Privacy policy
Hug the Dot is a one-touch arcade game. We collect as little as we can. There are no accounts, names, email addresses or locations, and no analytics. The website and the itch.io version show no ads. The iOS and Android apps show an occasional full-screen ad served by Google AdMob: see Advertising in the apps for what that involves.
Who we are
The game is published by Michael Out In Manchester Limited (company number 16156173, registered office 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom), the data controller. We are registered with the Information Commissioner's Office (registration number ZB847466). Contact: [email protected]. More about the company: michaeloutinmanchester.com.
What stays on your device
The game keeps these on your device, in the browser's local storage or the app's storage. They are not sent anywhere unless stated below.
- your settings (sound, hum, vibration, light or dark);
- your best score on each course you have played, and a compact recording of your best run's finger movement, used to show your own "ghost";
- today's daily course code, and a random player id (below).
We do not use cookies or tracking technologies. Clearing the site data, or uninstalling the app, removes all of this.
What we store on our servers
When you finish a daily run, the game sends it to our server so the daily has a verified rank and an "N got this far" count. Other kinds of play (a random course, or a code you typed) are not sent, with one exception: if you tap Share on such a run, its finger path is sent once so our server can check the score and sign your link, and is discarded immediately (see "Shared results" below).
| Data | What it is | Why |
|---|---|---|
| Player id | A random code made on your device the first time you play a daily, and a random secret that proves later requests come from the same device (we store only a one-way hash of the secret). It is not linked to your name, account, device model or advertising id. | So your best run per day counts once, and so we can delete it when you ask. |
| Runs | The result of each daily run: score, time survived, highest multiplier, which daily and screen orientation, and when. The path your finger took is sent with the run so our server can re-play it and check the score, and is then discarded: we do not keep it. | Checking scores are genuine, preventing cheating, and working out ranks and counts. |
| Shared results | If you tap Share after a run, the link itself carries that run's score, time and date, signed by our server so it cannot be altered. For a daily run the server already has the run. For any other course, the run's finger path is sent to our server once, with no player id, so it can check the score and sign the link; we keep nothing from it. Anyone with the link sees those numbers (and, for a daily, the rank while that day's results are kept, 7 days). Nothing about you is shown. | Letting you challenge a friend with your result. |
| Rank data | Your best result per daily, and how many players reached each time. Other players see only numbers such as "rank 12 of 340" or "14 got this far". No names, no ids. | Showing the daily's rank and counter. |
This is pseudonymous data about how a game was played, but because the player id is unique to your device we treat it as personal data.
IP addresses. Our servers see your IP address when the game connects. We use it briefly to limit abuse (for example, someone creating thousands of ids) and we do not store it in our database. Our hosting provider processes it to deliver and protect the service and keeps short-lived operational logs under its own settings.
What we do not collect: your name, email, phone number, contacts, photos, location, device identifiers or advertising identifiers. (In the apps, Google's ad technology may use an advertising identifier; we never see it. See below.)
Why we are allowed to use it
Under UK GDPR our basis is legitimate interests: running a fair daily leaderboard, detecting cheating and keeping the service secure. We think this is proportionate because the data is minimal and pseudonymous. You can object or delete it at any time (below).
Who handles it for us
Our servers run on Cloudflare (network, serverless functions and database), which acts as our processor. Cloudflare may process data in the UK, the EU and the United States, under its data processing terms and standard contractual safeguards. We do not sell your data. Apart from Google for the ads in the apps (see below), we do not share it with anyone else. Apple and Google, as the app stores, handle their own data about your download under their own policies.
How long we keep it
- Each day's results (your runs, rank entries and the counters) are deleted automatically 7 days after that day.
- A player id is deleted automatically after 12 months without a daily run.
- You can delete everything tied to your player id yourself at any time (below).
Your rights, and how to delete your data
You can ask to see, correct, restrict or delete what we hold, and you can object to our use of it.
- Delete it yourself: on the start screen of the game, tap DELETE MY DATA (and tap again to confirm). This removes your player id and any runs and rank entries still held for it from our server and forgets the id on your device. Scores saved only on your device stay until you clear the site data or uninstall.
- Or ask us: email [email protected]. Because the id is random and has no name attached, we cannot tell which records are yours from an email alone, so the in-game button is the reliable route.
If you are unhappy with how we use your data you can complain to the Information Commissioner's Office (ico.org.uk), though we would like the chance to put it right first.
Children
Hug the Dot is a general-audience game that is not directed at children. We do not ask for or knowingly collect personal information from children under 13, and the game does not need any to work.
Advertising in the apps
The iOS and Android apps (not the website or the itch.io version) show a full-screen ad between runs now and then, served by Google AdMob (Google Ireland Limited and Google LLC). When an ad is requested, Google receives technical information from your device, which can include your IP address, an advertising identifier, your device and app details and how you interact with the ad, and uses it to choose, show and measure ads and to prevent fraud. Google is an independent controller of that data; see how Google uses information from sites or apps that use its services. We do not give Google your player id, your scores or your runs, and advertisers get nothing from us.
- Consent. Where the law requires it (the UK and the EEA), the app asks for your consent through Google's consent message before any ad is requested. You can change your mind at any time: tap AD PRIVACY on the start screen, which appears wherever the law requires that option.
- iPhone. The app asks, through Apple's prompt, whether it may track you across other companies' apps and websites. If you say no, ads are still shown, but they are less relevant, and the advertising identifier is not used.
- Android. You can reset or delete your advertising ID, and opt out of ad personalisation, in your device's settings (Settings, Privacy, Ads).
- Our legal basis for the ads is your consent where it is required, and otherwise our legitimate interest in funding a free game. The ads are limited to content suitable for teenagers and older.
Hug the Dot sells nothing. If we add purchases we will update this policy before they ship. We do not show ads to players we know to be under 16, and the game is not directed at children.
Changes to this policy
We will change this page when the game changes what it collects, and update the date at the top. Material changes will also be mentioned in the game's release notes.