1. Who We Are (Data Controller)
This Privacy Policy applies to the mobile game Stacko, published by:
Registered address: Via Colombara, 7, 36030, Sarcedo, (VI), Italy
VAT / P.IVA: IT04223550247
Privacy contact email: info@digitalassetgroup.it
We act as the data controller within the meaning of Regulation (EU) 2016/679 (General Data Protection Regulation — GDPR). We are responsible for determining how and why personal data is processed in connection with the Stacko app.
We have not appointed a Data Protection Officer (DPO), as our processing activities do not meet the criteria that make appointment mandatory under Article 37 GDPR.
2. Scope and App Description
Stacko is a casual stacking game available for iOS and Android (bundle ID:
io.ukkio.stacko). It is a single-player offline game that does not require
account registration, login, or the submission of any personal information by the user.
However, certain technical data is automatically collected by the third-party services integrated into the app (see Section 5) in order to:
- Monitor app stability and fix crashes;
- Understand general usage patterns to improve the experience;
- Display advertisements to support free access to the game;
- Enable optional global leaderboard functionality.
This policy applies to all users of Stacko on iOS and Android worldwide. Users in the European Economic Area (EEA), the United Kingdom, and Switzerland benefit from additional rights described in Section 9.
3. Data We Collect
3.1 Data stored locally on your device only
The following data is saved exclusively on your device using the operating system's local storage (SharedPreferences). It is never transmitted to our servers.
| Data | Purpose | Where stored |
|---|---|---|
| High score | Display personal best | Device only |
| Total games played | Statistics display | Device only |
| Total perfect placements | Statistics display | Device only |
| Death count | Ad frequency logic (shown every 4 deaths) | Device only |
| Audio mute preference | Remember sound setting | Device only |
| Device OS version | Enable enhanced particle effects on capable hardware | Device only — never transmitted |
All locally stored data is deleted when you uninstall the app.
3.2 Data collected automatically by third-party services
When you use Stacko, the following technical data may be automatically collected by integrated third-party SDKs:
| Data type | Collected by | Purpose |
|---|---|---|
| App events (game start, game over, score, session duration, perfects count) | Firebase Analytics | Usage analytics to improve the game |
| Randomly generated session ID (per-game, not linked to any identity) | Firebase Analytics | Correlate events within a single game session |
| App and device information (OS version, app version, device model, language) | Firebase Analytics, Firebase Crashlytics | Analytics segmentation and crash diagnosis |
| Crash reports and stack traces (including app state at time of crash) | Firebase Crashlytics | Identify and fix app bugs |
| Performance traces (game session duration, frame rate) | Firebase Performance | Identify performance bottlenecks |
| Device advertising identifier (IDFA on iOS, GAID on Android), IP address, approximate location | Google AdMob | Serve advertisements; ad measurement and fraud prevention |
| Leaderboard score and public game profile (only if signed in to Game Center / Google Play Games) | Apple Game Center / Google Play Games | Global leaderboard functionality |
3.3 Data you voluntarily share (score sharing)
When you use the in-app share button on the Game Over screen, the app generates a screenshot image containing your score and opens your device's native share sheet. You decide which app or person receives this content. We do not receive or store the shared image or the recipient's identity.
4. Legal Basis for Processing (GDPR Art. 6)
Where we (or our third-party processors) process personal data, we rely on the following legal bases under Article 6 of the GDPR:
| Processing activity | Legal basis | Explanation |
|---|---|---|
| Firebase Analytics (gameplay events) | Legitimate interest (Art. 6(1)(f)) | We have a legitimate interest in understanding how the game is played in order to improve it. Data is aggregated and pseudonymous. |
| Firebase Crashlytics (crash reporting) | Legitimate interest (Art. 6(1)(f)) | We have a legitimate interest in detecting and fixing technical faults to ensure a stable product. |
| Firebase Performance (performance monitoring) | Legitimate interest (Art. 6(1)(f)) | We have a legitimate interest in identifying performance issues that degrade the user experience. |
| Google AdMob (advertising) | Consent (Art. 6(1)(a)) for personalized ads in the EEA/UK; Legitimate interest for contextual/non-personalized ads | In the EEA and UK, personalized advertising requires valid consent under GDPR and the ePrivacy Directive. The app implements Google's User Messaging Platform (UMP) as its Consent Management Platform: a consent form is shown on first launch to users in the EEA/UK, and preferences can be updated at any time via the Privacy link in the app's main screen. |
| Apple Game Center / Google Play Games (leaderboard) | Legitimate interest (Art. 6(1)(f)) | The leaderboard feature is optional and only activated if the user is already signed in to their platform account. Score submission serves the user's interest in competing globally. |
Where we rely on legitimate interest, we have conducted a balancing test and concluded that our interests do not override the fundamental rights and freedoms of data subjects, given the pseudonymous nature of the data, the limited scope of the game context, and the availability of opt-out mechanisms.
5. Third-Party Services and Data Processors
We use the following third-party services. Each provider acts as an independent data controller (or a processor on our behalf, as applicable) and is subject to its own privacy policy. We encourage you to review them.
