Lovele Arcade Privacy Policy

Last updated 2026-11-01

This policy explains what data the Lovele Arcade app and the website lovelearcade.com process, why, and what you can do about it.

1. Who is responsible

The controller of your data is ANDIAMO SOFTWARE SRL, a company registered in Romania. Its details are at the end of this policy. For any privacy question or request, write to [email protected].

2. What we process

Account

• your email address, or your phone number if you sign in with your phone;
• your display name, @username and avatar;
• your date of birth, to check the minimum age;
• your language;
• if you sign in with Google or Apple: an identifier for that account and the email address it shares with us (with Apple, this can be a private relay address);
• an account PIN, if your account has one;
• which version of the terms you accepted, and when.

Gameplay

• the races you play, your places, results and the hero you got;
• during a race, your runner's position and moves, sent live so the other runners see you;
• points, Sparks, Hero Shards and mastery earned and spent, and daily counters (races played, daily limits, extra races from rewarded ads);
• your place on the daily Top and any prizes;
• friends, friend requests, race invites and reactions;
• the cosmetic items you own or unlock, and the look you choose for each hero.

Country

A country code, shown as a flag next to your name in races and on the Top. It comes from your account country or, if there is none, from your IP address at sign-up, looked up in the MaxMind GeoIP database on our own servers.

Device and app

• a device id, which identifies this app installation on your phone;
• the platform (Android or iOS) and the app version;
• a push token, if you allow notifications;
• the results of device integrity checks: Google Play Integrity on Android, Apple App Attest on iOS. They tell us whether the app is genuine and runs on a real device.

Sign-in checks

When you ask for a sign-in code, a short automatic check (Cloudflare Turnstile) can run to tell people from bots. It receives a check token and your IP address.

IP addresses and logs

Our servers record IP addresses and technical logs for security. We keep them for 7 days.

Ads

The app shows ads from Google AdMob. Before ads load, Google's consent form asks for your choice where the law requires it. On iOS, Apple's App Tracking Transparency (ATT) prompt also asks for your permission.

• With your consent, Google may use your advertising id (Android advertising ID, or IDFA on iOS) to show personalized ads.
• Without consent, Google shows non-personalized ads. Google may still process some data, such as the IP address and device information, to deliver ads, count them and prevent fraud.
• Players under 16 get only non-personalized ads.
• When you finish a rewarded ad, Google tells our server, with your user id, so we can give you the extra race.

Support

If you write to us, we process your email address and what you tell us.

What we do not collect

The app does not ask for your contacts, precise location, camera or microphone. We do not sell your personal data.

3. Why we process it, and our legal basis (GDPR)

• To run your account and the games: races, points, the Top, friends, invites, heroes and the shop. Basis: contract (Article 6(1)(b)).
• To check the minimum age. Basis: contract, and our legitimate interest in protecting young people (Article 6(1)(f)).
• To keep the game fair and safe: integrity checks, sign-in checks, anti-fraud, daily limits, IP logs. Basis: legitimate interest in preventing cheating and abuse (Article 6(1)(f)).
• To send push notifications, such as race invites. Basis: your consent, given in your phone's permission prompt (Article 6(1)(a)).
• To show personalized ads and use your advertising id. Basis: your consent, through Google's consent form and, on iOS, ATT (Article 6(1)(a)).
• To show non-personalized ads, which keep the app free. Basis: legitimate interest (Article 6(1)(f)).
• To give you an extra race after a rewarded ad. Basis: contract (Article 6(1)(b)).
• To answer support requests. Basis: contract or legitimate interest (Article 6(1)(b) or (f)).
• To meet legal duties, for example answering authorities. Basis: legal obligation (Article 6(1)(c)).

4. Automatic decisions

Places, points and daily limits are calculated automatically by our servers. Anti-fraud checks are also automatic. They may cancel points or pause an account. You can ask for a person to review such a decision, give your point of view and contest it. Write to [email protected].

