Girostella Privacy Policy

Last updated: October 25, 2026

This Privacy Policy describes the processing of personal data carried out through the Girostella mobile application (the “App”), in accordance with Regulation (EU) 2016/679 (the “GDPR”) and other applicable data protection laws.

1. Data Controller

The Data Controller is Girostella.

Email: alessandro_penna@icloud.com

2. Data Processed by the App

Girostella is designed in accordance with the principle of data minimization.

The App does not require users to create a proprietary account and does not use servers operated by the Data Controller to collect gameplay data. It does not integrate standalone analytics SDKs or third-party crash reporting services, without prejudice to the processing of technical and diagnostic data by the advertising services described in Section 6.

The App does not request access to GPS location, camera, microphone, contacts, photos, calendar, or health data, and does not require users to provide their name, address, telephone number, or email address to play the game.

During use, information necessary for the operation of the game is stored locally on the device, including scores, high scores, progress, unlocked or selected cosmetic items, audio and haptic preferences, information about previously encountered power-ups, technical identifiers of transactions already processed, and scores that may be awaiting synchronization with Game Center.

This data remains within the App’s private storage area on the device and is not transmitted to servers operated by the Data Controller. It is normally deleted when the App is uninstalled, except for any copies retained in device backups and information independently stored by Apple services.

The App also uses Google Mobile Ads and Google User Messaging Platform, which may process technical information, identifiers, advertising data, and information about App usage, as described in Section 6.

The Data Controller does not maintain its own database of players’ IP addresses. However, external service providers used by the App may receive IP addresses and other technical information necessary to provide their respective services.

3. Game Center

Girostella uses Apple Game Center for optional player authentication, leaderboard management, score submission and synchronization, and the recognition of in-game achievements.

Through GameKit, the App may temporarily receive information necessary for the operation of the service, including Game Center identifiers, scores, and information used to display leaderboards.

Nicknames, avatars, and other Game Center profile information may be displayed according to the player’s settings and the features provided by Apple, but are not stored on servers operated by the Data Controller.

Leaderboards and Gameplay Information

Girostella uses Apple Game Center to manage and synchronize leaderboards. For this purpose, the App transmits players’ scores and certain information associated with in-game items to Apple, as necessary to correctly display leaderboards and verify the integrity of results.

This information does not include personal identification details and may be made visible to other players through Game Center features.

Local Storage of Other Players’ Information

To provide a more consistent display of spacecraft in leaderboards, Girostella stores certain gameplay information relating to other players encountered through Game Center on the device.

This information includes codes relating to spacecraft, trails, and collections, the technical context associated with a score, and the date of the game session.

Each record is associated with a pseudonymous key generated from the Game Center identifier using a cryptographic function and a locally generated random value. The original Game Center identifier and the player’s name are not stored in the cache.

The cache contains a maximum of 25,000 records and has no fixed retention period. When this limit is exceeded, the oldest entries are removed first. The data is normally deleted when the App is uninstalled, except for any copies retained in device backups.

This information is not transmitted to the Data Controller, Google, or any other parties, and is not used for advertising, profiling, or analytics.

The processing is based on the Data Controller’s legitimate interest in ensuring a consistent display of gameplay information in leaderboards, pursuant to Article 6(1)(f) of the GDPR.

Friends and Game Center Achievements

Girostella allows players to recognize their Game Center friends appearing in leaderboards through a dedicated visual indicator.

For this purpose, the App uses information provided by the friends-only leaderboard, without requesting access to the device’s address book or independently obtaining a complete list of contacts.

The identifiers needed for comparison are used exclusively in memory, for a maximum of five minutes, and are not permanently stored.

The App also uses Game Center achievements, including the Founder achievement, to record the completion of certain milestones and allow associated rewards to be restored through the same Game Center account.

Scores achieved offline may be temporarily stored on the device until they are synchronized.

Apple processes data managed through Game Center in accordance with its own Privacy Policy and the terms applicable to the service.

Use of Game Center is optional. Without authentication, certain features, including leaderboards, score synchronization, and account-linked achievements, may not be available.

4. In-App Purchases

Any in-app purchases are managed through StoreKit 2 and the App Store.

Girostella offers non-consumable purchases relating to cosmetic game items, such as spacecraft and trails.

The Data Controller does not receive or store credit card numbers, bank account details, Apple Account credentials, or complete payment method information.

The App receives the technical information necessary to verify and manage purchases, including product identifiers, transaction outcomes, and technical identifiers associated with transactions.

