CognyQuest
Play free

Privacy policy

Last updated 2026-09-28

This policy explains what personal data CognyQuest ("we") processes when you play Spot Royale or use cognyquest.com, why, and the choices you have. The data controller is CognyQuest. Contact: privacy@cognyquest.com.

1. Data from the game

  • Account. A player ID created when you first play (guest). If you link Google or Apple, we receive the account identifier and, where the provider shares it, your email address. We never receive your password.
  • Profile and progress. Your chosen player name, trophies, arena, cards and levels, coins, gems, chests, Spot Pass progress, friends list, match results and settings stored on our servers.
  • Purchases. When you buy something, Apple or Google processes the payment. We receive a transaction record (product, time, transaction ID, store receipt) to verify and credit it. We never see your card details.
  • Gameplay and anti-cheat signals. Match timings, taps counted as right or wrong, and similar signals, used to settle matches and detect cheating.
  • Analytics and diagnostics. Through Google Firebase Analytics and Crashlytics: app events (for example tutorial completed, match started), device model, OS and app version, a pseudonymous app-instance ID, approximate region derived from IP address, and crash reports.
  • Notifications. If you allow notifications, reminders are scheduled on your device. If push notifications are enabled, a device token is stored so we can send them. You can turn them off in the game or in your phone settings.
  • Technical data. Your IP address is processed by our servers and content-delivery providers to deliver the game and protect it from abuse.

Spot Royale does not currently include third-party advertising SDKs. If that changes, this policy will be updated before the change ships.

2. Data from this website

  • Support requests. What you enter in our forms (email, player ID, device, message) and a one-way hashed form of your IP address used only for rate-limiting.
  • Bot protection. Forms use Cloudflare Turnstile, which processes browser signals to tell people from bots.
  • Statistics. Cloudflare Web Analytics counts page views without cookies and without identifying you.
  • No tracking cookies. This site sets no cookies. It stores your light/dark theme choice in your own browser.

3. Why we use it (legal bases)

  • To provide the game you asked for (contract): your account, progress, matches, purchases and support.
  • To keep the game fair and secure (legitimate interests): anti-cheat, fraud prevention, abuse and rate limiting.
  • To improve the game (legitimate interests, or consent where the law requires it): analytics and crash reports.
  • To meet legal obligations: tax and accounting records of purchases, responding to lawful requests.

We do not sell your personal data and we do not use it for third-party advertising.

4. Who we share it with

Only service providers that process data for us under contract:

  • Google (Firebase) — authentication, database, cloud functions, remote configuration, analytics, crash reporting.
  • Apple and Google — sign-in (if you choose it), payments and purchase verification.
  • Cloudflare — content delivery, matchmaking servers, this website, its support inbox and bot protection.

We may also disclose data if required by law, or to protect players and the game from fraud or abuse. Some providers process data outside your country (including the United States); where required we rely on safeguards such as the EU Standard Contractual Clauses.

5. How long we keep it

  • Account and progress: until you delete your account. Deletion removes your profile, progress, inventory and friend links; a minimal deletion record is kept for 30 days to confirm it completed.
  • Match records: results of matches you played also belong to your opponents, so they are kept — but when you delete your account, your identity in them is replaced by an anonymous placeholder.
  • Purchase records: as long as tax and accounting laws require (typically up to 10 years), even after account deletion.
  • Support requests: up to 24 months after your request is closed.
  • Analytics: according to the retention set in Firebase (we use the shortest practical setting); crash reports up to 90 days.
  • Security logs: up to 30 days.

6. Your rights

Depending on where you live, you can ask to access, correct, delete or export your data, object to or restrict some processing, and withdraw consent. Delete your account any time in the game (Settings → Account → Delete Account) or on this site. For anything else, email privacy@cognyquest.com with your player ID. We answer within one month. You can also complain to your local data-protection authority.

7. Children

Spot Royale is not directed at children under 13, and we do not knowingly collect their personal data. If you believe a child under 13 has given us personal data, contact privacy@cognyquest.com and we will delete it.

8. Security

Data is encrypted in transit, access is restricted to what each service needs, and all game economy changes happen on our servers. No system is perfectly secure; report vulnerabilities to security@cognyquest.com.

9. Changes

We will update this page when our practices change and, for significant changes, tell you in the game.