5.1 Google / Firebase (Analytics, Crashlytics, Performance)
Data collected: App events, device information, crash reports, performance traces
Data center location: USA (with EU Standard Contractual Clauses)
Opt-out: Google Analytics Opt-out | Firebase Privacy
5.2 Google AdMob (Advertising)
Data collected: Advertising identifier (IDFA/GAID), device info, IP address, ad interaction data
Ad type: Interstitial full-screen ads (shown approximately every 4 deaths)
Consent (EEA/UK): Managed via Google UMP — a consent form is shown on first launch; preferences can be updated via the Privacy link in the app's main screen
Opt-out (iOS): Settings → Privacy & Security → Tracking → disable "Allow Apps to Request to Track"
Opt-out (Android): Settings → Google → Ads → "Delete advertising ID"
Privacy policy: policies.google.com/privacy
5.3 Apple Game Center (iOS leaderboard)
Data collected: Apple ID, leaderboard score
Condition: Only if you are signed in to Game Center on your device
Privacy policy: apple.com/legal/privacy
5.4 Google Play Games (Android leaderboard)
Data collected: Google account display name, leaderboard score
Condition: Only if you are signed in to Google Play Games on your device
Privacy policy: policies.google.com/privacy
6. International Data Transfers
Some of the third-party services listed above (primarily Google/Firebase) transfer data to servers located outside the European Economic Area, including the United States.
Google LLC has self-certified under the EU–U.S. Data Privacy Framework and provides appropriate safeguards through Standard Contractual Clauses (SCCs) approved by the European Commission (Decision 2021/914). For more information, see: business.safety.google/gdpr/.
We do not directly transfer personal data to countries outside the EEA ourselves.
7. Data Retention
| Data / Service | Retention period |
|---|---|
| Local game data (score, preferences) — stored on your device | Until you uninstall the app |
| Firebase Analytics event data | 14 months (Google's default retention; configurable in Firebase console) |
| Firebase Crashlytics crash reports | 90 days |
| Firebase Performance traces | 30 days (raw data); aggregated data retained longer by Google |
| Google AdMob interaction data | Per Google's advertising data retention policy (varies by data type, typically 18 months) |
| Game Center / Google Play Games scores | Per Apple/Google's account data retention policies |
8. Children's Privacy
Stacko is rated 12+ (PEGI 3 equivalent) and is not directed to children under the age of 13. We do not knowingly collect personal data from children under 13.
The app does not require account registration and does not display age gates. If you are a parent or guardian and believe your child under 13 has been exposed to data collection through this app, please contact us at info@digitalassetgroup.it. We will take steps to remove any applicable data.
9. Your Rights under GDPR
If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, you have the following rights in relation to your personal data:
| Right | Description |
|---|---|
| Access (Art. 15) | Request a copy of the personal data we hold about you. |
| Rectification (Art. 16) | Request correction of inaccurate personal data. |
| Erasure / Right to be Forgotten (Art. 17) | Request deletion of your personal data, subject to our legal obligations. |
| Restriction (Art. 18) | Request that we limit processing of your data in certain circumstances. |
| Portability (Art. 20) | Receive your data in a structured, machine-readable format. |
| Objection (Art. 21) | Object to processing based on legitimate interest, including analytics. |
| Withdraw Consent (Art. 7(3)) | Withdraw or update consent for advertising at any time via the Privacy link in the app's main screen (EEA/UK only), or via your device's ad settings (see Section 5.2). |
| Lodge a complaint | File a complaint with the Italian data protection authority (Garante per la protezione dei dati personali, garanteprivacy.it) or your local supervisory authority. |
To exercise your rights, contact us at info@digitalassetgroup.it. We will respond within 30 days, as required by Article 12 GDPR. We may need to verify your identity before processing your request.
Practical opt-out options
- Analytics: Reset or disable your advertising ID in your device settings. On iOS, go to Settings → Privacy & Security → Tracking and disable tracking. On Android, go to Settings → Google → Ads → "Delete advertising ID".
- Ad consent (EEA/UK): Use the Privacy link at the bottom of the app's main screen to open the consent management form and update your preferences at any time.
- Ads (iOS): Deny the App Tracking Transparency (ATT) prompt when shown. Non-personalized ads will be displayed instead.
- Leaderboard: Sign out of Game Center (iOS) or Google Play Games (Android) to prevent score submission.
- Local data: Uninstall the app to delete all locally stored data.
10. Security
We take appropriate technical and organizational measures to protect the data processed in connection with Stacko. These include:
- Use of reputable third-party SDKs (Google Firebase, AdMob) with industry-standard encryption in transit (TLS/HTTPS) and at rest;
- No storage of personal data on our own servers;
- Minimizing data collection to what is strictly necessary for stated purposes.
However, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security of data transmitted over the internet.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or app features. When we make material changes, we will update the "Last updated" date at the top of this page. Where required by applicable law, we will provide more prominent notice (such as an in-app notification).
We encourage you to review this page periodically. Continued use of the app after the updated policy takes effect constitutes your acknowledgement of the changes.
The current version is always available at: [https://yourwebsite.com/stacko/privacy-policy]
12. Contact Us
For any questions, requests, or concerns regarding this Privacy Policy or the handling of your personal data, please contact:
Attn: Privacy / Data Protection
Via Colombara, 7, 36030, Sarcedo, (VI), Italy
Email: info@digitalassetgroup.it
We aim to respond to all privacy-related inquiries within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the Italian supervisory authority:
Piazza Venezia 11, 00187 Roma, Italy
www.garanteprivacy.it