5. Who else sees or processes your data

• Other players see your display name, @username, avatar, country flag, hero and look, your places in races and your place and points on the Top.
• Hosting: our game servers are run by a hosting provider in the European Union, under a data processing contract.
• Cloudflare, Inc.: runs the website lovelearcade.com, forwards emails sent to our addresses, passes Google's rewarded-ad confirmations to our servers, and runs the sign-in checks (Turnstile).
• Google: AdMob (ads), Firebase Cloud Messaging (push on Android), Play Integrity (integrity checks on Android), Sign in with Google. For personalized ads, Google acts as an independent controller under its own privacy policy.
• Apple: Apple Push Notification service (push on iOS), Sign in with Apple, App Attest (integrity checks on iOS).
• Expo (650 Industries, Inc.): delivers game updates and push notifications to the app. It receives technical data such as the platform, app version, IP address and push token.
• Resend: sends the emails with sign-in codes. It receives your email address and the message.
• Twilio Inc.: sends sign-in codes by SMS. It receives your phone number.
• CheckMobi: sends sign-in codes by a missed call. It receives your phone number.
• proxycheck.io: checks whether an IP address belongs to a VPN or a proxy, when you sign in and when a race starts. It receives the IP address.
• Authorities, when the law requires it.

6. Transfers outside the European Union

Google, Apple, Cloudflare, Expo, Resend, Twilio and CheckMobi may process data in the United States and in other countries. Where they do, the transfer relies on the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses. proxycheck.io is in the United Kingdom, which the European Commission recognises as giving adequate protection.

7. How long we keep it

• Account and gameplay data: while your account exists. After you ask to delete your account, 14 days, then it is deleted.
• IP addresses and server logs: 7 days.
• Records of sign-in codes sent by email, SMS or call: 90 days. They hold no code in readable form.
• Device integrity check results: 90 days.
• Push token: until you sign out, turn off notifications or delete your account.
• Support emails: 2 years after the conversation ends.
• Backups: 30 days, then they are overwritten.
• Records the law requires us to keep: for the period the law sets, even after the account is deleted.
• Data held by Google for ads: under Google's own policies.

8. Deleting your account

• In the app: open Profile and tap Delete account.
• By email: write to [email protected] from the email address of your account and ask us to delete it. We may ask you to confirm that the account is yours. We handle it within one month.
• On the web: lovelearcade.com/delete-account explains both ways.
• The account closes immediately and is deleted for good after 14 days. If you sign in again within those 14 days, the deletion is cancelled.

9. Age

• The app is for people aged 13 or over.
• We ask for your date of birth when you create an account. An account is not created if the date is below the minimum age. We do not check the date against a document.
• If you think a child under 13 has an account, write to [email protected]. We close the account and delete its data.

10. Your rights

Under the GDPR you can:

• get a copy of your data (access);
• correct wrong data;
• ask us to delete your data;
• ask us to restrict processing;
• receive your data in a portable format;
• object to processing based on legitimate interest;
• withdraw your consent at any time, without affecting what was done before.

To use these rights, write to [email protected]. We reply within one month. For complex requests this can be extended by two more months, and we tell you if so.

To change your ad choices: open Profile in the app and tap Ad privacy choices. On iOS, you can also use the Tracking setting in your phone's privacy settings. On Android you can also reset or delete your advertising ID in your phone settings.

You can complain to the Romanian data protection authority, ANSPDCP (dataprotection.ro), or to the authority in the EU country where you live or work.

11. Security

The app talks to our servers over encrypted connections (HTTPS). Sign-in tokens are kept in your phone's secure storage. Device integrity checks help stop fake apps and automated play.

12. The website

lovelearcade.com uses no cookies, no analytics and no third-party scripts. It is hosted by Cloudflare, which processes standard request data (IP address, page, time) to deliver the site and protect it against attacks.

13. Changes to this policy

We may update this policy. The date at the top shows the latest version. When a change matters to you, we tell you in the app.

14. Company details and contact

• ANDIAMO SOFTWARE SRL, a company registered in Romania
• Registered office: Strada Principala nr. 100, Beldiu, Teius, judetul Alba, 515901, Romania
• Trade register number: J2024049027004
• Tax identification code (CUI): 51032570
• Email: [email protected]

The Terms of Use also apply.