Information necessary to manage purchased items and prevent duplicate transaction processing may be stored locally on the device.

Payments, billing, refunds, and purchase history are managed by Apple in accordance with its own terms and privacy policies.

5. Update Checks

At launch, Girostella may download a public configuration file from GitHub Pages containing information about the minimum supported App version and certain leaderboard settings.

The request does not include scores, progress, Game Center identifiers, or other personal data supplied by the App.

As is normally the case with Internet communications, the service provider may receive the device’s IP address and technical information relating to the request. Any processing and retention of such information is governed by the provider’s own terms and privacy policies.

The Data Controller does not use this connection to collect gameplay data, perform profiling, or individually monitor users.

Girostella is a free game that uses Google Mobile Ads (AdMob) to display rewarded video advertisements.

Advertisements are offered exclusively when a player, after losing a game, chooses to watch a video to receive a second chance and resume gameplay.

The App does not display banner advertisements or mandatory video advertisements during normal gameplay.

Data Processed by Advertising Services

For the delivery, measurement, security, and improvement of advertising services, Google Mobile Ads may collect and process the following information, according to its own procedures and purposes:

IP addresses and approximate geographic location information inferred from the IP address;
Device, App, or developer-scoped identifiers;
Information about advertisements displayed and interactions with video advertisements;
Data relating to App usage and interactions;
Diagnostic information, crash logs, and performance data.

Some information may be associated with technical identifiers and used by Google and the advertising providers involved, in accordance with their respective terms and applicable privacy choices.

The Data Controller does not directly receive an individual-level database of the data collected by Google through its advertising SDKs.

For players located in the European Economic Area, the United Kingdom, and Switzerland, Girostella uses Google User Messaging Platform (UMP) to display, when required, a notice explaining the purposes of data processing and the advertising providers involved.

Through this notice, players can give consent, refuse consent, or manage the available individual options.

Preferences can subsequently be changed through Settings → Ad Preferences, when this feature is required and made available by the consent management system.

Advertising providers may process certain data on the basis of consent or, where applicable and in compliance with the law, other legal bases, including legitimate interests. The purposes, providers, and corresponding options are described in Google’s consent message.

Refusing consent does not prevent players from using the game. However, the availability of rewarded video advertisements may vary depending on the preferences expressed, applicable regulations, and ad availability.

For further information about data processing carried out by advertising services, please refer to:

7. Support

If a user voluntarily contacts the Data Controller by email, the following information may be processed: the user’s email address, any name provided, the content of the request, any attachments, and technical information supplied by the user.

This data is used exclusively to respond to the request, provide support, handle any disputes, or comply with legal obligations.

Users are encouraged not to submit personal data that is unnecessary for handling their requests.

8. Purposes and Legal Bases for Processing

Purpose	Legal Basis
Operation of the App and storage of game progress	Performance of the requested service, Article 6(1)(b) GDPR
Game Center, leaderboards, achievements, and synchronization	Performance of the requested service, Article 6(1)(b) GDPR
Local pseudonymous storage of other players’ information	Legitimate interest in accurately displaying leaderboards, Article 6(1)(f) GDPR
Management of in-app purchases	Performance of a contract, Article 6(1)(b) GDPR
Prevention of errors, duplicate processing, and abuse	Legitimate interest in the security and proper operation of the service, Article 6(1)(f) GDPR
Verification of App version and settings	Performance of the requested service, Article 6(1)(b) GDPR
Advertising-related processing requiring consent	Consent of the data subject, Article 6(1)(a) GDPR
Other advertising-related processing permitted by applicable law	Legal bases identified by the providers, including, where applicable, legitimate interests under Article 6(1)(f) GDPR
User support	Performance of the service or legitimate interest in handling requests, Articles 6(1)(b) and 6(1)(f) GDPR
Compliance with legal obligations	Legal obligation, Article 6(1)(c) GDPR
Establishment, exercise, or defense of legal claims	Legitimate interest, Article 6(1)(f) GDPR

Where processing is based on consent, consent may be withdrawn using the mechanisms provided by the preference management service, without affecting the lawfulness of processing carried out before withdrawal.

Where processing is based on legitimate interests, the data subject may exercise the right to object in the cases provided for under Article 21 of the GDPR.

9. Data Recipients

The Data Controller does not directly sell players’ personal data or maintain a database intended for their commercial sale.

