Legal

Privacy Policy

Last updated: 16 May 2026 · Effective worldwide

1. Who we are

This policy describes how Ghosts Games, a Dutch sole proprietorship (eenmanszaak) in the Netherlands (“Ghosts Games”, “we”, “us”, “our”), processes personal information when you use the Ghosts Deal mobile application (iOS and Android), our real-time game services, and the ghostsdeal.com website (together, the “Service”).

Ghosts Games is registered in the Netherlands with the Chamber of Commerce (KvK). We do not publish a residential or street address on this website. Statutory business details (including the KvK number, once registered) are available in the public KvK trade register. For correspondence, use legal@ghostsdeal.com. We act as the data controller for personal data described here.

Data protection contact: dpo@ghostsdeal.com (Data Protection Officer / privacy requests).

2. Scope and audience

The Service is offered internationally. This policy applies to all users unless a separate notice applies to a specific feature or territory. Where local law grants you additional rights, those rights apply in addition to this policy.

The Service is a social entertainment product with simulated card play and virtual currency only (see our Terms & Conditions). It is intended for adults aged 18 and over only.

3. Information we collect

3.1 You provide directly

• Account data: email address, display name, password (stored hashed on our systems), session tokens.
• Profile data: avatar, country/region selection, date of birth (where provided), friend-request preferences.
• Guest play: limited local/session identifiers if you use the app without a full account (features may be restricted).
• Social features: friend connections, invitations, in-game quick-chat phrases you send, and support messages submitted in-app or by email.
• Contacts (optional): if you use “invite from contacts”, we process email addresses you select from your device address book to send invitations or friend requests. We do not upload your full contact list to our servers unless you explicitly select contacts to invite.
• Purchases: we receive purchase receipts and product identifiers from Apple or Google; we do not receive your full payment card number.

3.2 Collected automatically

• Gameplay and economy: match participation, results, virtual coin/diamond balances, leaderboard placement, room codes, anti-cheat signals.
• Device and app data: device model, operating system, app version, language, IP address, coarse network/connection events.
• Diagnostics: crash logs and error reports (e.g. via Firebase Crashlytics).
• Push notifications: device push tokens and your in-app notification category preferences.
• Advertising: advertising identifiers and ad interaction data when you view rewarded or other ads (e.g. via Google AdMob), subject to your device consent settings (such as Apple ATT on iOS and Google UMP/consent on Android, where required).
• Website technical data: when you visit ghostsdeal.com, standard server logs (IP, user-agent, pages requested). We do not use third-party analytics scripts on the marketing site.

3.3 We do not collect

• Precise GPS location (we do not request location permission for core play).
• Government ID, bank account, or payment card numbers (stores handle payments).
• Health, biometric, or special-category data, except date of birth where you choose to provide it for age-related features.

4. How we use your information

• Provide accounts, authentication, matchmaking, real-time games, friends, leaderboards, and virtual economy features.
• Operate computer-controlled opponents (“bots”) where needed to fill tables or maintain fair pacing.
• Process in-app purchases and grant virtual items through Apple App Store and Google Play.
• Deliver push notifications you have not disabled, and send transactional emails (e.g. password reset, friend invites).
• Show advertising (including rewarded ads) where enabled, respecting platform consent requirements.
• Detect fraud, cheating, collusion, and abuse; enforce our Terms.
• Improve stability and security through logs and crash reporting.
• Respond to support requests and legal obligations.
• Send marketing communications only where you have opted in (if offered).

5. Lawful bases (EEA, UK, and similar laws)

Where GDPR or UK GDPR applies, we rely on:

• Contract — to provide the Service you request (account, play, purchases).
• Legitimate interests — security, anti-cheat, service improvement, and non-intrusive analytics, balanced against your rights.
• Consent — optional marketing, certain advertising identifiers where required, and contacts access on your device.
• Legal obligation — tax, accounting, regulatory requests, and responding to lawful authority demands.

6. Advertising and cookies

6.1 In-app advertising

We use Google AdMob (and related Google advertising technology) to show ads, including rewarded ads that grant in-game benefits. Ad partners may process advertising IDs, device data, and ad interaction data under their own policies. Where law requires consent (notably in the EEA/UK), we use platform tools (e.g. Apple App Tracking Transparency, Google User Messaging Platform) before serving personalized ads.

