and can be cut off by blocking a player.
Your rights
Access, rectification, erasure, restriction, objection and portability: write to team@paniktown.com with your player code. You can also delete your account (see Delete my account) and lodge a complaint with the CNIL, the French data protection authority (cnil.fr).
This website
This website sets no advertising cookies. It uses Google Analytics (Google Ireland Ltd) to measure its audience (page views, referrer, device, approximate country), only if you accept in the banner shown on your first visit (Consent Mode v2: without your consent, no Analytics cookie is set). Detailed data is kept for 2 months. You can change your mind at any time through the “Cookies” link at the bottom of every page.