Data may be processed, where necessary, by:

Apple, in connection with Game Center, the App Store, and StoreKit services;
Google, through Google Mobile Ads and Google User Messaging Platform, and any advertising providers involved in delivering advertisements;
The provider of GitHub Pages, in connection with requests required to download the public configuration file;
The email service provider used for support;
Professional advisers or public authorities where required by law.

The information stored in the local leaderboard cache is not disclosed by the Data Controller to these recipients.

Processing carried out through external services is subject to their respective privacy policies and the conditions required by applicable law.

10. International Data Transfers

The Data Controller does not operate its own servers for storing gameplay data.

The use of services provided by Apple, Google, and GitHub may involve the processing of personal data outside the European Economic Area.

Such processing is subject to the terms, privacy policies, and safeguards adopted by the respective providers, in compliance with applicable provisions governing international transfers of personal data.

Information concerning international transfers and any applicable safeguards may be requested from the Data Controller or consulted in the privacy policies of the relevant providers.

11. Data Retention

Progress, preferences, and other data stored exclusively on the device are normally retained until the App is uninstalled, except for any copies retained in device backups.

The local cache of other players’ information contains a maximum of 25,000 records, with no predetermined retention period. When this limit is exceeded, the oldest entries are removed first. The data is normally deleted when the App is uninstalled, except for any copies retained in device backups.

Scores awaiting synchronization are retained until synchronization, their possible expiration, or the deletion of the App.

Advertising consent preferences are managed through UMP and its related systems, according to the applicable retention criteria and the providers’ terms.

Data collected by advertising services is retained by Google and any other providers involved in accordance with their respective retention policies and applicable purposes.

Support requests are retained for the time necessary to handle them and, as a general rule, for no longer than 24 months, unless legal obligations or the need to protect the Data Controller’s rights require otherwise.

Any administrative or accounting documentation is retained for the periods required by applicable law.

Data independently managed by Apple and other external services is retained according to the criteria established by the respective providers.

12. Data Subject Rights

In the circumstances provided for under Articles 15–22 of the GDPR, data subjects may exercise their rights of access, rectification, erasure, restriction of processing, objection, and data portability.

Requests may be sent to the email address provided in the Data Controller section.

Data stored exclusively within the App’s local storage area cannot be accessed remotely by the Data Controller. Uninstalling the App normally results in the deletion of data stored in its local container, except for any copies retained in device backups.

Requests concerning pseudonymous information relating to other players and stored locally on users’ devices will be assessed in light of the technical possibilities for identifying and modifying the relevant data, in accordance with the rights provided for under applicable law.

Advertising consent preferences can be managed through the Ad Preferences feature available in the App’s settings, when applicable.

For data independently managed by Game Center, the App Store, or other Apple services, data subjects may use the tools provided by Apple. Similarly, for processing carried out by advertising providers, the relevant privacy management tools may be used.

Data subjects also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) pursuant to Article 77 of the GDPR.

13. Minors

Girostella does not require users to provide personal identification details and does not offer chat, messaging, or features that allow users to freely publish content.

The use of Game Center, the App Store, and purchases by minors is subject to Apple Account settings, family features, and restrictions provided by Apple.

Any processing of minors’ advertising data is subject to the restrictions established by applicable law and the settings adopted by the advertising services used by the App.

If the Data Controller receives personal data relating to a minor through support that is not necessary to handle the request, such data will be deleted when no other legitimate grounds for retaining it exist.

14. Security, Profiling, and Automated Decision-Making

The App’s local data is stored within the sandbox environment provided by iOS.

Where applicable, the App uses pseudonymous identifiers to limit the storage of information directly attributable to other players.

Communications with Game Center and the App Store use the frameworks and security systems provided by Apple.

The Data Controller adopts reasonable and proportionate measures to protect personal data against unauthorized access, loss, or alteration.

Girostella does not independently create advertising profiles of players and does not carry out automated decision-making that produces legal or similarly significant effects on users within the meaning of Article 22 of the GDPR.

Advertising providers may process data for the selection, personalization, or measurement of advertisements, according to the applicable purposes and legal bases.

15. Changes to This Privacy Policy and Contact Information

This Privacy Policy may be updated in the event of changes to the App, the services used, or applicable law.

The updated version will be published at the same address and will indicate its date of revision. In the event of significant changes, a notice may be provided within the App.

For information, requests, or to exercise rights relating to the protection of personal data, please contact:

alessandro_penna@icloud.com