Privacy Policy

Serpent Drift is published by Daniel Peter Nagy, an independent self-employed developer based in Germany, operating under the name “ChillScale Games”. Daniel Peter Nagy is the controller responsible for the processing of your data. For any privacy question or request, write to info@danielnagy.dev or use the contact form on this website. The postal address is in the Impressum.

Contact form: Send us a message

We keep data collection to what the game needs to work. Specifically:

• Google Play Games sign-in (optional): if you sign in, we receive your Play Games player ID and your display name. We use them to show you on the leaderboards; Google uses your account for your cloud save and achievements.
• Cloud save: your progress and settings are stored as a Google Play “Saved Game” (Snapshot) in your own Google account, so you can continue on another device. Google manages this data; it does not reach our server.
• Leaderboard submissions: only players signed in to Google Play Games can submit runs. When you finish a leaderboard level, the game uploads your player ID and display name, the level identifier and a fingerprint of the level’s content, the game version, your completion time, stars and split times, and a recording of your inputs during the run. The recording also holds timing measurements of the run: its real elapsed time, the time spent paused, the number of pauses, and the moment the run started according to your device clock (this ties a run to a day for the daily board). It contains no location and nothing else from your device. Our server replays the recording to verify the run (anti-cheat) and computes statistics about the inputs, such as how even the frame timing was. A run whose statistics look unusual is marked for manual review; the mark is visible only to us, and it never removes a run automatically. We also store when your player profile was created and when it was last used.
• Daily level: a verified run on the day’s level, played and submitted on that day, is also entered on that day’s board (date, player, time and stars). Past days’ boards stay viewable.
• Guest play: if you do not sign in, the game creates a random identifier and keeps it on your device. It only lets our server recognise your device (for example, to export or delete your data), and it is not linked to your identity. Guests can play and browse the leaderboards, but cannot place runs on them.
• Advertising: the game shows only rewarded ads, which you choose to watch (for example to refill lives). There are no banner or interstitial ads, and after you buy Remove Ads no ads are shown at all. Ads are served by Google AdMob, which may process your device’s advertising ID, your IP address and related data to deliver, limit and measure ads and, only with your consent, to personalise them.
• Purchases: the only purchase in the game, Remove Ads, is processed entirely by Google Play. No payment details reach us; the game only learns from Google Play whether you own the purchase, and remembers that on your device. If a purchase is refunded or reversed, the benefit is removed.
• Notifications (optional): if you turn on the life refill notification, the game schedules a local notification on your device. Nothing is sent to us for this.
• Data on your device: your settings, progress, stars, personal-best times, the guest ID, your consent choices, and the input recordings of your personal bests are kept in the app’s storage on your device. Android’s automatic cloud backup (Google Drive) excludes this data; a phone-to-phone transfer that you start yourself carries it over. Uninstalling the app deletes it.
• Contact form: if you write to us through the contact form, we store your message, the time it was sent, the language and page it was sent from and, if you give them, your name and a reply email address. Messages are stored on our server, only we can read them, and they are deleted after 180 days. Your IP address is used only briefly to limit abuse and is not stored with the message.

Our server, which runs the leaderboards, the daily level and this website, is hosted by netcup GmbH in Germany. netcup processes the data on our behalf under a data processing agreement (Art. 28 GDPR).

When you visit this website or the game connects to our server, the web server writes an access log entry: your IP address, the time, the requested address and the browser or app identifier (user agent). These logs are deleted automatically after 10 days (14 days on our test system). The leaderboard application itself does not log IP addresses; to limit abuse it keeps them only briefly in memory. This website sets no analytics or advertising cookies; it only remembers your language choice in your browser.

Crash reporting: we use Google Firebase Crashlytics to find and fix crashes. When the app crashes or hits an error, a report is sent with the device model, operating-system version, app state, a technical stack trace and a Crashlytics installation ID. If you are signed in to Google Play Games, the report is also tagged with your player ID, so a recurring crash can be traced to one account. Google deletes crash reports automatically after 90 days; the in-game data deletion does not remove them sooner. We do this on the basis of our legitimate interest in a stable game.

Usage statistics: we use Google Firebase Analytics for aggregate usage and stability statistics. In the EEA, the United Kingdom and Switzerland it is switched on only if you consent in the consent prompt the app shows (to the measurement purposes), and you can withdraw that consent at any time (see “Your ad consent choices”), after which collection stops. Outside these regions, where no consent is required, it is on. This data is not sold and not used for advertising.