6.2 Website

Our marketing site is largely static. We do not set first-party advertising cookies. We load fonts from Google Fonts; your browser may connect to Google servers (IP address and technical data). You can block this via browser or network settings. See Google’s privacy policy for their processing.

7. Sharing and subprocessors

We do not sell your personal information. We share data only with service providers that process it on our instructions, under contracts with confidentiality and security obligations:

• Supabase, Inc. — authentication, database, and file storage.
• Google LLC (Firebase Crashlytics, Firebase Cloud Messaging) — crash reporting and push delivery.
• Google LLC (AdMob) — in-app advertising.
• Apple Inc. — App Store distribution and in-app purchases (iOS).
• Google LLC (Google Play) — app distribution and in-app purchases (Android).
• Vercel Inc. (or equivalent) — hosting and content delivery for ghostsdeal.com.
• Cloud hosting providers — our game API and real-time services (infrastructure region depends on deployment configuration).
• Email delivery — transactional email via SMTP or a mail API provider configured by us.

We may also disclose information if required by law, to protect rights and safety, or in connection with a merger or acquisition (with notice where required).

A current sub-processor summary is also on our GDPR Compliance page.

8. International transfers

We and our processors may process data in the Netherlands, the European Economic Area, the United States, and other countries. Where personal data is transferred from the EEA, UK, or Switzerland to countries without an adequacy decision, we use appropriate safeguards such as the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, and supplementary measures where needed.

9. Retention

• Account and profile: for the life of your account, then up to 24 months after deletion for fraud prevention, disputes, backups, and legal obligations (unless a longer period is required by law).
• Gameplay logs and anti-cheat records: typically up to 12 months.
• Crash/diagnostic logs: typically up to 90 days (aggregated retention may be longer).
• Support messages: up to 36 months after resolution.
• Store purchase records: as required for tax and accounting (often 7 years where applicable).
• Marketing consents: until you withdraw consent plus a short proof record.

We delete or anonymize data when retention periods end, unless further retention is legally required.

10. Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, port, restrict, or object to certain processing, and to withdraw consent. Contact dpo@ghostsdeal.com with the email on your account and the right you wish to exercise. We respond within the time required by applicable law (typically one month under GDPR).

10.1 Account deletion and data export

You may request account deletion or a copy of your data by emailing dpo@ghostsdeal.com or support@ghostsdeal.com from your registered email. We verify ownership before acting. Deletion removes or anonymizes personal data except where we must retain limited records for legal, security, or billing purposes.

10.2 EEA / UK supervisory authorities

You may lodge a complaint with your local authority, for example the Dutch Autoriteit Persoonsgegevens (AP) or the UK ICO.

10.3 United States (including California)

Where US state privacy laws apply (e.g. California CPRA), you may have rights to know, access, correct, and delete personal information, and to opt out of “sale” or “sharing” for cross-context behavioral advertising. We do not sell personal information for money. AdMob may involve “sharing” under California law; you can limit ad tracking in device settings and through in-app consent flows where shown. Submit requests to dpo@ghostsdeal.com. We will not discriminate against you for exercising privacy rights.

10.4 Other regions

Users in Brazil (LGPD), Canada (PIPEDA), Australia, and other jurisdictions may have similar rights. Contact us at dpo@ghostsdeal.com and we will respond under applicable local law.

See also our dedicated GDPR Compliance page.

11. Security

We use technical and organizational measures including TLS encryption in transit, access controls, hashed passwords, and monitoring. No method of transmission or storage is 100% secure. Report suspected vulnerabilities to security@ghostsdeal.com.

12. Children

The Service is 18+ only. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided data, contact dpo@ghostsdeal.com and we will take steps to delete the account and data.

13. Automated decisions

We use automated systems for matchmaking, anti-cheat, and bot behaviour. These do not produce legal or similarly significant effects on you in the GDPR sense. Human review is available for account sanctions on request via support.

14. Changes to this policy

We may update this policy from time to time. Material changes will be posted here with an updated date and, where appropriate, notified in the app or by email. Continued use after the effective date constitutes acceptance where permitted by law.

15. Contact

Ghosts Games (eenmanszaak, Netherlands)
Privacy / DPO: dpo@ghostsdeal.com
Legal: legal@ghostsdeal.com
Support: support@ghostsdeal.com