Some features rely on Google services. Google processes this data partly on our behalf (Firebase) and partly as an independent controller under its own privacy policy (Play Games, AdMob, Google Play):

• Google Play Games Services (sign-in, cloud save, achievements).
• Google AdMob (rewarded ads), including Google’s consent management (UMP) for the EEA, the UK, Switzerland and US states with privacy laws.
• Google Firebase (Crashlytics crash reporting and Analytics).
• Google Play (app distribution and the Remove Ads purchase).

Our own server is hosted by netcup GmbH (Germany) as our processor (see “Hosting and server logs”). We do not sell your personal data to anyone.

Our own server is in Germany. Google may process data in the United States and other countries outside the European Economic Area. For these transfers Google relies on the EU–US Data Privacy Framework, under which Google LLC is certified, and on the European Commission’s standard contractual clauses. Details are in Google’s privacy policy.

Where the GDPR applies, we process data on these bases:

• Performance of the service you use (Art. 6(1)(b) GDPR): leaderboards and the daily board, cloud save, the Remove Ads entitlement and, where available, community levels.
• Your consent (Art. 6(1)(a) GDPR, and for access to your device § 25(1) TDDDG): personalised ads and Firebase Analytics. You can withdraw consent at any time; the withdrawal does not affect processing that took place before it.
• Our legitimate interest (Art. 6(1)(f) GDPR): preventing cheating (run verification and input statistics), crash reporting, protecting our server (access logs, rate limiting) and answering your messages. If your message concerns a purchase or a service you use, the basis is also Art. 6(1)(b) GDPR.

If you are in the European Economic Area (EEA), the United Kingdom or Switzerland, the app asks for your consent before ads are personalised or analytics is used. You can review, change or withdraw that consent at any time in the app: open Settings → Game → Ad privacy → “Manage ad consent”. After a withdrawal you only see non-personalised ads and analytics stops.

If you live in a US state with a consumer privacy law (for example California), the same button lets you opt out of the sale or sharing of your personal information for advertising.

You have the right to access the data we hold about you, to have it corrected, to have it erased, to restrict its processing, to receive it in a machine-readable format (data portability), and to object to processing that is based on our legitimate interest. Where processing is based on your consent, you can withdraw it at any time.

In the game: open Settings → Game → “My leaderboard data” and choose “Export my data” or “Delete my data”. The export is a machine-readable file (JSON). Deletion permanently removes your player profile, your leaderboard and daily-board entries and your stored run recordings; your runs leave the public boards immediately.

Your display name comes from Google Play Games: change it there, and it is updated with your next leaderboard upload. You can delete your cloud save in Google Play Games, and reset local progress in the game under Settings → Game → “Reset progress”. For any other request, or if you can no longer open the game, write to info@danielnagy.dev.

Step-by-step deletion instructions, including what to do if you can no longer open the app, are on a separate page: Delete your account & data

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work or where you believe the infringement took place. In Hungary this is the National Authority for Data Protection and Freedom of Information (NAIH).

• Leaderboard and daily-board entries: kept while your account exists, or until you delete them.
• Run recordings: only the recording of your best verified run on each level is kept; recordings of slower runs are discarded automatically.
• Rejected or unverifiable submissions: deleted after 30 days.
• Web server access logs: deleted after 10 days (14 days on our test system).
• Contact form messages: deleted after 180 days.
• Crash reports: deleted automatically by Google after 90 days.
• Data on your device: kept until you reset your progress or uninstall the app. Cloud save: kept until you delete it in Google Play Games.

For recovery after a fault, the server keeps backup copies of its database: at most 4 copies, normally none older than 30 days. A copy made before you deleted your data may still contain it until that copy is removed. Backups are never used to bring deleted accounts back: if a backup is ever restored, every account deleted since that backup was made is erased again automatically before the server goes back online. For this we keep a one-way fingerprint of each deleted sign-in identity (not the identity itself) and the time of deletion.

Serpent Drift is intended for players aged 13 and over. We do not knowingly collect personal data from children under 13. Where the law of your country sets a higher age for consenting to online services (in some EU countries up to 16), a parent or guardian has to give or approve that consent. If you believe a child has given us personal data, contact us and we will delete it.

Data sent between the game and our servers is transmitted over encrypted connections. No system is perfectly secure, but we take reasonable measures to protect the limited data we hold.

We may update this policy as the game evolves. Material changes will be reflected by an updated effective date on this page.

Questions about this policy or your data: info@danielnagy.dev.

Or use the contact form: Send us a message